* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-13 18:49 [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off Michal Hocko
@ 2018-11-13 19:20 ` Pavel Tatashin
2018-11-13 19:56 ` Jiri Kosina
` (4 subsequent siblings)
5 siblings, 0 replies; 15+ messages in thread
From: Pavel Tatashin @ 2018-11-13 19:20 UTC (permalink / raw)
To: Michal Hocko
Cc: Thomas Gleixner, Jiri Kosina, Linus Torvalds, Dave Hansen,
Andi Kleen, Borislav Petkov, LKML, linux-mm, Michal Hocko
On 18-11-13 19:49:10, Michal Hocko wrote:
> From: Michal Hocko <mhocko@suse.com>
>
> Swap storage is restricted to max_swapfile_size (~16TB on x86_64)
> whenever the system is deemed affected by L1TF vulnerability. Even
> though the limit is quite high for most deployments it seems to be
> too restrictive for deployments which are willing to live with the
> mitigation disabled.
>
> We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices
> which is clearly out of the limit.
>
> Drop the swap restriction when l1tf=off is specified. It also doesn't
> make much sense to warn about too much memory for the l1tf mitigation
> when it is forcefully disabled by the administrator.
>
> Signed-off-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Pavel Tatashin <pasha.tatashin@soleen.com>
^ permalink raw reply [flat|nested] 15+ messages in thread* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-13 18:49 [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off Michal Hocko
2018-11-13 19:20 ` Pavel Tatashin
@ 2018-11-13 19:56 ` Jiri Kosina
2018-11-14 7:32 ` Michal Hocko
2018-11-15 0:27 ` Andi Kleen
` (3 subsequent siblings)
5 siblings, 1 reply; 15+ messages in thread
From: Jiri Kosina @ 2018-11-13 19:56 UTC (permalink / raw)
To: Michal Hocko
Cc: Thomas Gleixner, Linus Torvalds, Dave Hansen, Andi Kleen,
Borislav Petkov, LKML, linux-mm, Michal Hocko
On Tue, 13 Nov 2018, Michal Hocko wrote:
> From: Michal Hocko <mhocko@suse.com>
>
> Swap storage is restricted to max_swapfile_size (~16TB on x86_64)
> whenever the system is deemed affected by L1TF vulnerability. Even
> though the limit is quite high for most deployments it seems to be
> too restrictive for deployments which are willing to live with the
> mitigation disabled.
>
> We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices
> which is clearly out of the limit.
>
> Drop the swap restriction when l1tf=off is specified. It also doesn't
> make much sense to warn about too much memory for the l1tf mitigation
> when it is forcefully disabled by the administrator.
>
> Signed-off-by: Michal Hocko <mhocko@suse.com>
> ---
> Documentation/admin-guide/kernel-parameters.txt | 2 ++
> Documentation/admin-guide/l1tf.rst | 5 ++++-
> arch/x86/kernel/cpu/bugs.c | 3 ++-
> arch/x86/mm/init.c | 2 +-
> 4 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index 81d1d5a74728..a54f2bd39e77 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -2095,6 +2095,8 @@
> off
> Disables hypervisor mitigations and doesn't
> emit any warnings.
> + It also drops the swap size and available
> + RAM limit restriction.
Minor nit: I think this should explicitly mention that those two things
are related to bare metal mitigation, to avoid any confusion (as otherwise
the l1tf cmdline parameter is purely about hypervisor mitigations).
With that
Acked-by: Jiri Kosina <jkosina@suse.cz>
Thanks,
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 15+ messages in thread* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-13 19:56 ` Jiri Kosina
@ 2018-11-14 7:32 ` Michal Hocko
2018-11-19 13:36 ` Jiri Kosina
0 siblings, 1 reply; 15+ messages in thread
From: Michal Hocko @ 2018-11-14 7:32 UTC (permalink / raw)
To: Jiri Kosina
Cc: Thomas Gleixner, Linus Torvalds, Dave Hansen, Andi Kleen,
Borislav Petkov, LKML, linux-mm
On Tue 13-11-18 20:56:54, Jiri Kosina wrote:
> On Tue, 13 Nov 2018, Michal Hocko wrote:
>
> > From: Michal Hocko <mhocko@suse.com>
> >
> > Swap storage is restricted to max_swapfile_size (~16TB on x86_64)
> > whenever the system is deemed affected by L1TF vulnerability. Even
> > though the limit is quite high for most deployments it seems to be
> > too restrictive for deployments which are willing to live with the
> > mitigation disabled.
