Commit a399477e authored by Konrad Rzeszutek Wilk's avatar Konrad Rzeszutek Wilk Committed by Thomas Gleixner
Browse files

x86/KVM/VMX: Add module argument for L1TF mitigation 



Add a mitigation mode parameter "vmentry_l1d_flush" for CVE-2018-3620, aka
L1 terminal fault. The valid arguments are:

 - "always" 	L1D cache flush on every VMENTER.
 - "cond"	Conditional L1D cache flush, explained below
 - "never"	Disable the L1D cache flush mitigation

"cond" is trying to avoid L1D cache flushes on VMENTER if the code executed
between VMEXIT and VMENTER is considered safe, i.e. is not bringing any
interesting information into L1D which might exploited.

[ tglx: Split out from a larger patch ]

Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent 26acfb66

Documentation/admin-guide/kernel-parameters.txt

+12 −0
Original line number Diff line number Diff line
@@ -1973,6 +1973,18 @@ 
			(virtualized real and unpaged mode) on capable

			Intel chips. Default is 1 (enabled)



	kvm-intel.vmentry_l1d_flush=[KVM,Intel] Mitigation for L1 Terminal Fault

			CVE-2018-3620.



			Valid arguments: never, cond, always



			always: L1D cache flush on every VMENTER.

			cond:	Flush L1D on VMENTER only when the code between

				VMEXIT and VMENTER can leak host memory.

			never:	Disables the mitigation



			Default is cond (do L1 cache flush in specific instances)



	kvm-intel.vpid=	[KVM,Intel] Disable Virtual Processor Identification

			feature (tagged TLBs) on capable Intel chips.

			Default is 1 (enabled)

arch/x86/kvm/vmx.c

+59 −0
Original line number Diff line number Diff line
@@ -191,6 +191,54 @@ module_param(ple_window_max, uint, 0444); 


extern const ulong vmx_return;



static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);



/* These MUST be in sync with vmentry_l1d_param order. */

enum vmx_l1d_flush_state {

	VMENTER_L1D_FLUSH_NEVER,

	VMENTER_L1D_FLUSH_COND,

	VMENTER_L1D_FLUSH_ALWAYS,

};



static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush = VMENTER_L1D_FLUSH_COND;



static const struct {

	const char *option;

	enum vmx_l1d_flush_state cmd;

} vmentry_l1d_param[] = {

	{"never",	VMENTER_L1D_FLUSH_NEVER},

	{"cond",	VMENTER_L1D_FLUSH_COND},

	{"always",	VMENTER_L1D_FLUSH_ALWAYS},

};



static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)

{

	unsigned int i;



	if (!s)

		return -EINVAL;



	for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {

		if (!strcmp(s, vmentry_l1d_param[i].option)) {

			vmentry_l1d_flush = vmentry_l1d_param[i].cmd;

			return 0;

		}

	}



	return -EINVAL;

}



static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)

{

	return sprintf(s, "%s\n", vmentry_l1d_param[vmentry_l1d_flush].option);

}



static const struct kernel_param_ops vmentry_l1d_flush_ops = {

	.set = vmentry_l1d_flush_set,

	.get = vmentry_l1d_flush_get,

};

module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, &vmentry_l1d_flush, S_IRUGO);



struct kvm_vmx {

	struct kvm kvm;
@@ -13062,6 +13110,15 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { 
	.enable_smi_window = enable_smi_window,

};



static void __init vmx_setup_l1d_flush(void)

{

	if (vmentry_l1d_flush == VMENTER_L1D_FLUSH_NEVER ||

	    !boot_cpu_has_bug(X86_BUG_L1TF))

		return;



	static_branch_enable(&vmx_l1d_should_flush);

}



static int __init vmx_init(void)

{

	int r;
@@ -13095,6 +13152,8 @@ static int __init vmx_init(void) 
	}

#endif



	vmx_setup_l1d_flush();



	r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),

                     __alignof__(struct vcpu_vmx), THIS_MODULE);

	if (r)

CRA Git | Maintained and supported by SUSTech CRA and CCSE