File 5afc13ae-5-x86-introduce-spec-ctrl-cmdline-opt.... of Package xen.11319

Overview Repositories Revisions Requests Users Attributes Meta

File 5afc13ae-5-x86-introduce-spec-ctrl-cmdline-opt.patch of Package xen.11319

# Commit 3352afc26c497d26ecb70527db3cb29daf7b1422
# Date 2018-05-16 12:19:10 +0100
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/spec_ctrl: Introduce a new `spec-ctrl=` command line argument to replace `bti=`

In hindsight, the options for `bti=` aren't as flexible or useful as expected
(including several options which don't appear to behave as intended).
Changing the behaviour of an existing option is problematic for compatibility,
so introduce a new `spec-ctrl=` in the hopes that we can do better.

One common way of deploying Xen is with a single PV dom0 and all domUs being
HVM domains.  In such a setup, an administrator who has weighed up the risks
may wish to forgo protection against malicious PV domains, to reduce the
overall performance hit.  To cater for this usecase, `spec-ctrl=no-pv` will
disable all speculative protection for PV domains, while leaving all
speculative protection for HVM domains intact.

For coding clarity as much as anything else, the suboptions are grouped by
logical area; those which affect the alternatives blocks, and those which
affect Xen's in-hypervisor settings.  See the xen-command-line.markdown for
full details of the new options.

While changing the command line options, take the time to change how the data
is reported to the user.  The three DEBUG printks are upgraded to unilateral,
as they are all relevant pieces of information, and the old "mitigations:"
line is split in the two logical areas described above.

Sample output from booting with `spec-ctrl=no-pv` looks like:

(XEN) Speculative mitigation facilities:
  (XEN)   Hardware features: IBRS/IBPB STIBP IBPB
  (XEN)   Compiled-in support: INDIRECT_THUNK
  (XEN)   Xen settings: BTI-Thunk RETPOLINE, SPEC_CTRL: IBRS-, Other: IBPB
  (XEN)   Support for VMs: PV: None, HVM: MSR_SPEC_CTRL RSB
  (XEN)   XPTI (64-bit PV only): Dom0 enabled, DomU enabled

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -203,6 +203,9 @@ and reboots.
 ### bti (x86)
 > `= List of [ ibrs=<bool>, ibpb=<bool>, rsb_{vmexit,native}=<bool> ]`
 
+**WARNING: This command line option is deprecated, and superseded by
+_spec-ctrl=_ - using both options in combination is undefined.**
+
 On hardware supporting IBRS, the `ibrs=` option can be used to force or
 prevent Xen using the feature itself.  If Xen is not using IBRS itself,
 functionality is still set up so IBRS can be virtualised for guests.
@@ -980,6 +983,52 @@ Flag to enable Supervisor Mode Execution
 ### snb\_igd\_quirk
 > `= <boolean>`
 
+### spec-ctrl (x86)
+> `= List of [ <bool>, xen=<bool>, {pv,hvm,msr-sc,rsb}=<bool>,
+>              bti-thunk=retpoline|lfence|jmp, {ibrs,ibpb}=<bool> ]`
+
+Controls for speculative execution sidechannel mitigations.  By default, Xen
+will pick the most appropriate mitigations based on compiled in support,
+loaded microcode, and hardware details, and will virtualise appropriate
+mitigations for guests to use.
+
+**WARNING: Any use of this option may interfere with heuristics.  Use with
+extreme care.**
+
+An overall boolean value, `spec-ctrl=no`, can be specified to turn off all
+mitigations, including pieces of infrastructure used to virtualise certain
+mitigation features for guests.  Alternatively, a slightly more restricted
+`spec-ctrl=no-xen` can be used to turn off all of Xen's mitigations, while
+leaving the virtualisation support in place for guests to use.  Use of a
+positive boolean value for either of these options is invalid.
+
+The booleans `pv=`, `hvm=`, `msr-sc=` and `rsb=` offer fine grained control
+over the alternative blocks used by Xen.  These impact Xen's ability to
+protect itself, and Xen's ability to virtualise support for guests to use.
+
+* `pv=` and `hvm=` offer control over all suboptions for PV and HVM guests
+  respectively.
+* `msr-sc=` offers control over Xen's support for manipulating MSR\_SPEC\_CTRL
+  on entry and exit.  These blocks are necessary to virtualise support for
+  guests and if disabled, guests will be unable to use IBRS/STIBP/etc.
+* `rsb=` offers control over whether to overwrite the Return Stack Buffer /
+  Return Address Stack on entry to Xen.
+
+If Xen was compiled with INDIRECT\_THUNK support, `bti-thunk=` can be used to
+select which of the thunks gets patched into the `__x86_indirect_thunk_%reg`
+locations.  The default thunk is `retpoline` (generally preferred for Intel
+hardware), with the alternatives being `jmp` (a `jmp *%reg` gadget, minimal
+overhead), and `lfence` (an `lfence; jmp *%reg` gadget, preferred for AMD).
+
+On hardware supporting IBRS (Indirect Branch Restricted Speculation), the
+`ibrs=` option can be used to force or prevent Xen using the feature itself.
+If Xen is not using IBRS itself, functionality is still set up so IBRS can be
+virtualised for guests.
+
+On hardware supporting IBPB (Indirect Branch Prediction Barrier), the `ibpb=`
+option can be used to force (the default) or prevent Xen from issuing branch
+prediction barriers on vcpu context switches.
+
 ### sync\_console
 > `= <boolean>`
 
--- a/xen/arch/x86/spec_ctrl.c
+++ b/xen/arch/x86/spec_ctrl.c
@@ -24,6 +24,13 @@
 #include <asm/processor.h>
 #include <asm/spec_ctrl.h>
 
+/* Cmdline controls for Xen's alternative blocks. */
+static bool_t __initdata opt_msr_sc_pv = 1;
+static bool_t __initdata opt_msr_sc_hvm = 1;
+static bool_t __initdata opt_rsb_pv = 1;
+static bool_t __initdata opt_rsb_hvm = 1;
+
+/* Cmdline controls for Xen's speculative settings. */
 enum ind_thunk {
     THUNK_DEFAULT, /* Decide which thunk to use at boot time. */
     THUNK_NONE,    /* Missing compiler support for thunks. */
@@ -31,8 +38,6 @@ enum ind_thunk {
     THUNK_RETPOLINE,
 };
 static int8_t __initdata opt_ibrs = -1;
-static bool_t __initdata opt_rsb_pv = 1;
-static bool_t __initdata opt_rsb_hvm = 1;
 bool_t __read_mostly opt_ibpb = 1;
 
 bool_t __initdata bsp_delay_spec_ctrl;
@@ -67,6 +72,77 @@ static int __init parse_bti(const char *
 }
 custom_param("bti", parse_bti);
 
+static int __init parse_spec_ctrl(char *s)
+{
+    char *ss;
+    int val, rc = 0;
+
+    do {
+        ss = strchr(s, ',');
+        if ( ss )
+            *ss = '\0';
+
+        /* Global and Xen-wide disable. */
+        val = parse_bool(s);
+        if ( !val )
+        {
+            opt_msr_sc_pv = 0;
+            opt_msr_sc_hvm = 0;
+
+        disable_common:
+            opt_rsb_pv = 0;
+            opt_rsb_hvm = 0;
+
+            opt_ibrs = 0;
+            opt_ibpb = 0;
+        }
+        else if ( val > 0 )
+            rc = -EINVAL;
+        else if ( (val = parse_boolean("xen", s, ss)) >= 0 )
+        {
+            if ( !val )
+                goto disable_common;
+
+            rc = -EINVAL;
+        }
+
+        /* Xen's alternative blocks. */
+        else if ( (val = parse_boolean("pv", s, ss)) >= 0 )
+        {
+            opt_msr_sc_pv = val;
+            opt_rsb_pv = val;
+        }
+        else if ( (val = parse_boolean("hvm", s, ss)) >= 0 )
+        {
+            opt_msr_sc_hvm = val;
+            opt_rsb_hvm = val;
+        }
+        else if ( (val = parse_boolean("msr-sc", s, ss)) >= 0 )
+        {
+            opt_msr_sc_pv = val;
+            opt_msr_sc_hvm = val;
+        }
+        else if ( (val = parse_boolean("rsb", s, ss)) >= 0 )
+        {
+            opt_rsb_pv = val;
+            opt_rsb_hvm = val;
+        }
+
+        /* Xen's speculative sidechannel mitigation settings. */
+        else if ( (val = parse_boolean("ibrs", s, ss)) >= 0 )
+            opt_ibrs = val;
+        else if ( (val = parse_boolean("ibpb", s, ss)) >= 0 )
+            opt_ibpb = val;
+        else
+            rc = -EINVAL;
+
+        s = ss + 1;
+    } while ( ss );
+
+    return rc;
+}
+custom_param("spec-ctrl", parse_spec_ctrl);
+
 static void __init print_details(enum ind_thunk thunk, uint64_t caps)
 {
     unsigned int _7d0 = 0, e8b = 0, tmp;
@@ -77,10 +153,10 @@ static void __init print_details(enum in
     if ( cpuid_eax(0x80000000) >= 0x80000008 )
         cpuid(0x80000008, &tmp, &e8b, &tmp, &tmp);
 
-    printk(XENLOG_DEBUG "Speculative mitigation facilities:\n");
+    printk("Speculative mitigation facilities:\n");
 
     /* Hardware features which pertain to speculative mitigations. */
-    printk(XENLOG_DEBUG "  Hardware features:%s%s%s%s%s%s\n",
+    printk("  Hardware features:%s%s%s%s%s%s\n",
            (_7d0 & cpufeat_mask(X86_FEATURE_IBRSB)) ? " IBRS/IBPB" : "",
            (_7d0 & cpufeat_mask(X86_FEATURE_STIBP)) ? " STIBP"     : "",
            (e8b  & cpufeat_mask(X86_FEATURE_IBPB))  ? " IBPB"      : "",
@@ -90,17 +166,24 @@ static void __init print_details(enum in
 
     /* Compiled-in support which pertains to BTI mitigations. */
 #ifdef CONFIG_INDIRECT_THUNK
-    printk(XENLOG_DEBUG "  Compiled-in support: INDIRECT_THUNK\n");
+    printk("  Compiled-in support: INDIRECT_THUNK\n");
 #endif
 
-    printk("BTI mitigations: Thunk %s, Others:%s%s%s%s\n",
+    /* Settings for Xen's protection, irrespective of guests. */
+    printk("  Xen settings: BTI-Thunk %s, SPEC_CTRL: %s, Other:%s\n",
            thunk == THUNK_NONE      ? "N/A" :
            thunk == THUNK_RETPOLINE ? "RETPOLINE" : "?",
            default_xen_spec_ctrl < 0 ? "" :
            default_xen_spec_ctrl & SPEC_CTRL_IBRS ? " IBRS+" : " IBRS-",
-           opt_ibpb                 ? " IBPB"  : "",
-           default_xen_rsb & XEN_RSB_NATIVE ? " RSB_NATIVE" : "",
-           default_xen_rsb & XEN_RSB_VMEXIT ? " RSB_VMEXIT" : "");
+           opt_ibpb                 ? " IBPB"  : "");
+
+    printk("  Support for VMs: PV:%s%s%s, HVM:%s%s%s\n",
+           opt_msr_sc_pv || opt_rsb_pv   ? ""               : " None",
+           opt_msr_sc_pv                 ? " MSR_SPEC_CTRL" : "",
+           opt_rsb_pv                    ? " RSB"           : "",
+           opt_msr_sc_hvm || opt_rsb_hvm ? ""               : " None",
+           opt_msr_sc_hvm                ? " MSR_SPEC_CTRL" : "",
+           opt_rsb_hvm                   ? " RSB"           : "");
 
     printk("XPTI: %s\n", opt_xpti ? "enabled" : "disabled");
 }
@@ -135,15 +218,11 @@ void __init init_speculation_mitigations
         thunk = THUNK_RETPOLINE;
 
     if ( boot_cpu_has(X86_FEATURE_IBRSB) )
-    {
-        /*
-         * Even if we've chosen to not have IBRS set in Xen context, we still
-         * need the IBRS entry/exit logic to virtualise IBRS support for
-         * guests.
-         */
         default_xen_spec_ctrl = ibrs ? SPEC_CTRL_IBRS : 0;
-    }
 
+    if ( default_xen_spec_ctrl < 0 )
+       opt_msr_sc_pv = opt_msr_sc_hvm = 0;
+
     /*
      * PV guests can poison the RSB to any virtual address from which
      * they can execute a call instruction.  This is necessarily outside
--- a/xen/include/asm-x86/cpufeature.h
+++ b/xen/include/asm-x86/cpufeature.h
@@ -218,6 +218,7 @@
 #define cpu_has_svm		boot_cpu_has(X86_FEATURE_SVM)
 
 #define cpu_has_vmx		boot_cpu_has(X86_FEATURE_VMXE)
+#define cpu_has_hypervisor	boot_cpu_has(X86_FEATURE_HYPERVISOR)
 
 #define cpu_has_cpuid_faulting	boot_cpu_has(X86_FEATURE_CPUID_FAULTING)
 #define cpu_has_lfence_dispatch boot_cpu_has(X86_FEATURE_LFENCE_DISPATCH)

Places

File 5afc13ae-5-x86-introduce-spec-ctrl-cmdline-opt.patch of Package xen.11319

Places