> >
> > We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices
> > which is clearly out of the limit.
> >
> > Drop the swap restriction when l1tf=off is specified. It also doesn't
> > make much sense to warn about too much memory for the l1tf mitigation
> > when it is forcefully disabled by the administrator.
> >
> > Signed-off-by: Michal Hocko <mhocko@suse.com>
> > ---
> > Documentation/admin-guide/kernel-parameters.txt | 2 ++
> > Documentation/admin-guide/l1tf.rst | 5 ++++-
> > arch/x86/kernel/cpu/bugs.c | 3 ++-
> > arch/x86/mm/init.c | 2 +-
> > 4 files changed, 9 insertions(+), 3 deletions(-)
> >
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index 81d1d5a74728..a54f2bd39e77 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -2095,6 +2095,8 @@
> > off
> > Disables hypervisor mitigations and doesn't
> > emit any warnings.
> > + It also drops the swap size and available
> > + RAM limit restriction.
>
> Minor nit: I think this should explicitly mention that those two things
> are related to bare metal mitigation, to avoid any confusion (as otherwise
> the l1tf cmdline parameter is purely about hypervisor mitigations).
Do you have any specific wording in mind?
It also drops the swap size and available RAM limit restrictions on both
hypervisor and bare metal.
Sounds better?
> With that
>
> Acked-by: Jiri Kosina <jkosina@suse.cz>
Thanks!
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-14 7:32 ` Michal Hocko
@ 2018-11-19 13:36 ` Jiri Kosina
2018-11-19 13:51 ` Michal Hocko
0 siblings, 1 reply; 15+ messages in thread
From: Jiri Kosina @ 2018-11-19 13:36 UTC (permalink / raw)
To: Michal Hocko
Cc: Thomas Gleixner, Linus Torvalds, Dave Hansen, Andi Kleen,
Borislav Petkov, LKML, linux-mm
On Wed, 14 Nov 2018, Michal Hocko wrote:
> > > + It also drops the swap size and available
> > > + RAM limit restriction.
> >
> > Minor nit: I think this should explicitly mention that those two things
> > are related to bare metal mitigation, to avoid any confusion (as otherwise
> > the l1tf cmdline parameter is purely about hypervisor mitigations).
>
> Do you have any specific wording in mind?
>
> It also drops the swap size and available RAM limit restrictions on both
> hypervisor and bare metal.
>
> Sounds better?
>
> > With that
> >
> > Acked-by: Jiri Kosina <jkosina@suse.cz>
>
> Thanks!
Yes, I think that makes it absolutely clear. Thanks,
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-19 13:36 ` Jiri Kosina
@ 2018-11-19 13:51 ` Michal Hocko
2018-12-09 20:46 ` Jiri Kosina
0 siblings, 1 reply; 15+ messages in thread
From: Michal Hocko @ 2018-11-19 13:51 UTC (permalink / raw)
To: Jiri Kosina
Cc: Thomas Gleixner, Linus Torvalds, Dave Hansen, Andi Kleen,
Borislav Petkov, LKML, linux-mm
On Mon 19-11-18 14:36:32, Jiri Kosina wrote:
> On Wed, 14 Nov 2018, Michal Hocko wrote:
>
> > > > + It also drops the swap size and available
> > > > + RAM limit restriction.
> > >
> > > Minor nit: I think this should explicitly mention that those two things
> > > are related to bare metal mitigation, to avoid any confusion (as otherwise
> > > the l1tf cmdline parameter is purely about hypervisor mitigations).
> >
> > Do you have any specific wording in mind?
> >
> > It also drops the swap size and available RAM limit restrictions on both
> > hypervisor and bare metal.
> >
> > Sounds better?
> >
> > > With that
> > >
> > > Acked-by: Jiri Kosina <jkosina@suse.cz>
> >
> > Thanks!
>
> Yes, I think that makes it absolutely clear. Thanks,
OK. Here is the incremental diff on top of the patch. I will fold and
repost later this week. I assume people are still catching up after LPC
and I do not want to spam them even more.
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index a54f2bd39e77..c5aa4b4a797d 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2096,7 +2096,8 @@
Disables hypervisor mitigations and doesn't
emit any warnings.
It also drops the swap size and available
- RAM limit restriction.
+ RAM limit restriction on both hypervisor and
+ bare metal.
Default is 'flush'.
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index b00464a9c09c..2e65e6cb033e 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -405,7 +405,8 @@ The kernel command line allows to control the L1TF mitigations at boot
off Disables hypervisor mitigations and doesn't emit any
warnings.
- It also drops the swap size and available RAM limit restrictions.
+ It also drops the swap size and available RAM limit restrictions
+ on both hypervisor and bare metal.
============ =============================================================
--
Michal Hocko
SUSE Labs
^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-19 13:51 ` Michal Hocko
@ 2018-12-09 20:46 ` Jiri Kosina
2018-12-10 20:03 ` Michal Hocko
0 siblings, 1 reply; 15+ messages in thread
From: Jiri Kosina @ 2018-12-09 20:46 UTC (permalink / raw)
To: Michal Hocko
Cc: Thomas Gleixner, Linus Torvalds, Dave Hansen, Andi Kleen,
Borislav Petkov, LKML, linux-mm
On Mon, 19 Nov 2018, Michal Hocko wrote:
> > > > > + It also drops the swap size and available
> > > > > + RAM limit restriction.
> > > >
> > > > Minor nit: I think this should explicitly mention that those two things
> > > > are related to bare metal mitigation, to avoid any confusion (as otherwise
> > > > the l1tf cmdline parameter is purely about hypervisor mitigations).
> > >
> > > Do you have any specific wording in mind?
> > >
> > > It also drops the swap size and available RAM limit restrictions on both
> > > hypervisor and bare metal.
> > >
> > > Sounds better?
> > >
> > > > With that
> > > >
> > > > Acked-by: Jiri Kosina <jkosina@suse.cz>
> > >
> > > Thanks!
> >
> > Yes, I think that makes it absolutely clear. Thanks,
>
> OK. Here is the incremental diff on top of the patch. I will fold and
> repost later this week. I assume people are still catching up after LPC
> and I do not want to spam them even more.
Is this queued anywhere in the meantime please?
Thanks,
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-12-09 20:46 ` Jiri Kosina
@ 2018-12-10 20:03 ` Michal Hocko
0 siblings, 0 replies; 15+ messages in thread
From: Michal Hocko @ 2018-12-10 20:03 UTC (permalink / raw)
To: Thomas Gleixner
Cc: Jiri Kosina, Linus Torvalds, Dave Hansen, Andi Kleen,
Borislav Petkov, LKML, linux-mm
On Sun 09-12-18 21:46:57, Jiri Kosina wrote:
> On Mon, 19 Nov 2018, Michal Hocko wrote:
>
> > > > > > + It also drops the swap size and available
> > > > > > + RAM limit restriction.
> > > > >
> > > > > Minor nit: I think this should explicitly mention that those two things
> > > > > are related to bare metal mitigation, to avoid any confusion (as otherwise
> > > > > the l1tf cmdline parameter is purely about hypervisor mitigations).
> > > >
> > > > Do you have any specific wording in mind?
> > > >
> > > > It also drops the swap size and available RAM limit restrictions on both
> > > > hypervisor and bare metal.
> > > >
> > > > Sounds better?
> > > >
> > > > > With that
> > > > >
> > > > > Acked-by: Jiri Kosina <jkosina@suse.cz>
> > > >
> > > > Thanks!
