From patchwork Thu Jan 16 16:00:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Igor Druzhinin X-Patchwork-Id: 11337355 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E1A351820 for ; Thu, 16 Jan 2020 16:01:47 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id BDB63207FF for ; Thu, 16 Jan 2020 16:01:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=citrix.com header.i=@citrix.com header.b="ZxdQWflz" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BDB63207FF Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=citrix.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1is7ZD-0007vj-PD; Thu, 16 Jan 2020 16:00:19 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1is7ZC-0007ve-Hf for xen-devel@lists.xenproject.org; Thu, 16 Jan 2020 16:00:18 +0000 X-Inumbo-ID: 452806d0-3879-11ea-a985-bc764e2007e4 Received: from esa1.hc3370-68.iphmx.com (unknown [216.71.145.142]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 452806d0-3879-11ea-a985-bc764e2007e4; Thu, 16 Jan 2020 16:00:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1579190409; h=from:to:cc:subject:date:message-id:mime-version; bh=5R2V5+tIVMkTgKNkpcdcHLvGCSEp357re7PioKsT3TM=; b=ZxdQWflzfW7sxHYOM1oHPUB3B2H4Tpir6CsYqrHtAwlduc54BErfBJRB wEqJi2xL8udHVBnXIs38KFHB+wZeJngvN764jyB+X49RCshhjRnf4kBPk y5QYqATRNBhMUpinVXlbQFNFtUY7uWrJIbqaleryAUZ8lGBTt/EVPy9wG I=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none; spf=None smtp.pra=igor.druzhinin@citrix.com; spf=Pass smtp.mailfrom=igor.druzhinin@citrix.com; spf=None smtp.helo=postmaster@mail.citrix.com Received-SPF: None (esa1.hc3370-68.iphmx.com: no sender authenticity information available from domain of igor.druzhinin@citrix.com) identity=pra; client-ip=162.221.158.21; receiver=esa1.hc3370-68.iphmx.com; envelope-from="igor.druzhinin@citrix.com"; x-sender="igor.druzhinin@citrix.com"; x-conformance=sidf_compatible Received-SPF: Pass (esa1.hc3370-68.iphmx.com: domain of igor.druzhinin@citrix.com designates 162.221.158.21 as permitted sender) identity=mailfrom; client-ip=162.221.158.21; receiver=esa1.hc3370-68.iphmx.com; envelope-from="igor.druzhinin@citrix.com"; x-sender="igor.druzhinin@citrix.com"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:209.167.231.154 ip4:178.63.86.133 ip4:195.66.111.40/30 ip4:85.115.9.32/28 ip4:199.102.83.4 ip4:192.28.146.160 ip4:192.28.146.107 ip4:216.52.6.88 ip4:216.52.6.188 ip4:162.221.158.21 ip4:162.221.156.83 ip4:168.245.78.127 ~all" Received-SPF: None (esa1.hc3370-68.iphmx.com: no sender authenticity information available from domain of postmaster@mail.citrix.com) identity=helo; client-ip=162.221.158.21; receiver=esa1.hc3370-68.iphmx.com; envelope-from="igor.druzhinin@citrix.com"; x-sender="postmaster@mail.citrix.com"; x-conformance=sidf_compatible IronPort-SDR: k9HR0y3BI9tmGKywhQc6plfVMHhqVRIYOOIVs2X+B5kR4TGY8i7UOk2lvvF/K+0ok5Hvu0rkwt Z5GzoSsAL7zv4I0A3+oqBw+p9kJ27xJ82HdeC5YT0tYnxAoXdI+LHm4qU8ForAsQnKINxpGQNG LkU6Ec6myQSB4glyiDCOalQZSk6nT4z4J2qZvFGCUBajP+HJNZ2mOLnDSGw10e3b8HfsyWqDki 9vwosi5Gf9N7L3qNYdjLuFMA68iFjxjd12hUNi0Jb6PgDJNbjUVyZBNAHXMlWasuf44AYHxGGz NFo= X-SBRS: 2.7 X-MesageID: 11190833 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.70,326,1574139600"; d="scan'208";a="11190833" From: Igor Druzhinin To: Date: Thu, 16 Jan 2020 16:00:03 +0000 Message-ID: <1579190403-23720-1-git-send-email-igor.druzhinin@citrix.