From 41d93be76611704bdc73e8fe71c251a6f1da114c Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roger=20Pau=20Monn=C3=A9?= Date: Mon, 4 Mar 2024 18:08:48 +0100 Subject: [PATCH] x86/mm: add speculation barriers to open coded locks MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Add a speculation barrier to the clearly identified open-coded lock taking functions. Note that the memory sharing page_lock() replacement (_page_lock()) is left as-is, as the code is experimental and not security supported. This is part of XSA-453 / CVE-2024-2193 Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 42a572a38e22a97d86a4b648a22597628d5b42e4) --- xen/arch/x86/mm.c | 6 ++++-- xen/include/asm-x86/mm.h | 4 +++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index ea024c1450..2bf1b70985 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -2005,7 +2005,7 @@ static inline bool current_locked_page_ne_check(struct page_info *page) { #define current_locked_page_ne_check(x) true #endif -int page_lock(struct page_info *page) +int page_lock_unsafe(struct page_info *page) { unsigned long x, nx; @@ -2066,7 +2066,7 @@ void page_unlock(struct page_info *page) * l3t_lock(), so to avoid deadlock we must avoid grabbing them in * reverse order. */ -static void l3t_lock(struct page_info *page) +static always_inline void l3t_lock(struct page_info *page) { unsigned long x, nx; @@ -2075,6 +2075,8 @@ static void l3t_lock(struct page_info *page) cpu_relax(); nx = x | PGT_locked; } while ( cmpxchg(&page->u.inuse.type_info, x, nx) != x ); + + block_lock_speculation(); } static void l3t_unlock(struct page_info *page) diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h index cccef852b4..73d5a98bec 100644 --- a/xen/include/asm-x86/mm.h +++ b/xen/include/asm-x86/mm.h @@ -393,7 +393,9 @@ const struct platform_bad_page *get_platform_badpages(unsigned int *array_size); * The use of PGT_locked in mem_sharing does not collide, since mem_sharing is * only supported for hvm guests, which do not have PV PTEs updated. */ -int page_lock(struct page_info *page); +int page_lock_unsafe(struct page_info *page); +#define page_lock(pg) lock_evaluate_nospec(page_lock_unsafe(pg)) + void page_unlock(struct page_info *page); void put_page_type(struct page_info *page); -- 2.39.5