x86/spec-ctrl: Protect against Speculative Code Store Bypass
authorAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 11 Mar 2021 14:39:11 +0000 (14:39 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 8 Jun 2021 17:36:03 +0000 (18:36 +0100)
commitfcf98eff7321a5ed8d9b4fccf44cde8ad7e2ec7e
tree2e536b8ac6c32490ed9820a54fe6f0f1c7afeac3
parent51278ce831a8fcc4ffb4c841e3442de3fd4ea76b
x86/spec-ctrl: Protect against Speculative Code Store Bypass

Modern x86 processors have far-better-than-architecturally-guaranteed self
modifying code detection.  Typically, when a write hits an instruction in
flight, a Machine Clear occurs to flush stale content in the frontend and
backend.

For self modifying code, before a write which hits an instruction in flight
retires, the frontend can speculatively decode and execute the old instruction
stream.  Speculation of this form can suffer from type confusion in registers,
and potentially leak data.

Furthermore, updates are typically byte-wise, rather than atomic.  Depending
on timing, speculation can race ahead multiple times between individual
writes, and execute the transiently-malformed instruction stream.

Xen has stubs which are used in certain cases for emulation purposes.  Inhibit
speculation between updating the stub and executing it.

This is XSA-375 / CVE-2021-0089.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 45f59ed8865318bb0356954bad067f329677ce9e)
xen/arch/x86/pv/emul-priv-op.c
xen/arch/x86/x86_emulate/x86_emulate.c