@@ -202,6 +202,17 @@ to appropriate auditing by Xen. Argo is disabled by default.
This option is disabled by default, to protect domains from a DoS by a
buggy or malicious other domain spamming the ring.
+### asi (x86)
+> `= <boolean>`
+
+> Default: `false`
+
+Offers control over whether the hypervisor will engage in Address Space
+Isolation, by not having potentially sensitive information permanently mapped
+in the directmap. Enabling this option populates the directmap sparsely on
+demand, blocking exploits that leak secrets via speculative memory access in
+the directmap.
+
### asid (x86)
> `= <boolean>`
@@ -23,6 +23,7 @@ config X86
select HAS_IOPORTS
select HAS_KEXEC
select HAS_NS16550
+ select HAS_ONDEMAND_DIRECTMAP
select HAS_PASSTHROUGH
select HAS_PCI
select HAS_PCI_MSI
@@ -643,11 +643,17 @@ void write_32bit_pse_identmap(uint32_t *l2);
/*
* x86 maps part of physical memory via the directmap region.
* Return whether the range of MFN falls in the directmap region.
+ *
+ * Enabling ASI on the commandline (i.e: using the `asi=` option) causes the
+ * directmap to be mostly empty, so this always returns false in that case.
*/
static inline bool arch_mfns_in_directmap(unsigned long mfn, unsigned long nr)
{
unsigned long eva = min(DIRECTMAP_VIRT_END, HYPERVISOR_VIRT_END);
+ if ( !has_directmap() )
+ return false;
+
return (mfn + nr) <= (virt_to_mfn(eva - 1) + 1);
}
@@ -85,6 +85,11 @@ static int8_t __initdata opt_gds_mit = -1;
static int8_t __initdata opt_div_scrub = -1;
bool __ro_after_init opt_bp_spec_reduce = true;
+#ifdef CONFIG_ONDEMAND_DIRECTMAP
+bool __ro_after_init opt_ondemand_dmap;
+boolean_param("asi", opt_ondemand_dmap);
+#endif
+
static int __init cf_check parse_spec_ctrl(const char *s)
{
const char *ss;
@@ -633,6 +638,8 @@ static void __init print_details(enum ind_thunk thunk)
cpu_has_bug_l1tf ? "" : " not",
l1d_maxphysaddr, paddr_bits, l1tf_safe_maddr);
+ printk(" ASI: %s", !has_directmap() ? "enabled" : "disabled");
+
/*
* Alternatives blocks for protecting against and/or virtualising
* mitigation support for guests.
@@ -74,6 +74,9 @@ config HAS_KEXEC
config HAS_LLC_COLORING
bool
+config HAS_ONDEMAND_DIRECTMAP
+ bool
+
config HAS_PIRQ
bool
@@ -214,6 +217,24 @@ config SPECULATIVE_HARDEN_LOCK
If unsure, say Y.
+config ONDEMAND_DIRECTMAP
+ bool "On-Demand Directmap"
+ depends on HAS_ONDEMAND_DIRECTMAP
+ help
+ Contemporary processors may use speculative execution as a
+ performance optimisation, but this can potentially be abused by an
+ attacker to leak data via speculative sidechannels.
+
+ When enabled, this option provides defense in depth by preventing
+ most RAM from being constantly mapped on the hypervisor, thereby
+ greatly reducing the scope of data leaks after a successful
+ speculative attack.
+
+ This option is disabled by default at run time, and needs to be
+ enabled on the command line.
+
+ If unsure, say N.
+
endmenu
config DIT_DEFAULT
@@ -169,6 +169,17 @@ extern unsigned long max_page;
extern unsigned long total_pages;
extern paddr_t mem_hotplug;
+#ifdef CONFIG_ONDEMAND_DIRECTMAP
+extern bool opt_ondemand_dmap;
+
+static inline bool has_directmap(void)
+{
+ return !opt_ondemand_dmap;
+}
+#else
+#define has_directmap() true
+#endif
+
/*
* Extra fault info types which are used to further describe
* the source of an access violation.