Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:Update
xen.8425
5b72fbbf-8-x86-option-to-control-L1D_FLUSH-for-...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 5b72fbbf-8-x86-option-to-control-L1D_FLUSH-for-HVM-HAP.patch of Package xen.8425
# Commit 3bd36952dab60290f33d6791070b57920e10754b # Date 2018-08-14 16:56:47 +0100 # Author Andrew Cooper <andrew.cooper3@citrix.com> # Committer Andrew Cooper <andrew.cooper3@citrix.com> x86/spec-ctrl: Introduce an option to control L1D_FLUSH for HVM HAP guests This mitigation requires up-to-date microcode, and is enabled by default on affected hardware if available, and is used for HVM guests The default for SMT/Hyperthreading is far more complicated to reason about, not least because we don't know if the user is going to want to run any HVM guests to begin with. If a explicit default isn't given, nag the user to perform a risk assessment and choose an explicit default, and leave other configuration to the toolstack. This is part of XSA-273 / CVE-2018-3620. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> --- a/docs/misc/xen-command-line.markdown +++ b/docs/misc/xen-command-line.markdown @@ -1037,7 +1037,8 @@ Control bring up of multiple hyper-threa ### spec-ctrl (x86) > `= List of [ <bool>, xen=<bool>, {pv,hvm,msr-sc,rsb}=<bool>, -> bti-thunk=retpoline|lfence|jmp, {ibrs,ibpb,ssbd,eager-fpu}=<bool> ]` +> bti-thunk=retpoline|lfence|jmp, {ibrs,ibpb,ssbd,eager-fpu, +> l1d-flush}=<bool> ]` Controls for speculative execution sidechannel mitigations. By default, Xen will pick the most appropriate mitigations based on compiled in support, @@ -1092,6 +1093,12 @@ from using fully eager FPU context switc a global control. By default, Xen will choose to use fully eager context switches on hardware believed to speculate past #NM exceptions. +On hardware supporting L1D_FLUSH, the `l1d-flush=` option can be used to force +or prevent Xen from issuing an L1 data cache flush on each VMEntry. +Irrespective of Xen's setting, the feature is virtualised for HVM guests to +use. By default, Xen will enable this mitigation on hardware believed to be +vulnerable to L1TF. + ### sync\_console > `= <boolean>` --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -38,6 +38,7 @@ #include <xen/kernel.h> #include <xen/keyhandler.h> #include <asm/shadow.h> +#include <asm/spec_ctrl.h> #include <asm/tboot.h> static bool_t __read_mostly opt_vpid_enabled = 1; @@ -1160,6 +1161,10 @@ static int construct_vmcs(struct vcpu *v vmx_vlapic_msr_changed(v); } + if ( opt_l1d_flush && paging_mode_hap(d) ) + rc = vmx_add_msr(v, MSR_FLUSH_CMD, VMX_MSR_GUEST_LOADONLY) + ?: vmx_write_guest_loadonly_msr(v, MSR_FLUSH_CMD, FLUSH_CMD_L1D); + out: vmx_vmcs_exit(v); --- a/xen/arch/x86/spec_ctrl.c +++ b/xen/arch/x86/spec_ctrl.c @@ -22,6 +22,7 @@ #include <asm/msr.h> #include <asm/processor.h> +#include <asm/setup.h> #include <asm/spec_ctrl.h> /* Cmdline controls for Xen's alternative blocks. */ @@ -41,6 +42,7 @@ static int8_t __initdata opt_ibrs = -1; bool_t __read_mostly opt_ibpb = 1; bool_t __read_mostly opt_ssbd = 0; int8_t __read_mostly opt_eager_fpu = -1; +int8_t __read_mostly opt_l1d_flush = -1; bool_t __initdata bsp_delay_spec_ctrl; int8_t __read_mostly default_xen_spec_ctrl = -1; @@ -104,6 +106,7 @@ static int __init parse_spec_ctrl(char * opt_ibrs = 0; opt_ibpb = 0; opt_ssbd = 0; + opt_l1d_flush = 0; } else if ( val > 0 ) rc = -EINVAL; @@ -146,6 +149,8 @@ static int __init parse_spec_ctrl(char * opt_ssbd = val; else if ( (val = parse_boolean("eager-fpu", s, ss)) >= 0 ) opt_eager_fpu = val; + else if ( (val = parse_boolean("l1d-flush", s, ss)) >= 0 ) + opt_l1d_flush = val; else rc = -EINVAL; @@ -236,7 +241,7 @@ static void __init print_details(enum in #endif /* Settings for Xen's protection, irrespective of guests. */ - printk(" Xen settings: BTI-Thunk %s, SPEC_CTRL: %s%s, Other:%s\n", + printk(" Xen settings: BTI-Thunk %s, SPEC_CTRL: %s%s, Other:%s%s\n", thunk == THUNK_NONE ? "N/A" : thunk == THUNK_RETPOLINE ? "RETPOLINE" : "?", default_xen_spec_ctrl < 0 ? "" : @@ -244,7 +249,8 @@ static void __init print_details(enum in default_xen_spec_ctrl < 0 || !boot_cpu_has(X86_FEATURE_SSBD) ? "" : (default_xen_spec_ctrl & SPEC_CTRL_SSBD) ? " SSBD+" : " SSBD-", - opt_ibpb ? " IBPB" : ""); + opt_ibpb ? " IBPB" : "", + opt_l1d_flush ? " L1D_FLUSH" : ""); /* L1TF diagnostics, printed if vulnerable or PV shadowing is in use. */ if ( cpu_has_bug_l1tf || opt_pv_l1tf ) @@ -649,6 +655,34 @@ void __init init_speculation_mitigations opt_pv_l1tf = OPT_PV_L1TF_DOMU; } + /* + * By default, enable L1D_FLUSH on L1TF-vulnerable hardware, unless + * instructed to skip the flush on vmentry by our outer hypervisor. + */ + if ( !boot_cpu_has(X86_FEATURE_L1D_FLUSH) ) + opt_l1d_flush = 0; + else if ( opt_l1d_flush == -1 ) + opt_l1d_flush = cpu_has_bug_l1tf && !(caps & ARCH_CAPS_SKIP_L1DFL); + + /* + * We do not disable HT by default on affected hardware. + * + * Firstly, if the user intends to use exclusively PV, or HVM shadow + * guests, HT isn't a concern and should remain fully enabled. Secondly, + * safety for HVM HAP guests can be arranged by the toolstack with core + * parking, pinning or cpupool configurations, including mixed setups. + * + * However, if we are on affected hardware, with HT enabled, and the user + * hasn't explicitly chosen whether to use HT or not, nag them to do so. + */ + if ( opt_smt == -1 && cpu_has_bug_l1tf && + boot_cpu_data.x86_num_siblings > 1 ) + printk("**************************************************************\n" + "* Booted on L1TF-vulnerable hardware with SMT/Hyperthreading *\n" + "* enabled. Please assess your configuration and choose an *\n" + "* explicit 'smt=<bool>' setting. See XSA-273. *\n" + "**************************************************************\n"); + print_details(thunk, caps); /* --- a/xen/include/asm-x86/hvm/vmx/vmcs.h +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h @@ -538,6 +538,19 @@ static inline int vmx_write_guest_msr(st return 0; } +static inline int vmx_write_guest_loadonly_msr(struct vcpu *v, uint32_t msr, + uint64_t val) +{ + struct vmx_msr_entry *ent = vmx_find_msr(v, msr, VMX_MSR_GUEST_LOADONLY); + + if ( !ent ) + return -ESRCH; + + ent->data = val; + + return 0; +} + void vmx_disable_intercept_for_msr(struct vcpu *v, u32 msr, int type); void vmx_enable_intercept_for_msr(struct vcpu *v, u32 msr, int type); void vmx_vmcs_switch(struct vmcs_struct *from, struct vmcs_struct *to); --- a/xen/include/asm-x86/spec_ctrl.h +++ b/xen/include/asm-x86/spec_ctrl.h @@ -29,6 +29,7 @@ extern bool_t opt_ibpb; extern bool_t opt_ssbd; extern bool_t opt_msr_sc_pv, opt_msr_sc_hvm; extern int8_t opt_eager_fpu; +extern int8_t opt_l1d_flush; extern bool_t bsp_delay_spec_ctrl; extern int8_t default_xen_spec_ctrl;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
