From nobody Fri May 3 07:37:09 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail(p=none dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1579190475; cv=none; d=zohomail.com; s=zohoarc; b=bEZhjFcrpRV7MEoaLoxSCrkhKxxpuQ6/vje0RjphjfggErZxFCVdKpAZE8nK0t1LAvO0a1dETgFrRRWgco0ME/xMOvY/gjixibKYf8BBgyBuJGejjpfGbX+yo7Z1geMae307pyeZMvPlcUvezawOmajtvxsNWBe1U+o/t6tzPxU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1579190475; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=ps1b5c/AwYYc809z9GyMYVGIHi6uANCyjlDNz6ibmmM=; b=jGxbAnIDR9RxVIo7yfUXsKnK8MRAF3rfiKb4oIH5YJWwV4uGqTRw7BU3v69Iuws0SdIDGAX6PwXFQ+1BALeH9lj7P/0s0XeQ73bO9jr8Il3vemF4/96aTsqtTwAe5UK9EtRykdc5Ool5+Bdh3Opz9Uuj/G2Mc7AzRMQC0r2v8z4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 157919047504859.19835357874558; Thu, 16 Jan 2020 08:01:15 -0800 (PST) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1is7ZD-0007vj-PD; Thu, 16 Jan 2020 16:00:19 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1is7ZC-0007ve-Hf for xen-devel@lists.xenproject.org; Thu, 16 Jan 2020 16:00:18 +0000 Received: from esa1.hc3370-68.iphmx.com (unknown [216.71.145.142]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 452806d0-3879-11ea-a985-bc764e2007e4; Thu, 16 Jan 2020 16:00:09 +0000 (UTC) X-Inumbo-ID: 452806d0-3879-11ea-a985-bc764e2007e4 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1579190409; h=from:to:cc:subject:date:message-id:mime-version; bh=5R2V5+tIVMkTgKNkpcdcHLvGCSEp357re7PioKsT3TM=; b=ZxdQWflzfW7sxHYOM1oHPUB3B2H4Tpir6CsYqrHtAwlduc54BErfBJRB wEqJi2xL8udHVBnXIs38KFHB+wZeJngvN764jyB+X49RCshhjRnf4kBPk y5QYqATRNBhMUpinVXlbQFNFtUY7uWrJIbqaleryAUZ8lGBTt/EVPy9wG I=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none; spf=None smtp.pra=igor.druzhinin@citrix.com; spf=Pass smtp.mailfrom=igor.druzhinin@citrix.com; spf=None smtp.helo=postmaster@mail.citrix.com Received-SPF: none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Received-SPF: None (esa1.hc3370-68.iphmx.com: no sender authenticity information available from domain of igor.druzhinin@citrix.com) identity=pra; client-ip=162.221.158.21; receiver=esa1.hc3370-68.iphmx.com; envelope-from="igor.druzhinin@citrix.com"; x-sender="igor.druzhinin@citrix.com"; x-conformance=sidf_compatible Received-SPF: Pass (esa1.hc3370-68.iphmx.com: domain of igor.druzhinin@citrix.com designates 162.221.158.21 as permitted sender) identity=mailfrom; client-ip=162.221.158.21; receiver=esa1.hc3370-68.iphmx.com; envelope-from="igor.druzhinin@citrix.com"; x-sender="igor.druzhinin@citrix.com"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:209.167.231.154 ip4:178.63.86.133 ip4:195.66.111.40/30 ip4:85.115.9.32/28 ip4:199.102.83.4 ip4:192.28.146.160 ip4:192.28.146.107 ip4:216.52.6.88 ip4:216.52.6.188 ip4:162.221.158.21 ip4:162.221.156.83 ip4:168.245.78.127 ~all" Received-SPF: None (esa1.hc3370-68.iphmx.com: no sender authenticity information available from domain of postmaster@mail.citrix.com) identity=helo; client-ip=162.221.158.21; receiver=esa1.hc3370-68.iphmx.com; envelope-from="igor.druzhinin@citrix.com"; x-sender="postmaster@mail.citrix.com"; x-conformance=sidf_compatible IronPort-SDR: k9HR0y3BI9tmGKywhQc6plfVMHhqVRIYOOIVs2X+B5kR4TGY8i7UOk2lvvF/K+0ok5Hvu0rkwt Z5GzoSsAL7zv4I0A3+oqBw+p9kJ27xJ82HdeC5YT0tYnxAoXdI+LHm4qU8ForAsQnKINxpGQNG LkU6Ec6myQSB4glyiDCOalQZSk6nT4z4J2qZvFGCUBajP+HJNZ2mOLnDSGw10e3b8HfsyWqDki 9vwosi5Gf9N7L3qNYdjLuFMA68iFjxjd12hUNi0Jb6PgDJNbjUVyZBNAHXMlWasuf44AYHxGGz NFo= X-SBRS: 2.7 X-MesageID: 11190833 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.70,326,1574139600"; d="scan'208";a="11190833" From: Igor Druzhinin To: Date: Thu, 16 Jan 2020 16:00:03 +0000 Message-ID: <1579190403-23720-1-git-send-email-igor.druzhinin@citrix.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Subject: [Xen-devel] [PATCH] x86/sm{e, a}p: do not enable SMEP/SMAP in PV shim by default on AMD X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Igor Druzhinin , sstabellini@kernel.org, julien@xen.org, wl@xen.org, konrad.wilk@oracle.com, George.Dunlap@eu.citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, jbeulich@suse.com, roger.pau@citrix.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Due to AMD and Hygon being unable to selectively trap CR4 bit modifications running 32-bit PV guest inside PV shim comes with significant performance hit. Moreover, for SMEP in particular every time CR4.SMEP changes on context switch to/from 32-bit PV guest, it gets trapped by L0 Xen which then tries to perform global TLB invalidation for PV shim domain. This usually results in eventual hang of a PV shim with at least several vCPUs. Since the overall security risk is generally lower for shim Xen as it being there more of a defense-in-depth mechanism, choose to disable SMEP/SMAP in it by default on AMD and Hygon unless a user chose otherwise. Signed-off-by: Igor Druzhinin Reviewed-by: Jan Beulich Reviewed-by: Roger Pau Monn=C3=A9 --- I'm a little bit on the fence with this one. We're having the same issue wi= th general nested virt but I'm not inclined to trade security for a user in general case. Disabling it by default for PV shim only seems rather inocuous due to the use case restricion. I'd like to hear more opinions. --- docs/misc/xen-command-line.pandoc | 10 ++++++++-- xen/arch/x86/setup.c | 20 ++++++++++++++------ 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line= .pandoc index 981a5e2..05b2dde 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -1936,19 +1936,25 @@ is 1MB. ### smap (x86) > `=3D | hvm` =20 -> Default: `true` +> Default: `true` unless running in pv-shim mode on AMD or Hygon hardware =20 Flag to enable Supervisor Mode Access Prevention Use `smap=3Dhvm` to allow SMAP use by HVM guests only. =20 +In PV shim mode on AMD or Hygon hardware due to significant perfomance imp= act +in some cases and generally lower security risk the option defaults to fal= se. + ### smep (x86) > `=3D | hvm` =20 -> Default: `true` +> Default: `true` unless running in pv-shim mode on AMD or Hygon hardware =20 Flag to enable Supervisor Mode Execution Protection Use `smep=3Dhvm` to allow SMEP use by HVM guests only. =20 +In PV shim mode on AMD or Hygon hardware due to significant perfomance imp= act +in some cases and generally lower security risk the option defaults to fal= se. + ### smt (x86) > `=3D ` =20 diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 5bdc229..8432b77 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -105,9 +105,9 @@ struct cpuinfo_x86 __read_mostly boot_cpu_data =3D { 0,= 0, 0, 0, -1 }; =20 unsigned long __read_mostly mmu_cr4_features =3D XEN_MINIMAL_CR4; =20 -/* smep: Enable/disable Supervisor Mode Execution Protection (default on).= */ -#define SMEP_HVM_ONLY (-1) -static s8 __initdata opt_smep =3D 1; +/* smep: Enable/disable Supervisor Mode Execution Protection */ +#define SMEP_HVM_ONLY (-2) +static s8 __initdata opt_smep =3D -1; =20 /* * Initial domain place holder. Needs to be global so it can be created in @@ -142,9 +142,9 @@ static int __init parse_smep_param(const char *s) } custom_param("smep", parse_smep_param); =20 -/* smap: Enable/disable Supervisor Mode Access Prevention (default on). */ -#define SMAP_HVM_ONLY (-1) -static s8 __initdata opt_smap =3D 1; +/* smap: Enable/disable Supervisor Mode Access Prevention */ +#define SMAP_HVM_ONLY (-2) +static s8 __initdata opt_smap =3D -1; =20 static int __init parse_smap_param(const char *s) { @@ -1616,6 +1616,14 @@ void __init noreturn __start_xen(unsigned long mbi_p) =20 set_in_cr4(X86_CR4_OSFXSR | X86_CR4_OSXMMEXCPT); =20 + /* Do not enable SMEP/SMAP in PV shim on AMD and Hygon by default */ + if ( opt_smep =3D=3D -1 ) + opt_smep =3D !pv_shim || !(boot_cpu_data.x86_vendor & + (X86_VENDOR_AMD | X86_VENDOR_HYGON)); + if ( opt_smap =3D=3D -1 ) + opt_smap =3D !pv_shim || !(boot_cpu_data.x86_vendor & + (X86_VENDOR_AMD | X86_VENDOR_HYGON)); + if ( !opt_smep ) setup_clear_cpu_cap(X86_FEATURE_SMEP); if ( cpu_has_smep && opt_smep !=3D SMEP_HVM_ONLY ) --=20 2.7.4 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel