mirror of
https://github.com/projectacrn/acrn-hypervisor.git
synced 2025-06-05 05:32:05 +00:00
Project ACRN hypervisor
Issue description: ----------------- Machine Check Error on Page Size Change Instruction fetch may cause machine check error if page size and memory type was changed without invalidation on some processors[1][2]. Malicious guest kernel could trigger this issue. This issue applies to both primary page table and extended page tables (EPT), however the primary page table is controlled by hypervisor only. This patch mitigates the situation in EPT. Mitigation details: ------------------ Implement non-execute huge pages in EPT. This patch series clears the execute permission (bit 2) in the EPT entries for large pages. When EPT violation is triggered by guest instruction fetch, hypervisor converts the large page to smaller 4 KB pages and restore the execute permission, and then re-execute the guest instruction. The current patch turns on the mitigation by default. The follow-up patches will conditionally turn on/off the feature per processor model. [1] Refer to erratum KBL002 in "7th Generation Intel Processor Family and 8th Generation Intel Processor Family for U Quad Core Platforms Specification Update" https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/7th-gen-core-family-spec-update.pdf [2] Refer to erratum SKL002 in "6th Generation Intel Processor Family Specification Update" https://www.intel.com/content/www/us/en/products/docs/processors/core/desktop-6th-gen-core-family-spec-update.html Tracked-On: #4120 Signed-off-by: Binbin Wu <binbin.wu@intel.com> Reviewed-by: Eddie Dong <eddie.dong@intel.com> |
||
---|---|---|
.travis-dockerfiles | ||
devicemodel | ||
doc | ||
efi-stub | ||
hypervisor | ||
scripts | ||
tools | ||
.checkpatch.conf | ||
.gitignore | ||
.travis.yml | ||
CODEOWNERS | ||
LICENSE | ||
Makefile | ||
README.rst | ||
VERSION |
Project ACRN Embedded Hypervisor ################################ The open source project ACRN defines a device hypervisor reference stack and an architecture for running multiple software subsystems, managed securely, on a consolidated system by means of a virtual machine manager. It also defines a reference framework implementation for virtual device emulation, called the "ACRN Device Model". The ACRN Hypervisor is a Type 1 reference hypervisor stack, running directly on the bare-metal hardware, and is suitable for a variety of IoT and embedded device solutions. The ACRN hypervisor addresses the gap that currently exists between datacenter hypervisors, and hard partitioning hypervisors. The ACRN hypervisor architecture partitions the system into different functional domains, with carefully selected guest OS sharing optimizations for IoT and embedded devices. .. start_include_here Community Support ***************** The Project ACRN Developer Community includes developers from member organizations and the general community all joining in the development of software within the project. Members contribute and discuss ideas, submit bugs and bug fixes. They also help those in need through the community's forums such as mailing lists and IRC channels. Anyone can join the developer community and the community is always willing to help its members and the User Community to get the most out of Project ACRN. Welcome to the project ARCN community! We're now holding weekly Technical Community Meetings and encourage you to call in and learn more about the project. Meeting information is on the `TCM Meeting page`_ in our `ACRN wiki <https://wiki.projectacrn.org/>`_. .. _TCM Meeting page: https://github.com/projectacrn/acrn-hypervisor/wiki/ACRN-Committee-and-Working-Group-Meetings#technical-community-meetings Resources ********* Here's a quick summary of resources to find your way around the Project ACRN support systems: * **Project ACRN Website**: The https://projectacrn.org website is the central source of information about the project. On this site, you'll find background and current information about the project as well as relevant links to project material. For a quick start, refer to the `Introduction`_ and `Getting Started Guide`_. * **Source Code in GitHub**: Project ACRN source code is maintained on a public GitHub repository at https://github.com/projectacrn/acrn-hypervisor. You'll find information about getting access to the repository and how to contribute to the project in this `Contribution Guide`_ document. * **Documentation**: Project technical documentation is developed along with the project's code, and can be found at https://projectacrn.github.io. Additional documentation is maintained in the `Project ACRN GitHub wiki`_. * **Issue Reporting and Tracking**: Requirements and Issue tracking is done in the Github issues system: https://github.com/projectacrn/acrn-hypervisor/issues. You can browse through the reported issues and submit issues of your own. * **Mailing List**: The `Project ACRN Development mailing list`_ is perhaps the most convenient way to track developer discussions and to ask your own support questions to the project ACRN community. There are also specific `ACRN mailing list subgroups`_ for builds, users, and Technical Steering Committee notes, for example. You can read through the message archives to follow past posts and discussions, a good thing to do to discover more about the project. .. _Introduction: https://projectacrn.github.io/latest/introduction/ .. _Getting Started Guide: https://projectacrn.github.io/latest/getting_started/ .. _Contribution Guide: https://projectacrn.github.io/latest/contribute.html .. _Project ACRN GitHub wiki: https://github.com/projectacrn/acrn-hypervisor/wiki .. _Project ACRN Development mailing list: https://lists.projectacrn.org/g/acrn-dev .. _ACRN mailing list subgroups: https://lists.projectacrn.org/g/main/subgroups