Mailing List Archive

commit 6672d8ceae4acf0e0ef7dc7002e6146d10507c37
Author: Andrew Cooper <andrew.cooper3@citrix.com>
AuthorDate: Tue Mar 26 22:47:25 2024 +0000
Commit: Andrew Cooper <andrew.cooper3@citrix.com>
CommitDate: Tue Apr 9 17:16:31 2024 +0100

x86/spec-ctrl: Fix BTC/SRSO mitigations

We were looking for SCF_entry_ibpb in the wrong variable in the top-of-stack
block, and xen_spec_ctrl won't have had bit 5 set because Xen doesn't
understand SPEC_CTRL_RRSBA_DIS_U yet.

This is XSA-455 / CVE-2024-31142.

Fixes: 53a570b28569 ("x86/spec-ctrl: Support IBPB-on-entry")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
xen/arch/x86/hvm/svm/entry.S | 2 +-
xen/include/asm-x86/spec_ctrl_asm.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S
index ad5ca50c12..d1ca530315 100644
--- a/xen/arch/x86/hvm/svm/entry.S
+++ b/xen/arch/x86/hvm/svm/entry.S
@@ -101,7 +101,7 @@ __UNLIKELY_END(nsvm_hap)
/* SPEC_CTRL_ENTRY_FROM_SVM Req: %rsp=regs/cpuinfo, %rdx=0 Clob: acd */

.macro svm_vmexit_cond_ibpb
- testb $SCF_entry_ibpb, CPUINFO_xen_spec_ctrl(%rsp)
+ testb $SCF_entry_ibpb, CPUINFO_spec_ctrl_flags(%rsp)
jz .L_skip_ibpb

mov $MSR_PRED_CMD, %ecx
diff --git a/xen/include/asm-x86/spec_ctrl_asm.h b/xen/include/asm-x86/spec_ctrl_asm.h
index 9650a3aca7..9704a22d5b 100644
--- a/xen/include/asm-x86/spec_ctrl_asm.h
+++ b/xen/include/asm-x86/spec_ctrl_asm.h
@@ -102,7 +102,7 @@
jz .L\@_skip
testb $3, UREGS_cs(%rsp)
.else
- testb $SCF_entry_ibpb, CPUINFO_xen_spec_ctrl(%rsp)
+ testb $SCF_entry_ibpb, CPUINFO_spec_ctrl_flags(%rsp)
.endif
jz .L\@_skip

--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.15