openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File xsa453-3.patch of Package xen

# Commit 7ef0084418e188d05f338c3e028fbbe8b6924afa
# Date 2024-03-12 15:50:04 +0000
# Author Roger Pau Monné <roger.pau@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/spinlock: introduce support for blocking speculation into critical regions

Introduce a new Kconfig option to block speculation into lock protected
critical regions.  The Kconfig option is enabled by default, but the mitigation
won't be engaged unless it's explicitly enabled in the command line using
`spec-ctrl=lock-harden`.

Convert the spinlock acquire macros into always-inline functions, and introduce
a speculation barrier after the lock has been taken.  Note the speculation
barrier is not placed inside the implementation of the spin lock functions, as
to prevent speculation from falling through the call to the lock functions
resulting in the barrier also being skipped.

trylock variants are protected using a construct akin to the existing
evaluate_nospec().

This patch only implements the speculation barrier for x86.

Note spin locks are the only locking primitive taken care in this change,
further locking primitives will be adjusted by separate changes.

This is part of XSA-453 / CVE-2024-2193

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -1725,7 +1725,7 @@ false disable the quirk workaround, whic
 >              {msr-sc,rsb,verw,ibpb-entry}=<bool>|{pv,hvm}=<bool>,
 >              bti-thunk=retpoline|lfence|jmp, {ibrs,ibpb,ssbd,psfd,
 >              eager-fpu,l1d-flush,srb-lock,unpriv-mmio,gds-mit,
->              div-scrub}=<bool> ]`
+>              div-scrub,lock-harden}=<bool> ]`
 
 Controls for speculative execution sidechannel mitigations.  By default, Xen
 will pick the most appropriate mitigations based on compiled in support,
@@ -1845,6 +1845,11 @@ On all hardware, the `div-scrub=` option
 from mitigating the DIV-leakage vulnerability.  By default, Xen will mitigate
 DIV-leakage on hardware believed to be vulnerable.
 
+If Xen is compiled with `CONFIG_SPECULATIVE_HARDEN_LOCK`, the `lock-harden=`
+boolean can be used to force or prevent Xen from using speculation barriers to
+protect lock critical regions.  This mitigation won't be engaged by default,
+and needs to be explicitly enabled on the command line.
+
 ### sync\_console
 > `= <boolean>`
 
--- a/xen/arch/x86/spec_ctrl.c
+++ b/xen/arch/x86/spec_ctrl.c
@@ -62,6 +62,8 @@ int8_t __read_mostly opt_ibpb_ctxt_switc
 int8_t __read_mostly opt_eager_fpu = -1;
 int8_t __read_mostly opt_l1d_flush = -1;
 
+static bool __initdata opt_lock_harden;
+
 bool __initdata bsp_delay_spec_ctrl;
 uint8_t __read_mostly default_xen_spec_ctrl;
 uint8_t __read_mostly default_spec_ctrl_flags;
@@ -169,6 +171,7 @@ static int __init parse_spec_ctrl(char *
             opt_ibpb_ctxt_switch = false;
             opt_ssbd = false;
             opt_l1d_flush = 0;
+            opt_lock_harden = false;
             opt_srb_lock = 0;
             opt_unpriv_mmio = false;
             opt_gds_mit = 0;
@@ -323,6 +326,9 @@ static int __init parse_spec_ctrl(char *
             opt_eager_fpu = val;
         else if ( (val = parse_boolean("l1d-flush", s, ss)) >= 0 )
             opt_l1d_flush = val;
+        else if ( IS_ENABLED(CONFIG_SPECULATIVE_HARDEN_LOCK) &&
+                  (val = parse_boolean("lock-harden", s, ss)) >= 0 )
+            opt_lock_harden = val;
         else if ( (val = parse_boolean("srb-lock", s, ss)) >= 0 )
             opt_srb_lock = val;
         else if ( (val = parse_boolean("unpriv-mmio", s, ss)) >= 0 )
@@ -522,7 +528,8 @@ static void __init print_details(enum in
            (e21a & cpufeat_mask(X86_FEATURE_SBPB))           ? " SBPB"           : "");
 
     /* Compiled-in support which pertains to mitigations. */
-    if ( IS_ENABLED(CONFIG_INDIRECT_THUNK) || IS_ENABLED(CONFIG_SHADOW_PAGING) )
+    if ( IS_ENABLED(CONFIG_INDIRECT_THUNK) || IS_ENABLED(CONFIG_SHADOW_PAGING) ||
+         IS_ENABLED(CONFIG_SPECULATIVE_HARDEN_LOCK) )
         printk("  Compiled-in support:"
 #ifdef CONFIG_INDIRECT_THUNK
                " INDIRECT_THUNK"
@@ -530,10 +537,13 @@ static void __init print_details(enum in
 #ifdef CONFIG_SHADOW_PAGING
                " SHADOW_PAGING"
 #endif
+#ifdef CONFIG_SPECULATIVE_HARDEN_LOCK
+               " HARDEN_LOCK"
+#endif
                "\n");
 
     /* Settings for Xen's protection, irrespective of guests. */
-    printk("  Xen settings: BTI-Thunk %s, SPEC_CTRL: %s%s%s%s%s, Other:%s%s%s%s%s\n",
+    printk("  Xen settings: BTI-Thunk %s, SPEC_CTRL: %s%s%s%s%s, Other:%s%s%s%s%s%s\n",
            thunk == THUNK_NONE      ? "N/A" :
            thunk == THUNK_RETPOLINE ? "RETPOLINE" :
            thunk == THUNK_LFENCE    ? "LFENCE" :
@@ -557,7 +567,8 @@ static void __init print_details(enum in
            opt_l1d_flush                             ? " L1D_FLUSH" : "",
            opt_verw_pv || opt_verw_hvm ||
            opt_verw_mmio                             ? " VERW"  : "",
-           opt_div_scrub                             ? " DIV" : "");
+           opt_div_scrub                             ? " DIV" : "",
+           opt_lock_harden                           ? " LOCK_HARDEN" : "");
 
     /* L1TF diagnostics, printed if vulnerable or PV shadowing is in use. */
     if ( cpu_has_bug_l1tf || opt_pv_l1tf_hwdom || opt_pv_l1tf_domu )
@@ -1805,6 +1816,9 @@ void __init init_speculation_mitigations
     else if ( opt_l1d_flush == -1 )
         opt_l1d_flush = cpu_has_bug_l1tf && !cpu_has_skip_l1dfl;
 
+    if ( !opt_lock_harden )
+        setup_force_cpu_cap(X86_FEATURE_SC_NO_LOCK_HARDEN);
+
     /*
      * We do not disable HT by default on affected hardware.
      *
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -49,6 +49,27 @@ config HAS_CHECKPOLICY
 	string
 	option env="XEN_HAS_CHECKPOLICY"
 
+menu "Speculative hardening"
+
+config SPECULATIVE_HARDEN_LOCK
+	bool "Speculative lock context hardening"
+	default y
+	depends on X86
+	help
+	  Contemporary processors may use speculative execution as a
+	  performance optimisation, but this can potentially be abused by an
+	  attacker to leak data via speculative sidechannels.
+
+	  One source of data leakage is via speculative accesses to lock
+	  critical regions.
+
+	  This option is disabled by default at run time, and needs to be
+	  enabled on the command line.
+
+	  If unsure, say Y.
+
+endmenu
+
 config KEXEC
 	bool "kexec support"
 	default y
--- a/xen/include/asm-x86/cpufeatures.h
+++ b/xen/include/asm-x86/cpufeatures.h
@@ -25,7 +25,7 @@ XEN_CPUFEATURE(XEN_SMEP,        (FSCAPIN
 XEN_CPUFEATURE(XEN_SMAP,        (FSCAPINTS+0)*32+11) /* SMAP gets used by Xen itself */
 XEN_CPUFEATURE(MSR_PLATFORM_INFO, (FSCAPINTS+0)*32+12) /* PLATFORM_INFO MSR present */
 XEN_CPUFEATURE(MSR_MISC_FEATURES, (FSCAPINTS+0)*32+13) /* MISC_FEATURES_ENABLES MSR present */
-/* Bit 14 - unused. */
+XEN_CPUFEATURE(SC_NO_LOCK_HARDEN,(FSCAPINTS+0)*32+14) /* (Disable) Lock critical region hardening */
 XEN_CPUFEATURE(IND_THUNK_LFENCE,(FSCAPINTS+0)*32+15) /* Use IND_THUNK_LFENCE */
 XEN_CPUFEATURE(IND_THUNK_JMP,   (FSCAPINTS+0)*32+16) /* Use IND_THUNK_JMP */
 XEN_CPUFEATURE(XEN_IBPB,        (FSCAPINTS+0)*32+17) /* IBRSB || IBPB */
--- a/xen/include/asm-x86/system.h
+++ b/xen/include/asm-x86/system.h
@@ -209,6 +209,32 @@ static inline unsigned long array_index_
 /* Override default implementation in nospec.h. */
 #define array_index_mask_nospec array_index_mask_nospec
 
