[Xen-changelog] [xen stable-4.7] x86/cpuid: Improvements to guest policies for speculative sidechannel features

[patchbot@xxxxxxx]

commit 9299683d5911a4c44916099379932fed4e78c248
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue May 29 10:36:12 2018 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue May 29 10:36:12 2018 +0200

    x86/cpuid: Improvements to guest policies for speculative sidechannel 
features
    
    If Xen isn't virtualising MSR_SPEC_CTRL for guests, IBRSB shouldn't be
    advertised.  It is not currently possible to express this via the existing
    command line options, but such an ability will be introduced.
    
    Another useful option in some usecases is to offer IBPB without IBRS.  When 
a
    guest kernel is known to be compatible (uses retpoline and knows about the 
AMD
    IBPB feature bit), an administrator with pre-Skylake hardware may wish to 
hide
    IBRS.  This allows the VM to have full protection, without Xen or the VM
    needing to touch MSR_SPEC_CTRL, which can reduce the overhead of Spectre
    mitigations.
    
    Break the logic common to both PV and HVM CPUID calculations into a common
    helper, to avoid duplication.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: cb06b308ec71b23f37a44f5e2351fe2cae0306e9
    master date: 2018-05-16 12:19:10 +0100
---
 xen/arch/x86/cpuid.c | 60 ++++++++++++++++++++++++++++++++--------------------
 1 file changed, 37 insertions(+), 23 deletions(-)

diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c
index fffcecd878..bade364554 100644
--- a/xen/arch/x86/cpuid.c
+++ b/xen/arch/x86/cpuid.c
@@ -136,6 +136,28 @@ static void __init calculate_raw_featureset(void)
               &tmp, &tmp);
 }
 
+static void __init guest_common_feature_adjustments(uint32_t *fs)
+{
+    /* Unconditionally claim to be able to set the hypervisor bit. */
+    __set_bit(X86_FEATURE_HYPERVISOR, fs);
+
+    /*
+     * If IBRS is offered to the guest, unconditionally offer STIBP.  It is a
+     * nop on non-HT hardware, and has this behaviour to make heterogeneous
+     * setups easier to manage.
+     */
+    if ( test_bit(X86_FEATURE_IBRSB, fs) )
+        __set_bit(X86_FEATURE_STIBP, fs);
+
+    /*
+     * On hardware which supports IBRS/IBPB, we can offer IBPB independently
+     * of IBRS by using the AMD feature bit.  An administrator may wish for
+     * performance reasons to offer IBPB without IBRS.
+     */
+    if ( boot_cpu_has(X86_FEATURE_IBRSB) )
+        __set_bit(X86_FEATURE_IBPB, fs);
+}
+
 static void __init calculate_pv_featureset(void)
 {
     unsigned int i;
@@ -143,9 +165,6 @@ static void __init calculate_pv_featureset(void)
     for ( i = 0; i < FSCAPINTS; ++i )
         pv_featureset[i] = host_featureset[i] & pv_featuremask[i];
 
-    /* Unconditionally claim to be able to set the hypervisor bit. */
-    __set_bit(X86_FEATURE_HYPERVISOR, pv_featureset);
-
     /*
      * Allow the toolstack to set HTT, X2APIC and CMP_LEGACY.  These bits
      * affect how to interpret topology information in other cpuid leaves.
@@ -154,15 +173,14 @@ static void __init calculate_pv_featureset(void)
     __set_bit(X86_FEATURE_X2APIC, pv_featureset);
     __set_bit(X86_FEATURE_CMP_LEGACY, pv_featureset);
 
-    /* On hardware with IBRS/IBPB support, there are further adjustments. */
-    if ( test_bit(X86_FEATURE_IBRSB, pv_featureset) )
-    {
-        /* Offer STIBP unconditionally.  It is a nop on non-HT hardware. */
-        __set_bit(X86_FEATURE_STIBP, pv_featureset);
+    /*
+     * If Xen isn't virtualising MSR_SPEC_CTRL for PV guests because of
+     * administrator choice, hide the feature.
+     */
+    if ( !boot_cpu_has(X86_FEATURE_SC_MSR_PV) )
+        __clear_bit(X86_FEATURE_IBRSB, pv_featureset);
 
-        /* AMD's IBPB is a subset of IBRS/IBPB. */
-        __set_bit(X86_FEATURE_IBPB, pv_featureset);
-    }
+    guest_common_feature_adjustments(pv_featureset);
 
     sanitise_featureset(pv_featureset);
 }
@@ -181,9 +199,6 @@ static void __init calculate_hvm_featureset(void)
     for ( i = 0; i < FSCAPINTS; ++i )
         hvm_featureset[i] = host_featureset[i] & hvm_featuremask[i];
 
-    /* Unconditionally claim to be able to set the hypervisor bit. */
-    __set_bit(X86_FEATURE_HYPERVISOR, hvm_featureset);
-
     /*
      * Allow the toolstack to set HTT, X2APIC and CMP_LEGACY.  These bits
      * affect how to interpret topology information in other cpuid leaves.
@@ -208,6 +223,13 @@ static void __init calculate_hvm_featureset(void)
         __set_bit(X86_FEATURE_SEP, hvm_featureset);
 
     /*
+     * If Xen isn't virtualising MSR_SPEC_CTRL for HVM guests because of
+     * administrator choice, hide the feature.
+     */
+    if ( !boot_cpu_has(X86_FEATURE_SC_MSR_HVM) )
+        __clear_bit(X86_FEATURE_IBRSB, hvm_featureset);
+
+    /*
      * With VT-x, some features are only supported by Xen if dedicated
      * hardware support is also available.
      */
@@ -220,15 +242,7 @@ static void __init calculate_hvm_featureset(void)
             __clear_bit(X86_FEATURE_XSAVES, hvm_featureset);
     }
 
-    /* On hardware with IBRS/IBPB support, there are further adjustments. */
-    if ( test_bit(X86_FEATURE_IBRSB, hvm_featureset) )
-    {
-        /* Offer STIBP unconditionally.  It is a nop on non-HT hardware. */
-        __set_bit(X86_FEATURE_STIBP, hvm_featureset);
-
-        /* AMD's IBPB is a subset of IBRS/IBPB. */
-        __set_bit(X86_FEATURE_IBPB, hvm_featureset);
-    }
+    guest_common_feature_adjustments(hvm_featureset);
 
     sanitise_featureset(hvm_featureset);
 }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog