[xen staging-4.19] x86/alternatives: serialize after (self-)modifying code

[patchbot@xxxxxxx]

commit e13e729e3b548f2439fd9db83743a94c3d5ea103
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Jul 31 09:52:17 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Jul 31 09:52:17 2025 +0200

    x86/alternatives: serialize after (self-)modifying code
    
    While supposedly safe via enforcing a control flow change when modifying
    already prefetched code, it may not really be. Afaik a request is
    pending to drop the first of the two options in the SDM's "Handling
    Self- and Cross-Modifying Code" section (still present there as of
    version 087). Insert a serializing instruction there, and remove the
    "noinline" in exchange.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Jason Andryuk <jason.andryuk@xxxxxxx>
    master commit: c5b06d0b1b4ffcbb4ec77f999dfa530a035558bf
    master date: 2025-07-23 15:17:28 +0200
---
 xen/arch/x86/alternative.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/alternative.c b/xen/arch/x86/alternative.c
index 1b71ae959a..398a308c41 100644
--- a/xen/arch/x86/alternative.c
+++ b/xen/arch/x86/alternative.c
@@ -195,13 +195,18 @@ void *place_ret(void *ptr)
  * You should run this with interrupts disabled or on code that is not
  * executing.
  *
- * "noinline" to cause control flow change and thus invalidate I$ and
- * cause refetch after modification.
+ * While the SDM continues to suggest using "noinline" would be sufficient, it
+ * may not be, e.g. due to errata.  Issue a serializing insn afterwards, unless
+ * this is for live-patching, where we modify code before it goes live.  Issue
+ * a serializing insn which is unlikely to be intercepted by a hypervisor, in
+ * case we run virtualized ourselves.
  */
-static void init_or_livepatch noinline
+static void init_or_livepatch
 text_poke(void *addr, const void *opcode, size_t len)
 {
     memcpy(addr, opcode, len);
+    if ( system_state < SYS_STATE_active )
+        asm volatile ( "mov %0, %%cr2" :: "r" (0L) : "memory" );
 }
 
 extern void *const __initdata_cf_clobber_start[];
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.19