[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen stable-4.12] x86/spec-ctrl: Allow the RDRAND/RDSEED features to be hidden
commit d58c48df8c6ca819f5e6e6f1740bb114f24f024f Author: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> AuthorDate: Wed Jun 10 18:57:00 2020 +0100 Commit: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> CommitDate: Thu Jun 11 16:28:04 2020 +0100 x86/spec-ctrl: Allow the RDRAND/RDSEED features to be hidden RDRAND/RDSEED can be hidden using cpuid= to mitigate SRBDS if microcode isn't available. This is part of XSA-320 / CVE-2020-0543. Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> Acked-by: Julien Grall <jgrall@xxxxxxxxxx> (cherry picked from commit 7028534d8482d25860c4d1aa8e45f0b911abfc5a) --- docs/misc/xen-command-line.pandoc | 10 ++++++++-- xen/arch/x86/cpuid.c | 10 ++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc index 337fbf0492..7897da55ca 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -481,12 +481,18 @@ choice of `dom0-kernel` is deprecated and not supported by all Dom0 kernels. This option allows for fine tuning of the facilities Xen will use, after accounting for hardware capabilities as enumerated via CPUID. +Unless otherwise noted, options only have any effect in their negative form, +to hide the named feature(s). Ignoring a feature using this mechanism will +cause Xen not to use the feature, nor offer them as usable to guests. + Currently accepted: The Speculation Control hardware features `srbds-ctrl`, `md-clear`, `ibrsb`, `stibp`, `ibpb`, `l1d-flush` and `ssbd` are used by default if available and -applicable. They can be ignored, e.g. `no-ibrsb`, at which point Xen won't -use them itself, and won't offer them to guests. +applicable. They can all be ignored. + +`rdrand` and `rdseed` can be ignored, as a mitigation to XSA-320 / +CVE-2020-0543. ### cpuid_mask_cpu > `= fam_0f_rev_[cdefg] | fam_10_rev_[bc] | fam_11_rev_b` diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c index 22d8c71a95..d07567c901 100644 --- a/xen/arch/x86/cpuid.c +++ b/xen/arch/x86/cpuid.c @@ -64,6 +64,16 @@ static int __init parse_xen_cpuid(const char *s) if ( !val ) setup_clear_cpu_cap(X86_FEATURE_SRBDS_CTRL); } + else if ( (val = parse_boolean("rdrand", s, ss)) >= 0 ) + { + if ( !val ) + setup_clear_cpu_cap(X86_FEATURE_RDRAND); + } + else if ( (val = parse_boolean("rdseed", s, ss)) >= 0 ) + { + if ( !val ) + setup_clear_cpu_cap(X86_FEATURE_RDSEED); + } else rc = -EINVAL; -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.12
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |