[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen staging-4.7] xen/x86: support per-domain flag for xpti
commit 53c6a024699165314a02fde4f427148cda8546fb Author: Juergen Gross <jgross@xxxxxxxx> AuthorDate: Thu Apr 26 13:33:12 2018 +0200 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Tue May 29 10:43:44 2018 +0200 xen/x86: support per-domain flag for xpti Instead of switching XPTI globally on or off add a per-domain flag for that purpose. This allows to modify the xpti boot parameter to support running dom0 without Meltdown mitigations. Using "xpti=no-dom0" as boot parameter will achieve that. Move the xpti boot parameter handling to xen/arch/x86/pv/domain.c as it is pv-domain specific. Signed-off-by: Juergen Gross <jgross@xxxxxxxx> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx> --- docs/misc/xen-command-line.markdown | 14 ++++++- xen/arch/x86/domain.c | 7 ++++ xen/arch/x86/domain_build.c | 1 + xen/arch/x86/mm.c | 17 ++++++++- xen/arch/x86/setup.c | 19 ---------- xen/arch/x86/smpboot.c | 4 +- xen/arch/x86/spec_ctrl.c | 75 ++++++++++++++++++++++++++++++++++++- xen/include/asm-x86/current.h | 3 +- xen/include/asm-x86/domain.h | 3 ++ xen/include/asm-x86/flushtlb.h | 2 +- xen/include/asm-x86/spec_ctrl.h | 4 ++ 11 files changed, 120 insertions(+), 29 deletions(-) diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown index b4e009c7ce..843b3e82ba 100644 --- a/docs/misc/xen-command-line.markdown +++ b/docs/misc/xen-command-line.markdown @@ -1717,14 +1717,24 @@ clustered mode. The default, given no hint from the **FADT**, is cluster mode. ### xpti -> `= <boolean>` +> `= List of [ default | <boolean> | dom0=<bool> | domu=<bool> ]` -> Default: `false` on AMD hardware +> Default: `false` on hardware not to be vulnerable to Meltdown (e.g. AMD) > Default: `true` everywhere else Override default selection of whether to isolate 64-bit PV guest page tables. +`true` activates page table isolation even on hardware not vulnerable by +Meltdown for all domains. + +`false` deactivates page table isolation on all systems for all domains. + +`default` sets the default behaviour. + +With `dom0` and `domu` it is possible to control page table isolation +for dom0 or guest domains only. + ### xsave > `= <boolean>` diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index aa81f9e1f2..bb421435c4 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -394,6 +394,8 @@ int switch_compat(struct domain *d) d->arch.x87_fip_width = 4; + d->arch.pv_domain.xpti = 0; + return 0; undo_and_fail: @@ -667,9 +669,14 @@ int arch_domain_create(struct domain *d, unsigned int domcr_flags, goto fail; } else + { /* 64-bit PV guest by default. */ d->arch.is_32bit_pv = d->arch.has_32bit_shinfo = 0; + d->arch.pv_domain.xpti = opt_xpti & (is_hardware_domain(d) + ? OPT_XPTI_DOM0 : OPT_XPTI_DOMU); + } + /* initialize default tsc behavior in case tools don't */ tsc_set_info(d, TSC_MODE_DEFAULT, 0UL, 0, 0); spin_lock_init(&d->arch.vtsc_lock); diff --git a/xen/arch/x86/domain_build.c b/xen/arch/x86/domain_build.c index d449535891..cdb7b66617 100644 --- a/xen/arch/x86/domain_build.c +++ b/xen/arch/x86/domain_build.c @@ -1001,6 +1001,7 @@ int __init construct_dom0( if ( compat32 ) { d->arch.is_32bit_pv = d->arch.has_32bit_shinfo = 1; + d->arch.pv_domain.xpti = 0; v->vcpu_info = (void *)&d->shared_info->compat.vcpu_info[0]; if ( setup_compat_arg_xlat(v) != 0 ) BUG(); diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 12adc1e1b4..54f7351644 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -499,8 +499,21 @@ void make_cr3(struct vcpu *v, unsigned long mfn) void write_ptbase(struct vcpu *v) { - get_cpu_info()->root_pgt_changed = 1; - switch_cr3(v->arch.cr3); + struct cpu_info *cpu_info = get_cpu_info(); + + if ( is_pv_vcpu(v) && v->domain->arch.pv_domain.xpti ) + { + cpu_info->root_pgt_changed = 1; + cpu_info->pv_cr3 = __pa(this_cpu(root_pgt)); + switch_cr3(v->arch.cr3); + } + else + { + /* Make sure to clear xen_cr3 before pv_cr3; switch_cr3() serializes. */ + cpu_info->xen_cr3 = 0; + switch_cr3(v->arch.cr3); + cpu_info->pv_cr3 = 0; + } } /* diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 0ad69d02bb..6ce807bf6d 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -112,9 +112,6 @@ struct cpuinfo_x86 __read_mostly boot_cpu_data = { 0, 0, 0, 0, -1 }; unsigned long __read_mostly mmu_cr4_features = XEN_MINIMAL_CR4; -static int8_t __initdata opt_xpti = -1; -boolean_param("xpti", opt_xpti); - bool_t __read_mostly acpi_disabled; bool_t __initdata acpi_force; static char __initdata acpi_param[10] = ""; @@ -1424,22 +1421,6 @@ void __init noreturn __start_xen(unsigned long mbi_p) cr4_pv32_mask = mmu_cr4_features & XEN_CR4_PV32_BITS; - if ( opt_xpti < 0 ) - { - uint64_t caps = 0; - - if ( boot_cpu_data.x86_vendor == X86_VENDOR_AMD ) - caps = ARCH_CAPABILITIES_RDCL_NO; - else if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) ) - rdmsrl(MSR_ARCH_CAPABILITIES, caps); - - opt_xpti = !(caps & ARCH_CAPABILITIES_RDCL_NO); - } - if ( opt_xpti ) - setup_clear_cpu_cap(X86_FEATURE_NO_XPTI); - else - __set_bit(X86_FEATURE_NO_XPTI, boot_cpu_data.x86_capability); - if ( cpu_has_fsgsbase ) set_in_cr4(X86_CR4_FSGSBASE); diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c index bb3b1eccb7..9caba91b7d 100644 --- a/xen/arch/x86/smpboot.c +++ b/xen/arch/x86/smpboot.c @@ -322,7 +322,7 @@ void start_secondary(void *unused) spin_debug_disable(); get_cpu_info()->xen_cr3 = 0; - get_cpu_info()->pv_cr3 = this_cpu(root_pgt) ? __pa(this_cpu(root_pgt)) : 0; + get_cpu_info()->pv_cr3 = 0; load_system_tables(); @@ -1047,7 +1047,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) panic("Error %d setting up PV root page table\n", rc); if ( per_cpu(root_pgt, 0) ) { - get_cpu_info()->pv_cr3 = __pa(per_cpu(root_pgt, 0)); + get_cpu_info()->pv_cr3 = 0; /* * All entry points which may need to switch page tables have to start diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c index e2a3fdb561..d8528e30c5 100644 --- a/xen/arch/x86/spec_ctrl.c +++ b/xen/arch/x86/spec_ctrl.c @@ -233,8 +233,9 @@ static void __init print_details(enum ind_thunk thunk, uint64_t caps) boot_cpu_has(X86_FEATURE_SC_MSR_HVM) ? " MSR_SPEC_CTRL" : "", boot_cpu_has(X86_FEATURE_SC_RSB_HVM) ? " RSB" : ""); - printk("XPTI: %s\n", - boot_cpu_has(X86_FEATURE_NO_XPTI) ? "disabled" : "enabled"); + printk(" XPTI (64-bit PV only): Dom0 %s, DomU %s\n", + opt_xpti & OPT_XPTI_DOM0 ? "enabled" : "disabled", + opt_xpti & OPT_XPTI_DOMU ? "enabled" : "disabled"); } /* Calculate whether Retpoline is known-safe on this CPU. */ @@ -320,6 +321,70 @@ static bool_t __init retpoline_safe(uint64_t caps) } } +#define OPT_XPTI_DEFAULT 0xff +uint8_t __read_mostly opt_xpti = OPT_XPTI_DEFAULT; + +static __init void xpti_init_default(bool_t force) +{ + uint64_t caps = 0; + + if ( !force && (opt_xpti != OPT_XPTI_DEFAULT) ) + return; + + if ( boot_cpu_data.x86_vendor == X86_VENDOR_AMD ) + caps = ARCH_CAPABILITIES_RDCL_NO; + else if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) ) + rdmsrl(MSR_ARCH_CAPABILITIES, caps); + + if ( caps & ARCH_CAPABILITIES_RDCL_NO ) + opt_xpti = 0; + else + opt_xpti = OPT_XPTI_DOM0 | OPT_XPTI_DOMU; +} + +static __init int parse_xpti(char *s) +{ + char *ss; + int val, rc = 0; + + xpti_init_default(0); + + do { + ss = strchr(s, ','); + if ( ss ) + *ss = '\0'; + + switch ( parse_bool(s) ) + { + case 0: + opt_xpti = 0; + break; + + case 1: + opt_xpti = OPT_XPTI_DOM0 | OPT_XPTI_DOMU; + break; + + default: + if ( !strcmp(s, "default") ) + xpti_init_default(1); + else if ( (val = parse_boolean("dom0", s, ss)) >= 0 ) + opt_xpti = (opt_xpti & ~OPT_XPTI_DOM0) | + (val ? OPT_XPTI_DOM0 : 0); + else if ( (val = parse_boolean("domu", s, ss)) >= 0 ) + opt_xpti = (opt_xpti & ~OPT_XPTI_DOMU) | + (val ? OPT_XPTI_DOMU : 0); + else + rc = -EINVAL; + break; + } + + s = ss + 1; + } while ( ss ); + + return rc; +} +custom_param("xpti", parse_xpti); + void __init init_speculation_mitigations(void) { enum ind_thunk thunk = THUNK_DEFAULT; @@ -461,6 +526,12 @@ void __init init_speculation_mitigations(void) if ( default_xen_spec_ctrl ) __set_bit(X86_FEATURE_SC_MSR_IDLE, boot_cpu_data.x86_capability); + xpti_init_default(0); + if ( opt_xpti == 0 ) + __set_bit(X86_FEATURE_NO_XPTI, boot_cpu_data.x86_capability); + else + setup_clear_cpu_cap(X86_FEATURE_NO_XPTI); + print_details(thunk, caps); /* diff --git a/xen/include/asm-x86/current.h b/xen/include/asm-x86/current.h index e4c6b0224a..7baa737c7c 100644 --- a/xen/include/asm-x86/current.h +++ b/xen/include/asm-x86/current.h @@ -45,7 +45,8 @@ struct cpu_info { /* * Of the two following fields the latter is being set to the CR3 value * to be used on the given pCPU for loading whenever 64-bit PV guest - * context is being entered. The value never changes once set. + * context is being entered. A value of zero indicates no setting of CR3 + * is to be performed. * The former is the value to restore when re-entering Xen, if any. IOW * its value being zero means there's nothing to restore. However, its * value can also be negative, indicating to the exit-to-Xen code that diff --git a/xen/include/asm-x86/domain.h b/xen/include/asm-x86/domain.h index af80e7d172..c495c119e1 100644 --- a/xen/include/asm-x86/domain.h +++ b/xen/include/asm-x86/domain.h @@ -257,6 +257,9 @@ struct pv_domain atomic_t nr_l4_pages; + /* XPTI active? */ + bool_t xpti; + /* map_domain_page() mapping cache. */ struct mapcache_domain mapcache; diff --git a/xen/include/asm-x86/flushtlb.h b/xen/include/asm-x86/flushtlb.h index ab855f9393..9b73eb7c80 100644 --- a/xen/include/asm-x86/flushtlb.h +++ b/xen/include/asm-x86/flushtlb.h @@ -136,7 +136,7 @@ void flush_area_mask(const cpumask_t *, const void *va, unsigned int flags); #define flush_root_pgtbl_domain(d) \ { \ - if ( !cpu_has_no_xpti && is_pv_domain(d) && !is_pv_32bit_domain(d) ) \ + if ( is_pv_domain(d) && (d)->arch.pv_domain.xpti ) \ flush_mask((d)->domain_dirty_cpumask, FLUSH_ROOT_PGTBL); \ } diff --git a/xen/include/asm-x86/spec_ctrl.h b/xen/include/asm-x86/spec_ctrl.h index dd084d2d4d..45ac200f11 100644 --- a/xen/include/asm-x86/spec_ctrl.h +++ b/xen/include/asm-x86/spec_ctrl.h @@ -33,6 +33,10 @@ extern bool_t bsp_delay_spec_ctrl; extern uint8_t default_xen_spec_ctrl; extern uint8_t default_spec_ctrl_flags; +extern uint8_t opt_xpti; +#define OPT_XPTI_DOM0 0x01 +#define OPT_XPTI_DOMU 0x02 + static inline void init_shadow_spec_ctrl_state(void) { struct cpu_info *info = get_cpu_info(); -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.7 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxxxxxxxxx https://lists.xenproject.org/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |