[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen stable-4.15] x86/spec-ctrl: Remove conditional IRQs-on-ness for INT $0x80/0x82 paths
commit b918c4cdc7ab2c1c9e9a9b54fa9d9c595913e028 Author: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> AuthorDate: Thu Oct 26 14:37:38 2023 +0100 Commit: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> CommitDate: Tue Oct 31 17:48:39 2023 +0000 x86/spec-ctrl: Remove conditional IRQs-on-ness for INT $0x80/0x82 paths Before speculation defences, some paths in Xen could genuinely get away with being IRQs-on at entry. But XPTI invalidated this property on most paths, and attempting to maintain it on the remaining paths was a mistake. Fast forward, and DO_SPEC_CTRL_COND_IBPB (protection for AMD BTC/SRSO) is not IRQ-safe, running with IRQs enabled in some cases. The other actions taken on these paths happen to be IRQ-safe. Make entry_int82() and int80_direct_trap() unconditionally Interrupt Gates rather than Trap Gates. Remove the conditional re-adjustment of int80_direct_trap() in smp_prepare_cpus(), and have entry_int82() explicitly enable interrupts when safe to do so. In smp_prepare_cpus(), with the conditional re-adjustment removed, the clearing of pv_cr3 is the only remaining action gated on XPTI, and it is out of place anyway, repeating work already done by smp_prepare_boot_cpu(). Drop the entire if() condition to avoid leaving an incorrect vestigial remnant. Also drop comments which make incorrect statements about when its safe to enable interrupts. This is XSA-446 / CVE-2023-46836 Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx> (cherry picked from commit a48bb129f1b9ff55c22cf6d2b589247c8ba3b10e) --- xen/arch/x86/pv/traps.c | 4 ++-- xen/arch/x86/smpboot.c | 14 -------------- xen/arch/x86/x86_64/compat/entry.S | 2 ++ xen/arch/x86/x86_64/entry.S | 1 - 4 files changed, 4 insertions(+), 17 deletions(-) diff --git a/xen/arch/x86/pv/traps.c b/xen/arch/x86/pv/traps.c index 7439b76df8..79cb8264e0 100644 --- a/xen/arch/x86/pv/traps.c +++ b/xen/arch/x86/pv/traps.c @@ -160,11 +160,11 @@ void __init pv_trap_init(void) #ifdef CONFIG_PV32 /* The 32-on-64 hypercall vector is only accessible from ring 1. */ _set_gate(idt_table + HYPERCALL_VECTOR, - SYS_DESC_trap_gate, 1, entry_int82); + SYS_DESC_irq_gate, 1, entry_int82); #endif /* Fast trap for int80 (faster than taking the #GP-fixup path). */ - _set_gate(idt_table + LEGACY_SYSCALL_VECTOR, SYS_DESC_trap_gate, 3, + _set_gate(idt_table + LEGACY_SYSCALL_VECTOR, SYS_DESC_irq_gate, 3, &int80_direct_trap); open_softirq(NMI_SOFTIRQ, nmi_softirq); diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c index 7bb54c2207..97ed165d0d 100644 --- a/xen/arch/x86/smpboot.c +++ b/xen/arch/x86/smpboot.c @@ -1151,20 +1151,6 @@ void __init smp_prepare_cpus(void) stack_base[0] = (void *)((unsigned long)stack_start & ~(STACK_SIZE - 1)); - if ( opt_xpti_hwdom || opt_xpti_domu ) - { - get_cpu_info()->pv_cr3 = 0; - -#ifdef CONFIG_PV - /* - * All entry points which may need to switch page tables have to start - * with interrupts off. Re-write what pv_trap_init() has put there. - */ - _set_gate(idt_table + LEGACY_SYSCALL_VECTOR, SYS_DESC_irq_gate, 3, - &int80_direct_trap); -#endif - } - set_nr_sockets(); socket_cpumask = xzalloc_array(cpumask_t *, nr_sockets); diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 09a86768ac..cde7702b4c 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -23,6 +23,8 @@ ENTRY(entry_int82) SPEC_CTRL_ENTRY_FROM_PV /* Req: %rsp=regs/cpuinfo, %rdx=0, Clob: acd */ /* WARNING! `ret`, `call *`, `jmp *` not safe before this point. */ + sti + CR4_PV32_RESTORE GET_CURRENT(bx) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index ff3b2d366c..a086349841 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -287,7 +287,6 @@ ENTRY(sysenter_entry) #ifdef CONFIG_XEN_SHSTK ALTERNATIVE "", "setssbsy", X86_FEATURE_XEN_SHSTK #endif - /* sti could live here when we don't switch page tables below. */ pushq $FLAT_USER_SS pushq $0 pushfq -- generated by git-patchbot for /home/xen/git/xen.git#stable-4.15
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |