[xen stable-4.18] x86/spec-ctrl: Fix BTC/SRSO mitigations

[patchbot@xxxxxxx]

commit 6d4055b9a5d1d800d7f0e5584b9a0213bf25cd8b
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue Mar 26 22:47:25 2024 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Apr 9 16:45:01 2024 +0100

    x86/spec-ctrl: Fix BTC/SRSO mitigations
    
    We were looking for SCF_entry_ibpb in the wrong variable in the top-of-stack
    block, and xen_spec_ctrl won't have had bit 5 set because Xen doesn't
    understand SPEC_CTRL_RRSBA_DIS_U yet.
    
    This is XSA-455 / CVE-2024-31142.
    
    Fixes: 53a570b28569 ("x86/spec-ctrl: Support IBPB-on-entry")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/hvm/svm/entry.S             | 2 +-
 xen/arch/x86/include/asm/spec_ctrl_asm.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S
index c52528fed4..5f31d71698 100644
--- a/xen/arch/x86/hvm/svm/entry.S
+++ b/xen/arch/x86/hvm/svm/entry.S
@@ -101,7 +101,7 @@ __UNLIKELY_END(nsvm_hap)
         /* SPEC_CTRL_ENTRY_FROM_SVM    Req: %rsp=regs/cpuinfo, %rdx=0 Clob: 
acd */
 
         .macro svm_vmexit_cond_ibpb
-            testb  $SCF_entry_ibpb, CPUINFO_xen_spec_ctrl(%rsp)
+            testb  $SCF_entry_ibpb, CPUINFO_spec_ctrl_flags(%rsp)
             jz     .L_skip_ibpb
 
             mov    $MSR_PRED_CMD, %ecx
diff --git a/xen/arch/x86/include/asm/spec_ctrl_asm.h 
b/xen/arch/x86/include/asm/spec_ctrl_asm.h
index 13acebc75d..3c9aa56301 100644
--- a/xen/arch/x86/include/asm/spec_ctrl_asm.h
+++ b/xen/arch/x86/include/asm/spec_ctrl_asm.h
@@ -90,7 +90,7 @@
         jz     .L\@_skip
         testb  $3, UREGS_cs(%rsp)
     .else
-        testb  $SCF_entry_ibpb, CPUINFO_xen_spec_ctrl(%rsp)
+        testb  $SCF_entry_ibpb, CPUINFO_spec_ctrl_flags(%rsp)
     .endif
     jz     .L\@_skip
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.18