x86: disable XPTI when RDCL_NO

Use the respective ARCH_CAPABILITIES MSR bit, but don't expose the MSR
to guests yet.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
master commit: bee0732d2066691d8204e418d10110930ee4d4f8
master date: 2018-04-05 15:48:23 +0100

diff --git a/tools/libxl/libxl_cpuid.c b/tools/libxl/libxl_cpuid.c
index 279b3c3c320847406e3e3be634c43287c85823ba..041b64a5098672e269fd23754b5f4b3ad540f529 100644 (file)
--- a/tools/libxl/libxl_cpuid.c
+++ b/tools/libxl/libxl_cpuid.c
@@ -160,6 +160,7 @@ int libxl_cpuid_parse_config(libxl_cpuid_policy_list *cpuid, const char* str)
         {"fpu",          0x00000001, NA, CPUID_REG_EDX,  0,  1},
         {"ibrsb",        0x00000007,  0, CPUID_REG_EDX, 26,  1},
         {"stibp",        0x00000007,  0, CPUID_REG_EDX, 27,  1},
+        {"arch-caps",    0x00000007,  0, CPUID_REG_EDX, 29,  1},
         {"topoext",      0x80000001, NA, CPUID_REG_ECX, 22,  1},
         {"tbm",          0x80000001, NA, CPUID_REG_ECX, 21,  1},
         {"nodeid",       0x80000001, NA, CPUID_REG_ECX, 19,  1},

diff --git a/tools/misc/xen-cpuid.c b/tools/misc/xen-cpuid.c
index 0981366e06f4c04692f215ac60054c298e56a11f..06a9c7fffcc040979babbdc207b88c125dc2a4ea 100644 (file)
--- a/tools/misc/xen-cpuid.c
+++ b/tools/misc/xen-cpuid.c
@@ -152,8 +152,9 @@ static const char *str_7d0[32] =
     [0 ... 25] = "REZ",
 
     [26] = "ibrsb",         [27] = "stibp",
+    [28] = "REZ",           [29] = "arch_caps",
 
-    [28 ... 31] = "REZ",
+    [30 ... 31] = "REZ",
 };
 
 static struct {

diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c
index 04cb0fe8f01758737c2440995f7e0cfbf4ababda..43007c59d9c08d591372ed3b1a2c41b4ff8ffeae 100644 (file)
--- a/xen/arch/x86/cpu/common.c
+++ b/xen/arch/x86/cpu/common.c
@@ -430,6 +430,9 @@ void identify_cpu(struct cpuinfo_x86 *c)
                if (test_bit(X86_FEATURE_RSB_VMEXIT,
                             boot_cpu_data.x86_capability))
                        __set_bit(X86_FEATURE_RSB_VMEXIT, c->x86_capability);
+               if (test_bit(X86_FEATURE_NO_XPTI,
+                            boot_cpu_data.x86_capability))
+                       __set_bit(X86_FEATURE_NO_XPTI, c->x86_capability);
 
                /* AND the already accumulated flags with these */
                for ( i = 0 ; i < NCAPINTS ; i++ )

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 3824fa8810fc665ac60ea94ebdb97aa3e0b36f51..ec323ecc7e478b10f78653c08f3bcfcdf44a5eb0 100644 (file)
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4011,7 +4011,7 @@ long do_mmu_update(
                      * to the page lock we hold, its pinned status, and uses on
                      * this (v)CPU.
                      */
-                    if ( !rc && this_cpu(root_pgt) &&
+                    if ( !rc && !cpu_has_no_xpti &&
                          ((page->u.inuse.type_info & PGT_count_mask) >
                           (1 + !!(page->u.inuse.type_info & PGT_pinned) +
                            (pagetable_get_pfn(curr->arch.guest_table) == mfn) +

diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index f5051e3e35b6dffb325f8bdc05d343907dc06e39..e04a1e4595e008f9650510bdb90fbe392eda76c5 100644 (file)
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -112,6 +112,9 @@ struct cpuinfo_x86 __read_mostly boot_cpu_data = { 0, 0, 0, 0, -1 };
 
 unsigned long __read_mostly mmu_cr4_features = XEN_MINIMAL_CR4;
 
+static int8_t __initdata opt_xpti = -1;
+boolean_param("xpti", opt_xpti);
+
 bool_t __read_mostly acpi_disabled;
 bool_t __initdata acpi_force;
 static char __initdata acpi_param[10] = "";
@@ -1421,6 +1424,22 @@ void __init noreturn __start_xen(unsigned long mbi_p)
 
     cr4_pv32_mask = mmu_cr4_features & XEN_CR4_PV32_BITS;
 
+    if ( opt_xpti < 0 )
+    {
+        uint64_t caps = 0;
+
+        if ( boot_cpu_data.x86_vendor == X86_VENDOR_AMD )
+            caps = ARCH_CAPABILITIES_RDCL_NO;
+        else if ( boot_cpu_has(X86_FEATURE_ARCH_CAPS) )
+            rdmsrl(MSR_ARCH_CAPABILITIES, caps);
+
+        opt_xpti = !(caps & ARCH_CAPABILITIES_RDCL_NO);
+    }
+    if ( opt_xpti )
+        setup_clear_cpu_cap(X86_FEATURE_NO_XPTI);
+    else
+        __set_bit(X86_FEATURE_NO_XPTI, boot_cpu_data.x86_capability);
+
     if ( cpu_has_fsgsbase )
         set_in_cr4(X86_CR4_FSGSBASE);
 

diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
index a2451ef73d6fb7e7d2c2ceb38961c0aeb03f0521..51c24faf3938e64839466687b799b0205e799e7f 100644 (file)
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -748,8 +748,6 @@ static int clone_mapping(const void *ptr, root_pgentry_t *rpt)
     return 0;
 }
 
-static __read_mostly int8_t opt_xpti = -1;
-boolean_param("xpti", opt_xpti);
 DEFINE_PER_CPU(root_pgentry_t *, root_pgt);
 
 static root_pgentry_t common_pgt;
@@ -762,7 +760,7 @@ static int setup_cpu_root_pgt(unsigned int cpu)
     unsigned int off;
     int rc;
 
-    if ( !opt_xpti )
+    if ( cpu_has_no_xpti )
         return 0;
 
     rpt = alloc_xen_pagetable();
@@ -1036,9 +1034,6 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 
     stack_base[0] = stack_start;
 
-    if ( opt_xpti < 0 )
-        opt_xpti = boot_cpu_data.x86_vendor != X86_VENDOR_AMD;
-
     rc = setup_cpu_root_pgt(0);
     if ( rc )
         panic("Error %d setting up PV root page table\n", rc);

diff --git a/xen/include/asm-x86/cpufeature.h b/xen/include/asm-x86/cpufeature.h
index e170bb9525ee4c9f612aa18a62fdb6455efed5af..6a18755df26ed983d6d845518575090d2c338e70 100644 (file)
--- a/xen/include/asm-x86/cpufeature.h
+++ b/xen/include/asm-x86/cpufeature.h
@@ -34,6 +34,7 @@
 #define X86_FEATURE_XEN_IBRS_CLEAR     ((FSCAPINTS+0)*32+ 15) /* IBRSB && IBRS clear in Xen */
 #define X86_FEATURE_RSB_NATIVE         ((FSCAPINTS+0)*32+ 16) /* RSB overwrite needed for native */
 #define X86_FEATURE_RSB_VMEXIT         ((FSCAPINTS+0)*32+ 17) /* RSB overwrite needed for vmexit */
+#define X86_FEATURE_NO_XPTI            ((FSCAPINTS+0)*32+ 18) /* XPTI mitigation not in use */
 
 #define cpufeat_word(idx)      ((idx) / 32)
 #define cpufeat_bit(idx)       ((idx) % 32)
@@ -98,6 +99,7 @@
 #define cpu_has_hypervisor     boot_cpu_has(X86_FEATURE_HYPERVISOR)
 #define cpu_has_cmp_legacy     boot_cpu_has(X86_FEATURE_CMP_LEGACY)
 #define cpu_has_lfence_dispatch boot_cpu_has(X86_FEATURE_LFENCE_DISPATCH)
+#define cpu_has_no_xpti         boot_cpu_has(X86_FEATURE_NO_XPTI)
 
 enum _cache_type {
     CACHE_TYPE_NULL = 0,

diff --git a/xen/include/asm-x86/msr-index.h b/xen/include/asm-x86/msr-index.h
index 0fd34ed98df05629f280aa89be29fff8b65cb146..5c794acf8425c421b7b78549045a6ac24a8f3e24 100644 (file)
--- a/xen/include/asm-x86/msr-index.h
+++ b/xen/include/asm-x86/msr-index.h
@@ -40,6 +40,8 @@
 #define PRED_CMD_IBPB                  (_AC(1, ULL) << 0)
 
 #define MSR_ARCH_CAPABILITIES          0x0000010a
+#define ARCH_CAPABILITIES_RDCL_NO      (_AC(1, ULL) << 0)
+#define ARCH_CAPABILITIES_IBRS_ALL     (_AC(1, ULL) << 1)
 
 /* Intel MSRs. Some also available on other CPUs */
 #define MSR_IA32_PERFCTR0              0x000000c1

diff --git a/xen/include/public/arch-x86/cpufeatureset.h b/xen/include/public/arch-x86/cpufeatureset.h
index 9da4cf6b4e4288f28004238df71d07d61d4ce38f..7714108350093f69751d55f2d8eb1d1d127652ac 100644 (file)
--- a/xen/include/public/arch-x86/cpufeatureset.h
+++ b/xen/include/public/arch-x86/cpufeatureset.h
@@ -229,6 +229,7 @@ XEN_CPUFEATURE(IBPB,          8*32+12) /*A  IBPB support only (no IBRS, used by
 /* Intel-defined CPU features, CPUID level 0x00000007:0.edx, word 9 */
 XEN_CPUFEATURE(IBRSB,         9*32+26) /*A  IBRS and IBPB support (used by Intel) */
 XEN_CPUFEATURE(STIBP,         9*32+27) /*A! STIBP */
+XEN_CPUFEATURE(ARCH_CAPS,     9*32+29) /*   IA32_ARCH_CAPABILITIES MSR */
 
 #endif /* XEN_CPUFEATURE */