Commit 5b5e4d62 authored by Michal Hocko's avatar Michal Hocko Committed by Thomas Gleixner
Browse files

x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off 



Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.

We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.

Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.

[ tglx: Folded the documentation delta change ]

Fixes: 377eeaa8 ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarPavel Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: default avatarAndi Kleen <ak@linux.intel.com>
Acked-by: default avatarJiri Kosina <jkosina@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: <linux-mm@kvack.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org
parent aa77bfb3

Documentation/admin-guide/kernel-parameters.txt

+3 −0
Original line number Diff line number Diff line
@@ -2095,6 +2095,9 @@ 
			off

				Disables hypervisor mitigations and doesn't

				emit any warnings.

				It also drops the swap size and available

				RAM limit restriction on both hypervisor and

				bare metal.



			Default is 'flush'.

Documentation/admin-guide/l1tf.rst

+5 −1
Original line number Diff line number Diff line
@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are: 


  off		Disables hypervisor mitigations and doesn't emit any

		warnings.

		It also drops the swap size and available RAM limit restrictions

		on both hypervisor and bare metal.



  ============  =============================================================



The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
@@ -576,7 +579,8 @@ Default mitigations 
  The kernel default mitigations for vulnerable processors are:



  - PTE inversion to protect against malicious user space. This is done

    unconditionally and cannot be controlled.

    unconditionally and cannot be controlled. The swap storage is limited

    to ~16TB.



  - L1D conditional flushing on VMENTER when EPT is enabled for

    a guest.

arch/x86/kernel/cpu/bugs.c

+2 −1
Original line number Diff line number Diff line
@@ -1002,7 +1002,8 @@ static void __init l1tf_select_mitigation(void) 
#endif



	half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;

	if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {

	if (l1tf_mitigation != L1TF_MITIGATION_OFF &&

			e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {

		pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");

		pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",

				half_pa);

arch/x86/mm/init.c

+1 −1
Original line number Diff line number Diff line
@@ -931,7 +931,7 @@ unsigned long max_swapfile_size(void) 


	pages = generic_max_swapfile_size();



	if (boot_cpu_has_bug(X86_BUG_L1TF)) {

	if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {

		/* Limit the swap file size to MAX_PA/2 for L1TF workaround */

		unsigned long long l1tf_limit = l1tf_pfn_limit();

		/*

CRA Git | Maintained and supported by SUSTech CRA and CCSE