[xen stable-4.16] x86/spec-ctrl: Remove conditional IRQs-on-ness for INT $0x80/0x82 paths

[patchbot@xxxxxxx]

commit 4dfe95177b948d1f3ed27a801f603ed7f1bc36e8
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Oct 26 14:37:38 2023 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Oct 31 17:48:35 2023 +0000

    x86/spec-ctrl: Remove conditional IRQs-on-ness for INT $0x80/0x82 paths
    
    Before speculation defences, some paths in Xen could genuinely get away with
    being IRQs-on at entry.  But XPTI invalidated this property on most paths, 
and
    attempting to maintain it on the remaining paths was a mistake.
    
    Fast forward, and DO_SPEC_CTRL_COND_IBPB (protection for AMD BTC/SRSO) is 
not
    IRQ-safe, running with IRQs enabled in some cases.  The other actions taken 
on
    these paths happen to be IRQ-safe.
    
    Make entry_int82() and int80_direct_trap() unconditionally Interrupt Gates
    rather than Trap Gates.  Remove the conditional re-adjustment of
    int80_direct_trap() in smp_prepare_cpus(), and have entry_int82() explicitly
    enable interrupts when safe to do so.
    
    In smp_prepare_cpus(), with the conditional re-adjustment removed, the
    clearing of pv_cr3 is the only remaining action gated on XPTI, and it is out
    of place anyway, repeating work already done by smp_prepare_boot_cpu().  
Drop
    the entire if() condition to avoid leaving an incorrect vestigial remnant.
    
    Also drop comments which make incorrect statements about when its safe to
    enable interrupts.
    
    This is XSA-446 / CVE-2023-46836
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    (cherry picked from commit a48bb129f1b9ff55c22cf6d2b589247c8ba3b10e)
---
 xen/arch/x86/pv/traps.c            |  4 ++--
 xen/arch/x86/smpboot.c             | 14 --------------
 xen/arch/x86/x86_64/compat/entry.S |  2 ++
 xen/arch/x86/x86_64/entry.S        |  1 -
 4 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/xen/arch/x86/pv/traps.c b/xen/arch/x86/pv/traps.c
index 1e05a9f1cd..2fc24136c9 100644
--- a/xen/arch/x86/pv/traps.c
+++ b/xen/arch/x86/pv/traps.c
@@ -149,11 +149,11 @@ void __init pv_trap_init(void)
 #ifdef CONFIG_PV32
     /* The 32-on-64 hypercall vector is only accessible from ring 1. */
     _set_gate(idt_table + HYPERCALL_VECTOR,
-              SYS_DESC_trap_gate, 1, entry_int82);
+              SYS_DESC_irq_gate, 1, entry_int82);
 #endif
 
     /* Fast trap for int80 (faster than taking the #GP-fixup path). */
-    _set_gate(idt_table + LEGACY_SYSCALL_VECTOR, SYS_DESC_trap_gate, 3,
+    _set_gate(idt_table + LEGACY_SYSCALL_VECTOR, SYS_DESC_irq_gate, 3,
               &int80_direct_trap);
 
     open_softirq(NMI_SOFTIRQ, nmi_softirq);
diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
index 0694173173..4a10a1869a 100644
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -1167,20 +1167,6 @@ void __init smp_prepare_cpus(void)
 
     stack_base[0] = (void *)((unsigned long)stack_start & ~(STACK_SIZE - 1));
 
-    if ( opt_xpti_hwdom || opt_xpti_domu )
-    {
-        get_cpu_info()->pv_cr3 = 0;
-
-#ifdef CONFIG_PV
-        /*
-         * All entry points which may need to switch page tables have to start
-         * with interrupts off. Re-write what pv_trap_init() has put there.
-         */
-        _set_gate(idt_table + LEGACY_SYSCALL_VECTOR, SYS_DESC_irq_gate, 3,
-                  &int80_direct_trap);
-#endif
-    }
-
     set_nr_sockets();
 
     socket_cpumask = xzalloc_array(cpumask_t *, nr_sockets);
diff --git a/xen/arch/x86/x86_64/compat/entry.S 
b/xen/arch/x86/x86_64/compat/entry.S
index b86d38d1c5..253bb1688c 100644
--- a/xen/arch/x86/x86_64/compat/entry.S
+++ b/xen/arch/x86/x86_64/compat/entry.S
@@ -21,6 +21,8 @@ ENTRY(entry_int82)
         SPEC_CTRL_ENTRY_FROM_PV /* Req: %rsp=regs/cpuinfo, %rdx=0, Clob: acd */
         /* WARNING! `ret`, `call *`, `jmp *` not safe before this point. */
 
+        sti
+
         CR4_PV32_RESTORE
 
         GET_CURRENT(bx)
diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
index 88ff5c150f..837a31b405 100644
--- a/xen/arch/x86/x86_64/entry.S
+++ b/xen/arch/x86/x86_64/entry.S
@@ -327,7 +327,6 @@ ENTRY(sysenter_entry)
 #ifdef CONFIG_XEN_SHSTK
         ALTERNATIVE "", "setssbsy", X86_FEATURE_XEN_SHSTK
 #endif
-        /* sti could live here when we don't switch page tables below. */
         pushq $FLAT_USER_SS
         pushq $0
         pushfq
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.16