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Subject: [Xen-devel] [PATCH] x86/sm{e, a}p: do not enable SMEP/SMAP in PV shim by default on AMD X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Igor Druzhinin , sstabellini@kernel.org, julien@xen.org, wl@xen.org, konrad.wilk@oracle.com, George.Dunlap@eu.citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, jbeulich@suse.com, roger.pau@citrix.com Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Due to AMD and Hygon being unable to selectively trap CR4 bit modifications running 32-bit PV guest inside PV shim comes with significant performance hit. Moreover, for SMEP in particular every time CR4.SMEP changes on context switch to/from 32-bit PV guest, it gets trapped by L0 Xen which then tries to perform global TLB invalidation for PV shim domain. This usually results in eventual hang of a PV shim with at least several vCPUs. Since the overall security risk is generally lower for shim Xen as it being there more of a defense-in-depth mechanism, choose to disable SMEP/SMAP in it by default on AMD and Hygon unless a user chose otherwise. Signed-off-by: Igor Druzhinin Reviewed-by: Jan Beulich Reviewed-by: Roger Pau Monné --- I'm a little bit on the fence with this one. We're having the same issue with general nested virt but I'm not inclined to trade security for a user in general case. Disabling it by default for PV shim only seems rather inocuous due to the use case restricion. I'd like to hear more opinions. --- docs/misc/xen-command-line.pandoc | 10 ++++++++-- xen/arch/x86/setup.c | 20 ++++++++++++++------ 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc index 981a5e2..05b2dde 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -1936,19 +1936,25 @@ is 1MB. ### smap (x86) > `= | hvm` -> Default: `true` +> Default: `true` unless running in pv-shim mode on AMD or Hygon hardware Flag to enable Supervisor Mode Access Prevention Use `smap=hvm` to allow SMAP use by HVM guests only. +In PV shim mode on AMD or Hygon hardware due to significant perfomance impact +in some cases and generally lower security risk the option defaults to false. + ### smep (x86) > `= | hvm` -> Default: `true` +> Default: `true` unless running in pv-shim mode on AMD or Hygon hardware Flag to enable Supervisor Mode Execution Protection Use `smep=hvm` to allow SMEP use by HVM guests only. +In PV shim mode on AMD or Hygon hardware due to significant perfomance impact +in some cases and generally lower security risk the option defaults to false. + ### smt (x86) > `= ` diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 5bdc229..8432b77 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -105,9 +105,9 @@ struct cpuinfo_x86 __read_mostly boot_cpu_data = { 0, 0, 0, 0, -1 }; unsigned long __read_mostly mmu_cr4_features = XEN_MINIMAL_CR4; -/* smep: Enable/disable Supervisor Mode Execution Protection (default on). */ -#define SMEP_HVM_ONLY (-1) -static s8 __initdata opt_smep = 1; +/* smep: Enable/disable Supervisor Mode Execution Protection */ +#define SMEP_HVM_ONLY (-2) +static s8 __initdata opt_smep = -1; /* * Initial domain place holder. Needs to be global so it can be created in @@ -142,9 +142,9 @@ static int __init parse_smep_param(const char *s) } custom_param("smep", parse_smep_param); -/* smap: Enable/disable Supervisor Mode Access Prevention (default on). */ -#define SMAP_HVM_ONLY (-1) -static s8 __initdata opt_smap = 1; +/* smap: Enable/disable Supervisor Mode Access Prevention */ +#define SMAP_HVM_ONLY (-2) +static s8 __initdata opt_smap = -1; static int __init parse_smap_param(const char *s) { @@ -1616,6 +1616,14 @@ void __init noreturn __start_xen(unsigned long mbi_p) set_in_cr4(X86_CR4_OSFXSR | X86_CR4_OSXMMEXCPT); + /* Do not enable SMEP/SMAP in PV shim on AMD and Hygon by default */ + if ( opt_smep == -1 ) + opt_smep = !pv_shim || !(boot_cpu_data.x86_vendor & + (X86_VENDOR_AMD | X86_VENDOR_HYGON)); + if ( opt_smap == -1 ) + opt_smap = !pv_shim || !(boot_cpu_data.x86_vendor & + (X86_VENDOR_AMD | X86_VENDOR_HYGON)); + if ( !opt_smep ) setup_clear_cpu_cap(X86_FEATURE_SMEP); if ( cpu_has_smep && opt_smep != SMEP_HVM_ONLY )