From: "Roger Pau Monné" <roger.pau@citrix.com>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Xen-devel <xen-devel@lists.xenproject.org>, Wei Liu <wl@xen.org>,
Jan Beulich <JBeulich@suse.com>
Subject: Re: [PATCH 1/3] x86/pv: Options to disable and/or compile out 32bit PV support
Date: Mon, 20 Apr 2020 15:47:57 +0200 [thread overview]
Message-ID: <20200420134757.GS28601@Air-de-Roger> (raw)
In-Reply-To: <20200417155004.16806-2-andrew.cooper3@citrix.com>
On Fri, Apr 17, 2020 at 04:50:02PM +0100, Andrew Cooper wrote:
> This is the start of some performance and security-hardening improvements,
> based on the fact that 32bit PV guests are few and far between these days.
>
> Ring1 is full or architectural corner cases, such as counting as supervisor
^ of
> from a paging point of view. This accounts for a substantial performance hit
> on processors from the last 8 years (adjusting SMEP/SMAP on every privilege
> transition), and the gap is only going to get bigger with new hardware
> features.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Wei Liu <wl@xen.org>
> CC: Roger Pau Monné <roger.pau@citrix.com>
>
> There is a series I can't quite post yet which wants to conditionally turn
> opt_pv32 off, which is why I've put it straight in in an int8_t form rather
s/in in/in/
> than a straight boolean form.
> ---
> docs/misc/xen-command-line.pandoc | 12 +++++++++++-
> xen/arch/x86/Kconfig | 16 ++++++++++++++++
> xen/arch/x86/pv/domain.c | 35 +++++++++++++++++++++++++++++++++++
> xen/arch/x86/setup.c | 9 +++++++--
> xen/include/asm-x86/pv/domain.h | 6 ++++++
> 5 files changed, 75 insertions(+), 3 deletions(-)
>
> diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
> index acd0b3d994..ee12b0f53f 100644
> --- a/docs/misc/xen-command-line.pandoc
> +++ b/docs/misc/xen-command-line.pandoc
> @@ -1694,7 +1694,17 @@ The following resources are available:
> CDP, one COS will corespond two CBMs other than one with CAT, due to the
> sum of CBMs is fixed, that means actual `cos_max` in use will automatically
> reduce to half when CDP is enabled.
> -
> +
> +### pv
> + = List of [ 32=<bool> ]
> +
> + Applicability: x86
> +
> +Controls for aspects of PV guest support.
> +
> +* The `32` boolean controls whether 32bit PV guests can be created. It
> + defaults to `true`, and is ignored when `CONFIG_PV32` is compiled out.
> +
> ### pv-linear-pt (x86)
> > `= <boolean>`
>
> diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
> index 8149362bde..4c52197de3 100644
> --- a/xen/arch/x86/Kconfig
> +++ b/xen/arch/x86/Kconfig
> @@ -49,6 +49,22 @@ config PV
>
> If unsure, say Y.
>
> +config PV32
> + bool "Support for 32bit PV guests"
> + depends on PV
> + default y
> + ---help---
> + The 32bit PV ABI uses Ring1, an area of the x86 architecture which
> + was deprecated and mostly removed in the AMD64 spec. As a result,
> + it occasionally conflicts with newer x86 hardware features, causing
> + overheads for Xen to maintain backwards compatibility.
> +
> + People may wish to disable 32bit PV guests for attack surface
> + reduction, or performance reasons. Backwards compatibility can be
> + provided via the PV Shim mechanism.
> +
> + If unsure, say Y.
> +
> config PV_LINEAR_PT
> bool "Support for PV linear pagetables"
> depends on PV
> diff --git a/xen/arch/x86/pv/domain.c b/xen/arch/x86/pv/domain.c
> index 70fae43965..47a0db082f 100644
> --- a/xen/arch/x86/pv/domain.c
> +++ b/xen/arch/x86/pv/domain.c
> @@ -16,6 +16,39 @@
> #include <asm/pv/domain.h>
> #include <asm/shadow.h>
>
> +#ifdef CONFIG_PV32
> +int8_t __read_mostly opt_pv32 = -1;
> +#endif
> +
> +static int parse_pv(const char *s)
__init
With that:
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Thanks, Roger.
next prev parent reply other threads:[~2020-04-20 13:48 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-17 15:50 [PATCH 0/3] x86/pv: Start to trim 32bit support Andrew Cooper
2020-04-17 15:50 ` [PATCH 1/3] x86/pv: Options to disable and/or compile out 32bit PV support Andrew Cooper
2020-04-20 13:47 ` Roger Pau Monné [this message]
2020-04-20 17:31 ` Andrew Cooper
2020-04-20 14:05 ` Jan Beulich
2020-04-20 18:05 ` Andrew Cooper
2020-04-21 6:02 ` Jan Beulich
2020-04-23 17:35 ` Andrew Cooper
2020-04-24 5:28 ` Jürgen Groß
2020-04-27 20:02 ` Andrew Cooper
2020-04-24 6:11 ` Jan Beulich
2020-04-20 14:15 ` Jan Beulich
2020-04-29 13:06 ` [PATCH v2 " Andrew Cooper
2020-04-29 13:55 ` Jan Beulich
2020-04-17 15:50 ` [PATCH 2/3] x86/pv: Short-circuit is_pv_{32, 64}bit_domain() in !CONFIG_PV32 builds Andrew Cooper
2020-04-20 14:09 ` [PATCH 2/3] x86/pv: Short-circuit is_pv_{32,64}bit_domain() " Jan Beulich
2020-04-29 13:13 ` Andrew Cooper
2020-04-29 13:29 ` Jan Beulich
2020-04-29 13:30 ` Andrew Cooper
2020-04-29 13:37 ` Jan Beulich
2020-04-17 15:50 ` [PATCH 3/3] x86/pv: Compile out compat_gdt in !CONFIG_PV builds Andrew Cooper
2020-04-20 14:12 ` Jan Beulich
2020-04-20 14:39 ` Andrew Cooper
2020-04-20 15:47 ` Jan Beulich
2020-04-20 17:08 ` Andrew Cooper
2020-04-21 6:09 ` Jan Beulich
2020-04-18 13:46 ` [PATCH 0/3] x86/pv: Start to trim 32bit support Wei Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200420134757.GS28601@Air-de-Roger \
--to=roger.pau@citrix.com \
--cc=JBeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).