Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:Update
xen.35285
xsa456-0m.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xsa456-0m.patch of Package xen.35285
# Commit 40dea83b75386cb693481cf340024ce093be5c0f # Date 2024-04-09 16:37:30 +0100 # Author Andrew Cooper <andrew.cooper3@citrix.com> # Committer Andrew Cooper <andrew.cooper3@citrix.com> x86/spec-ctrl: Detail the safety properties in SPEC_CTRL_ENTRY_* The complexity is getting out of hand. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -93,6 +93,11 @@ __UNLIKELY_END(nsvm_hap) /* SPEC_CTRL_ENTRY_FROM_SVM Req: %rsp=regs/cpuinfo, %rdx=0 Clob: ac */ + /* + * IBPB is to mitigate BTC/SRSO on AMD/Hygon parts, in particular + * making type-confused RETs safe to use. This is not needed on Zen5 + * and later parts when SRSO_MSR_FIX (BP-SPEC-REDUCE) is in use. + */ .macro svm_vmexit_cond_ibpb testb $SCF_entry_ibpb, CPUINFO_scf(%rsp) jz .L_skip_ibpb @@ -104,6 +109,11 @@ __UNLIKELY_END(nsvm_hap) .endm ALTERNATIVE "", svm_vmexit_cond_ibpb, X86_FEATURE_IBPB_ENTRY_HVM + /* + * RSB (RAS/RAP) stuffing is to prevents RET predictions following guest + * entries. This is not needed on Zen4 and later, when AutoIBRS is in + * use. + */ ALTERNATIVE "", DO_OVERWRITE_RSB, X86_FEATURE_SC_RSB_HVM /* WARNING! `ret`, `call *`, `jmp *` not safe before this point. */ --- a/xen/arch/x86/hvm/vmx/entry.S +++ b/xen/arch/x86/hvm/vmx/entry.S @@ -34,7 +34,21 @@ ENTRY(vmx_asm_vmexit_handler) mov %rax,VCPU_hvm_guest_cr2(%rbx) /* SPEC_CTRL_ENTRY_FROM_VMX Req: b=curr %rsp=regs/cpuinfo, Clob: acd */ + /* + * RSB stuffing is to prevents RET predictions following guest + * entries. This is *not* sufficient to flush all RSB entries on + * parts enumerating eIBRS, although the following restore_spec_ctrl + * does covers us. + */ ALTERNATIVE "", DO_OVERWRITE_RSB, X86_FEATURE_SC_RSB_HVM + /* + * Restore Xen's MSR_SPEC_CTRL setting. For Legacy IBRS, this + * flushes/inhibits indirect predictions and does not flush the RSB. + * For eIBRS, this prevents CALLs/JMPs using predictions learnt at a + * lower predictor mode, and it flushes the RSB. On eIBRS parts that + * also suffer from PBRSB, the prior RSB stuffing suffices to make the + * RSB safe. + */ ALTERNATIVE "", DO_SPEC_CTRL_ENTRY_FROM_HVM, X86_FEATURE_SC_MSR_HVM ALTERNATIVE "lfence", "", X86_SPEC_NO_LFENCE_ENTRY_VMX /* WARNING! `ret`, `call *`, `jmp *` not safe before this point. */ --- a/xen/include/asm-x86/spec_ctrl_asm.h +++ b/xen/include/asm-x86/spec_ctrl_asm.h @@ -263,10 +263,32 @@ */ movzbl STACK_CPUINFO_FIELD(scf)(%r14), %ebx + /* + * For all safety notes, 32bit PV guest kernels run in Ring 1 and are + * therefore supervisor (== Xen) in the architecture. As a result, most + * hardware isolation techniques do not work. + */ + + /* + * IBPB is to mitigate BTC/SRSO on AMD/Hygon parts, in particular making + * type-confused RETs safe to use. This is not needed on Zen5 and later + * parts when SRSO_U/S_NO is enumerated. + */ ALTERNATIVE "", DO_COND_IBPB, X86_FEATURE_IBPB_ENTRY_PV + /* + * RSB stuffing is to prevent RET predictions following guest entries. + * This is not needed if SMEP is active and the RSB is full-width. + */ ALTERNATIVE "", DO_OVERWRITE_RSB, X86_FEATURE_SC_RSB_PV + /* + * Only used on Intel parts. Restore Xen's MSR_SPEC_CTRL setting. The + * guest can't change it's value behind Xen's back. For Legacy IBRS, this + * flushes/inhibits indirect predictions and does not flush the RSB. For + * eIBRS, this prevents CALLs/JMPs using predictions learnt at a lower + * predictor mode, and it flushes the RSB. + */ ALTERNATIVE "", __stringify(DO_SPEC_CTRL_ENTRY maybexen=0), \ X86_FEATURE_SC_MSR_PV @@ -289,6 +311,14 @@ */ movzbl STACK_CPUINFO_FIELD(scf)(%r14), %ebx + /* + * All safety notes the same as SPEC_CTRL_ENTRY_FROM_PV, although there is + * a conditional jump skipping some actions when interrupting Xen. + * + * On Intel parts, the IRET #GP path ends up here with the guest's choice + * of MSR_SPEC_CTRL. + */ + testb $3, UREGS_cs(%rsp) jz .L\@_skip @@ -339,6 +369,19 @@ */ movzbl STACK_CPUINFO_FIELD(scf)(%r14), %ebx + /* + * For all safety notes, 32bit PV guest kernels run in Ring 1 and are + * therefore supervisor (== Xen) in the architecture. As a result, most + * hardware isolation techniques do not work. + */ + + /* + * IBPB is to mitigate BTC/SRSO on AMD/Hygon parts, in particular making + * type-confused RETs safe to use. This is not needed on Zen5 and later + * parts when SRSO_U/S_NO is enumerated. The SVM path takes care of + * Host/Guest interactions prior to clearing GIF, and it's not used on the + * VMX path. + */ test $SCF_ist_ibpb, %bl jz .L\@_skip_ibpb @@ -348,6 +391,12 @@ .L\@_skip_ibpb: + /* + * RSB stuffing is to prevent RET predictions following guest entries. + * SCF_ist_rsb is active if either PV or HVM protections are needed. The + * VMX path cannot guarantee to make the RSB safe ahead of taking an IST + * vector. + */ test $SCF_ist_rsb, %bl jz .L\@_skip_rsb @@ -355,6 +404,16 @@ .L\@_skip_rsb: + /* + * Only used on Intel parts. Restore Xen's MSR_SPEC_CTRL setting. PV + * guests can't change their value behind Xen's back. HVM guests have + * their value stored in the MSR load/save list. For Legacy IBRS, this + * flushes/inhibits indirect predictions and does not flush the RSB. For + * eIBRS, this prevents CALLs/JMPs using predictions learnt at a lower + * predictor mode, and it flushes the RSB. On eIBRS parts that also + * suffer from PBRSB, the prior RSB stuffing suffices to make the RSB + * safe. + */ test $SCF_ist_sc_msr, %bl jz .L\@_skip_msr_spec_ctrl
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