+static always_inline void arch_block_lock_speculation(void)
+{
+    alternative("lfence", "", X86_FEATURE_SC_NO_LOCK_HARDEN);
+}
+
+/* Allow to insert a read memory barrier into conditionals */
+static always_inline bool barrier_lock_true(void)
+{
+    alternative("lfence #nospec-true", "", X86_FEATURE_SC_NO_LOCK_HARDEN);
+    return true;
+}
+
+static always_inline bool barrier_lock_false(void)
+{
+    alternative("lfence #nospec-false", "", X86_FEATURE_SC_NO_LOCK_HARDEN);
+    return false;
+}
+
+static always_inline bool arch_lock_evaluate_nospec(bool condition)
+{
+    if ( condition )
+        return barrier_lock_true();
+    else
+        return barrier_lock_false();
+}
+
 #define local_irq_disable()     asm volatile ( "cli" : : : "memory" )
 #define local_irq_enable()      asm volatile ( "sti" : : : "memory" )
 
--- a/xen/include/xen/nospec.h
+++ b/xen/include/xen/nospec.h
@@ -58,6 +58,21 @@ static inline unsigned long array_index_
     (typeof(_i)) (_i & _mask);                                          \
 })
 
+static always_inline void block_lock_speculation(void)
+{
+#ifdef CONFIG_SPECULATIVE_HARDEN_LOCK
+    arch_block_lock_speculation();
+#endif
+}
+
+static always_inline bool lock_evaluate_nospec(bool condition)
+{
+#ifdef CONFIG_SPECULATIVE_HARDEN_LOCK
+    return arch_lock_evaluate_nospec(condition);
+#endif
+    return condition;
+}
+
 #endif /* XEN_NOSPEC_H */
 
 /*
--- a/xen/include/xen/spinlock.h
+++ b/xen/include/xen/spinlock.h
@@ -1,6 +1,7 @@
 #ifndef __SPINLOCK_H__
 #define __SPINLOCK_H__
 
+#include <xen/nospec.h>
 #include <asm/system.h>
 #include <asm/spinlock.h>
 #include <asm/types.h>
@@ -168,12 +169,23 @@ int _spin_trylock_recursive(spinlock_t *
 void _spin_lock_recursive(spinlock_t *lock);
 void _spin_unlock_recursive(spinlock_t *lock);
 
-#define spin_lock(l)                  _spin_lock(l)
-#define spin_lock_irq(l)              _spin_lock_irq(l)
+static always_inline void spin_lock(spinlock_t *l)
+{
+    _spin_lock(l);
+    block_lock_speculation();
+}
+
+static always_inline void spin_lock_irq(spinlock_t *l)
+{
+    _spin_lock_irq(l);
+    block_lock_speculation();
+}
+
 #define spin_lock_irqsave(l, f)                                 \
     ({                                                          \
         BUILD_BUG_ON(sizeof(f) != sizeof(unsigned long));       \
         ((f) = _spin_lock_irqsave(l));                          \
+        block_lock_speculation();                               \
     })
 
 #define spin_unlock(l)                _spin_unlock(l)
@@ -181,7 +193,7 @@ void _spin_unlock_recursive(spinlock_t *
 #define spin_unlock_irqrestore(l, f)  _spin_unlock_irqrestore(l, f)
 
 #define spin_is_locked(l)             _spin_is_locked(l)
-#define spin_trylock(l)               _spin_trylock(l)
+#define spin_trylock(l)               lock_evaluate_nospec(_spin_trylock(l))
 
 #define spin_trylock_irqsave(lock, flags)       \
 ({                                              \
@@ -200,8 +212,15 @@ void _spin_unlock_recursive(spinlock_t *
  * are any critical regions that cannot form part of such a set, they can use
  * standard spin_[un]lock().
  */
-#define spin_trylock_recursive(l)     _spin_trylock_recursive(l)
-#define spin_lock_recursive(l)        _spin_lock_recursive(l)
+#define spin_trylock_recursive(l) \
+    lock_evaluate_nospec(_spin_trylock_recursive(l))
+
+static always_inline void spin_lock_recursive(spinlock_t *l)
+{
+    _spin_lock_recursive(l);
+    block_lock_speculation();
+}
+
 #define spin_unlock_recursive(l)      _spin_unlock_recursive(l)
 
 #endif /* __SPINLOCK_H__ */

Places

File xsa453-3.patch of Package xen

Places