From: Andrew Cooper Date: Tue, 26 Mar 2024 22:47:25 +0000 (+0000) Subject: x86/spec-ctrl: Fix BTC/SRSO mitigations X-Git-Tag: RELEASE-4.16.6~24 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=28f5ceb0b19b13a7c0ebd125c587e469490ab872;p=xen.git x86/spec-ctrl: Fix BTC/SRSO mitigations We were looking for SCF_entry_ibpb in the wrong variable in the top-of-stack block, and xen_spec_ctrl won't have had bit 5 set because Xen doesn't understand SPEC_CTRL_RRSBA_DIS_U yet. This is XSA-455 / CVE-2024-31142. Fixes: 53a570b28569 ("x86/spec-ctrl: Support IBPB-on-entry") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S index ad5ca50c12..d1ca530315 100644 --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -101,7 +101,7 @@ __UNLIKELY_END(nsvm_hap) /* SPEC_CTRL_ENTRY_FROM_SVM Req: %rsp=regs/cpuinfo, %rdx=0 Clob: acd */ .macro svm_vmexit_cond_ibpb - testb $SCF_entry_ibpb, CPUINFO_xen_spec_ctrl(%rsp) + testb $SCF_entry_ibpb, CPUINFO_spec_ctrl_flags(%rsp) jz .L_skip_ibpb mov $MSR_PRED_CMD, %ecx diff --git a/xen/include/asm-x86/spec_ctrl_asm.h b/xen/include/asm-x86/spec_ctrl_asm.h index 6e7725c11f..9416483c0b 100644 --- a/xen/include/asm-x86/spec_ctrl_asm.h +++ b/xen/include/asm-x86/spec_ctrl_asm.h @@ -102,7 +102,7 @@ jz .L\@_skip testb $3, UREGS_cs(%rsp) .else - testb $SCF_entry_ibpb, CPUINFO_xen_spec_ctrl(%rsp) + testb $SCF_entry_ibpb, CPUINFO_spec_ctrl_flags(%rsp) .endif jz .L\@_skip