> > >
> > > Yes, I think that makes it absolutely clear. Thanks,
> >
> > OK. Here is the incremental diff on top of the patch. I will fold and
> > repost later this week. I assume people are still catching up after LPC
> > and I do not want to spam them even more.
>
> Is this queued anywhere in the meantime please?
Not yet. Thanks for the reminder. It completely fall of my radar.
Thomas, do you want me to resubmit or there are some other changes you
would like to see?
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off
2018-11-13 18:49 [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off Michal Hocko
2018-11-13 19:20 ` Pavel Tatashin
2018-11-13 19:56 ` Jiri Kosina
@ 2018-11-15 0:27 ` Andi Kleen
2018-12-10 21:09 ` [tip:x86/pti] x86/speculation/l1tf: Drop " tip-bot for Michal Hocko
` (2 subsequent siblings)
5 siblings, 0 replies; 15+ messages in thread
From: Andi Kleen @ 2018-11-15 0:27 UTC (permalink / raw)
To: Michal Hocko
Cc: Thomas Gleixner, Jiri Kosina, Linus Torvalds, Dave Hansen,
Borislav Petkov, LKML, linux-mm, Michal Hocko
On Tue, Nov 13, 2018 at 07:49:10PM +0100, Michal Hocko wrote:
> From: Michal Hocko <mhocko@suse.com>
>
> Swap storage is restricted to max_swapfile_size (~16TB on x86_64)
> whenever the system is deemed affected by L1TF vulnerability. Even
> though the limit is quite high for most deployments it seems to be
> too restrictive for deployments which are willing to live with the
> mitigation disabled.
>
> We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices
> which is clearly out of the limit.
>
> Drop the swap restriction when l1tf=off is specified. It also doesn't
> make much sense to warn about too much memory for the l1tf mitigation
> when it is forcefully disabled by the administrator.
Reviewed-by: Andi Kleen <ak@linux.intel.com>
-Andi
^ permalink raw reply [flat|nested] 15+ messages in thread* [tip:x86/pti] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
2018-11-13 18:49 [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off Michal Hocko
` (2 preceding siblings ...)
2018-11-15 0:27 ` Andi Kleen
@ 2018-12-10 21:09 ` tip-bot for Michal Hocko
2018-12-11 9:00 ` Ingo Molnar
2018-12-11 10:36 ` tip-bot for Michal Hocko
2018-12-11 10:51 ` tip-bot for Michal Hocko
5 siblings, 1 reply; 15+ messages in thread
From: tip-bot for Michal Hocko @ 2018-12-10 21:09 UTC (permalink / raw)
To: linux-tip-commits
Cc: linux-mm, mhocko, bp, pasha.tatashin, mingo, torvalds,
dave.hansen, linux-kernel, tglx, ak, jkosina, hpa
Commit-ID: f4abaa98c4575cc06ea5e1a593e3bc2c8de8ef48
Gitweb: https://git.kernel.org/tip/f4abaa98c4575cc06ea5e1a593e3bc2c8de8ef48
Author: Michal Hocko <mhocko@suse.com>
AuthorDate: Tue, 13 Nov 2018 19:49:10 +0100
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitDate: Mon, 10 Dec 2018 22:07:02 +0100
x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.
We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.
Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.
[ tglx: Folded the documentation delta change ]
Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Pavel Tatashin <pasha.tatashin@soleen.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: <linux-mm@kvack.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org
---
Documentation/admin-guide/kernel-parameters.txt | 3 +++
Documentation/admin-guide/l1tf.rst | 6 +++++-
arch/x86/kernel/cpu/bugs.c | 3 ++-
arch/x86/mm/init.c | 2 +-
4 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 05a252e5178d..835e422572eb 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2095,6 +2095,9 @@
off
Disables hypervisor mitigations and doesn't
emit any warnings.
+ It also drops the swap size and available
+ RAM limit restriction on both hypervisor and
+ bare metal.
Default is 'flush'.
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index b85dd80510b0..2e65e6cb033e 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
off Disables hypervisor mitigations and doesn't emit any
warnings.
+ It also drops the swap size and available RAM limit restrictions
+ on both hypervisor and bare metal.
+
============ =============================================================
The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
@@ -576,7 +579,8 @@ Default mitigations
The kernel default mitigations for vulnerable processors are:
- PTE inversion to protect against malicious user space. This is done
- unconditionally and cannot be controlled.
+ unconditionally and cannot be controlled. The swap storage is limited
+ to ~16TB.
- L1D conditional flushing on VMENTER when EPT is enabled for
a guest.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a68b32cb845a..58689ac64440 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1002,7 +1002,8 @@ static void __init l1tf_select_mitigation(void)
#endif
half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
- if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
+ if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
+ e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
half_pa);
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ef99f3892e1f..427a955a2cf2 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -931,7 +931,7 @@ unsigned long max_swapfile_size(void)
pages = generic_max_swapfile_size();
- if (boot_cpu_has_bug(X86_BUG_L1TF)) {
+ if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {
/* Limit the swap file size to MAX_PA/2 for L1TF workaround */
unsigned long long l1tf_limit = l1tf_pfn_limit();
/*
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [tip:x86/pti] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
2018-12-10 21:09 ` [tip:x86/pti] x86/speculation/l1tf: Drop " tip-bot for Michal Hocko
@ 2018-12-11 9:00 ` Ingo Molnar
2018-12-11 10:47 ` Thomas Gleixner
0 siblings, 1 reply; 15+ messages in thread
From: Ingo Molnar @ 2018-12-11 9:00 UTC (permalink / raw)
To: linux-mm, mhocko, bp, pasha.tatashin, tglx, linux-kernel,
dave.hansen, torvalds, hpa, jkosina, ak
Cc: linux-tip-commits
* tip-bot for Michal Hocko <tipbot@zytor.com> wrote:
> Commit-ID: f4abaa98c4575cc06ea5e1a593e3bc2c8de8ef48
> Gitweb: https://git.kernel.org/tip/f4abaa98c4575cc06ea5e1a593e3bc2c8de8ef48
> Author: Michal Hocko <mhocko@suse.com>
> AuthorDate: Tue, 13 Nov 2018 19:49:10 +0100
> Committer: Thomas Gleixner <tglx@linutronix.de>
> CommitDate: Mon, 10 Dec 2018 22:07:02 +0100
>
> x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
> [ tglx: Folded the documentation delta change ]
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -2095,6 +2095,9 @@
> off
> Disables hypervisor mitigations and doesn't
> emit any warnings.
> + It also drops the swap size and available
> + RAM limit restriction on both hypervisor and
> + bare metal.
>
> Default is 'flush'.
>
> diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
> index b85dd80510b0..2e65e6cb033e 100644
> --- a/Documentation/admin-guide/l1tf.rst
> +++ b/Documentation/admin-guide/l1tf.rst
> @@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
>
> off Disables hypervisor mitigations and doesn't emit any
> warnings.
> + It also drops the swap size and available RAM limit restrictions
> + on both hypervisor and bare metal.
> +
Note tha there's also some whitespace damage here: all other similar
lines in this RST file start with two tabs, this one starts with 8
spaces.
Thanks,
Ingo
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [tip:x86/pti] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
2018-12-11 9:00 ` Ingo Molnar
@ 2018-12-11 10:47 ` Thomas Gleixner
2018-12-11 11:13 ` Michal Hocko
0 siblings, 1 reply; 15+ messages in thread
From: Thomas Gleixner @ 2018-12-11 10:47 UTC (permalink / raw)
To: Ingo Molnar
Cc: linux-mm, mhocko, bp, pasha.tatashin, linux-kernel, dave.hansen,
torvalds, hpa, jkosina, ak, linux-tip-commits
On Tue, 11 Dec 2018, Ingo Molnar wrote:
> > off Disables hypervisor mitigations and doesn't emit any
> > warnings.
> > + It also drops the swap size and available RAM limit restrictions
> > + on both hypervisor and bare metal.
> > +
>
> Note tha there's also some whitespace damage here: all other similar
> lines in this RST file start with two tabs, this one starts with 8
> spaces.
Fixed...
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [tip:x86/pti] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
2018-12-11 10:47 ` Thomas Gleixner
@ 2018-12-11 11:13 ` Michal Hocko
0 siblings, 0 replies; 15+ messages in thread
From: Michal Hocko @ 2018-12-11 11:13 UTC (permalink / raw)
To: Thomas Gleixner
Cc: Ingo Molnar, linux-mm, bp, pasha.tatashin, linux-kernel,
dave.hansen, torvalds, hpa, jkosina, ak, linux-tip-commits
On Tue 11-12-18 11:47:52, Thomas Gleixner wrote:
> On Tue, 11 Dec 2018, Ingo Molnar wrote:
> > > off Disables hypervisor mitigations and doesn't emit any
> > > warnings.
> > > + It also drops the swap size and available RAM limit restrictions
> > > + on both hypervisor and bare metal.
> > > +
> >
> > Note tha there's also some whitespace damage here: all other similar
> > lines in this RST file start with two tabs, this one starts with 8
> > spaces.
>
> Fixed...
Thanks Thomas! I haven't noticed a different whitespaces and relied on
whatever vim decided to do.
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 15+ messages in thread
* [tip:x86/pti] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
2018-11-13 18:49 [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off Michal Hocko
` (3 preceding siblings ...)
2018-12-10 21:09 ` [tip:x86/pti] x86/speculation/l1tf: Drop " tip-bot for Michal Hocko
@ 2018-12-11 10:36 ` tip-bot for Michal Hocko
2018-12-11 10:51 ` tip-bot for Michal Hocko
5 siblings, 0 replies; 15+ messages in thread
From: tip-bot for Michal Hocko @ 2018-12-11 10:36 UTC (permalink / raw)
To: linux-tip-commits
Cc: jkosina, tglx, torvalds, linux-kernel, pasha.tatashin,
dave.hansen, hpa, ak, mhocko, linux-mm, bp, mingo
Commit-ID: d7409e79dbec2d2834fb6ccca53664197ab65505
Gitweb: https://git.kernel.org/tip/d7409e79dbec2d2834fb6ccca53664197ab65505
Author: Michal Hocko <mhocko@suse.com>
AuthorDate: Tue, 13 Nov 2018 19:49:10 +0100
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitDate: Tue, 11 Dec 2018 11:13:32 +0100
x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.
We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.
Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.
[ tglx: Folded the documentation delta change ]
Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Pavel Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: <linux-mm@kvack.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org
---
Documentation/admin-guide/kernel-parameters.txt | 3 +++
Documentation/admin-guide/l1tf.rst | 6 +++++-
arch/x86/kernel/cpu/bugs.c | 3 ++-
arch/x86/mm/init.c | 2 +-
4 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 05a252e5178d..835e422572eb 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2095,6 +2095,9 @@
off
Disables hypervisor mitigations and doesn't
emit any warnings.
+ It also drops the swap size and available
+ RAM limit restriction on both hypervisor and
+ bare metal.
Default is 'flush'.
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index b85dd80510b0..2e65e6cb033e 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
off Disables hypervisor mitigations and doesn't emit any
warnings.
+ It also drops the swap size and available RAM limit restrictions
+ on both hypervisor and bare metal.
+
============ =============================================================
The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
@@ -576,7 +579,8 @@ Default mitigations
The kernel default mitigations for vulnerable processors are:
- PTE inversion to protect against malicious user space. This is done
- unconditionally and cannot be controlled.
+ unconditionally and cannot be controlled. The swap storage is limited
+ to ~16TB.
- L1D conditional flushing on VMENTER when EPT is enabled for
a guest.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a68b32cb845a..58689ac64440 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1002,7 +1002,8 @@ static void __init l1tf_select_mitigation(void)
#endif
half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
- if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
+ if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
+ e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
half_pa);
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ef99f3892e1f..427a955a2cf2 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -931,7 +931,7 @@ unsigned long max_swapfile_size(void)
pages = generic_max_swapfile_size();
- if (boot_cpu_has_bug(X86_BUG_L1TF)) {
+ if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {
/* Limit the swap file size to MAX_PA/2 for L1TF workaround */
unsigned long long l1tf_limit = l1tf_pfn_limit();
/*
^ permalink raw reply related [flat|nested] 15+ messages in thread* [tip:x86/pti] x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
2018-11-13 18:49 [PATCH] l1tf: drop the swap storage limit restriction when l1tf=off Michal Hocko
` (4 preceding siblings ...)
2018-12-11 10:36 ` tip-bot for Michal Hocko
@ 2018-12-11 10:51 ` tip-bot for Michal Hocko
5 siblings, 0 replies; 15+ messages in thread
From: tip-bot for Michal Hocko @ 2018-12-11 10:51 UTC (permalink / raw)
To: linux-tip-commits
Cc: tglx, linux-mm, ak, pasha.tatashin, linux-kernel, mhocko, hpa,
dave.hansen, jkosina, bp, mingo, torvalds
Commit-ID: 5b5e4d623ec8a34689df98e42d038a3b594d2ff9
Gitweb: https://git.kernel.org/tip/5b5e4d623ec8a34689df98e42d038a3b594d2ff9
Author: Michal Hocko <mhocko@suse.com>
AuthorDate: Tue, 13 Nov 2018 19:49:10 +0100
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitDate: Tue, 11 Dec 2018 11:46:13 +0100
x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
Swap storage is restricted to max_swapfile_size (~16TB on x86_64) whenever
the system is deemed affected by L1TF vulnerability. Even though the limit
is quite high for most deployments it seems to be too restrictive for
deployments which are willing to live with the mitigation disabled.
We have a customer to deploy 8x 6,4TB PCIe/NVMe SSD swap devices which is
clearly out of the limit.
Drop the swap restriction when l1tf=off is specified. It also doesn't make
much sense to warn about too much memory for the l1tf mitigation when it is
forcefully disabled by the administrator.
[ tglx: Folded the documentation delta change ]
Fixes: 377eeaa8e11f ("x86/speculation/l1tf: Limit swap file size to MAX_PA/2")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Pavel Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: <linux-mm@kvack.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20181113184910.26697-1-mhocko@kernel.org
---
Documentation/admin-guide/kernel-parameters.txt | 3 +++
Documentation/admin-guide/l1tf.rst | 6 +++++-
arch/x86/kernel/cpu/bugs.c | 3 ++-
arch/x86/mm/init.c | 2 +-
4 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 05a252e5178d..835e422572eb 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2095,6 +2095,9 @@
off
Disables hypervisor mitigations and doesn't
emit any warnings.
+ It also drops the swap size and available
+ RAM limit restriction on both hypervisor and
+ bare metal.
Default is 'flush'.
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index b85dd80510b0..9af977384168 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
off Disables hypervisor mitigations and doesn't emit any
warnings.
+ It also drops the swap size and available RAM limit restrictions
+ on both hypervisor and bare metal.
+
============ =============================================================
The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
@@ -576,7 +579,8 @@ Default mitigations
The kernel default mitigations for vulnerable processors are:
- PTE inversion to protect against malicious user space. This is done
- unconditionally and cannot be controlled.
+ unconditionally and cannot be controlled. The swap storage is limited
+ to ~16TB.
- L1D conditional flushing on VMENTER when EPT is enabled for
a guest.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a68b32cb845a..58689ac64440 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1002,7 +1002,8 @@ static void __init l1tf_select_mitigation(void)
#endif
half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
- if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
+ if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
+ e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
half_pa);
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ef99f3892e1f..427a955a2cf2 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -931,7 +931,7 @@ unsigned long max_swapfile_size(void)
pages = generic_max_swapfile_size();
- if (boot_cpu_has_bug(X86_BUG_L1TF)) {
+ if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {
/* Limit the swap file size to MAX_PA/2 for L1TF workaround */
unsigned long long l1tf_limit = l1tf_pfn_limit();
/*
^ permalink raw reply related [flat|nested] 15+ messages in thread