[PATCH v6.5 00/26] x86: Mitigations for SP2/CVE-2017-5715/Branch Target Injection

[Andrew Cooper <andrew.cooper3@citrix.com>]

Due to the foreshortening of the embargo, I've posted what is currently
available.  I have yet to complete all the feedback from v6 review, but what
is here should be functionally correct, if a little rough around the edges.

*Important:*

In addition to this software series, you will need the following:

  1) A compiler which understands -mindirect-branch=thunk-external and
     -mindirect-branch-register.  A GCC patch series implementing this
     should be available imminently.

  2) New microcode from Intel and AMD.  These provide new MSRs for Xen to use,
     and virtualise for guest kernels to use.

There are some limitations, even with the work presented here.

  1) vCPU-to-vCPU SP2 attacks can only be mitigated at the hypervisor level
     with IBPB support, which for internal pipeline reasons, we do not expect
     to be made available on older processors.  For now, I will leave these
     details to the hardware vendors.

  2) Hardware lacking SMEP is in a worse position than hardware with SMEP.  If
     you have SMEP (Intel IvyBridge and later, Some AMD Fam16h and all Fam17h
     and later), make absolutely sure it is enabled in the BIOS and working.

  3) On hardware lacking SMEP support, it is still an open question how to
     protect against RSB-to-SMM speculation.  Native operating systems can fix
     this by prohibiting userspace from mmap()'ing addresses which alias the
     SMM range, but Xen has no feasible way of enforcing this restriction on
     PV guests, even if we could tolerate the ABI breakage.  (However, see the
     forthcoming SP3 mitigation series for alternatives for un trusted PV
     guests).


Please see the commit messages and comments for more details about mitigation
details and available options/impacts.  Its more complicated than I care to
reproduce here (and risk introducing a contradition).

~Andrew

Andrew Cooper (26):
  x86/alt: Break out alternative-asm into a separate header file
  x86/alt: Introduce ALTERNATIVE{,_2} macros
  x86/hvm: Rename update_guest_vendor() callback to cpuid_policy_changed()
  x86: Introduce a common cpuid_policy_updated()
  x86/entry: Remove support for partial cpu_user_regs frames
  x86/entry: Rearrange RESTORE_ALL to restore register in stack order
  x86/hvm: Use SAVE_ALL to construct the cpu_user_regs frame after VMExit
  x86/entry: Erase guest GPR state on entry to Xen
  x86: Support compiling with indirect branch thunks
  common/wait: Clarifications to wait infrastructure
  x86: Support indirect thunks from assembly code
  x86/boot: Report details of speculative mitigations
  x86/amd: Try to set lfence as being Dispatch Serialising
  x86: Introduce alternative indirect thunks
  x86/feature: Definitions for Indirect Branch Controls
  x86/cmdline: Introduce a command line option to disable IBRS/IBPB, STIBP and IBPB
  x86/msr: Emulation of MSR_{SPEC_CTRL,PRED_CMD} for guests
  x86/migrate: Move MSR_SPEC_CTRL on migrate
  x86/hvm: Permit guests direct access to MSR_{SPEC_CTRL,PRED_CMD}
  x86: Protect unaware domains from meddling hyperthreads
  x86/entry: Use MSR_SPEC_CTRL at each entry/exit point
  x86/boot: Calculate the most appropriate BTI mitigation to use
  x86/entry: Clobber the Return Stack Buffer on entry to Xen
  x86/ctxt: Issue a speculation barrier between vcpu contexts
  x86/cpuid: Offer Indirect Branch Controls to guests
  x86/idle: Clear SPEC_CTRL while idle

 docs/misc/xen-command-line.markdown         |  37 ++++
 tools/libxc/xc_cpuid_x86.c                  |   4 +-
 tools/libxl/libxl_cpuid.c                   |   3 +
 tools/misc/xen-cpuid.c                      |  12 +-
 tools/tests/x86_emulator/x86-emulate.c      |   1 -
 xen/arch/x86/Makefile                       |   2 +
 xen/arch/x86/Rules.mk                       |   7 +
 xen/arch/x86/acpi/cpu_idle.c                |  21 ++
 xen/arch/x86/boot/trampoline.S              |  24 +-
 xen/arch/x86/cpu/amd.c                      |  35 ++-
 xen/arch/x86/cpu/mwait-idle.c               |   7 +
 xen/arch/x86/cpuid.c                        |  43 ++++
 xen/arch/x86/domain.c                       |  42 ++++
 xen/arch/x86/domctl.c                       |  38 +++-
 xen/arch/x86/extable.c                      |   4 +-
 xen/arch/x86/hvm/hvm.c                      |   4 +-
 xen/arch/x86/hvm/svm/entry.S                |  28 +--
 xen/arch/x86/hvm/svm/svm.c                  |   9 +-
 xen/arch/x86/hvm/vmx/entry.S                |  28 ++-
 xen/arch/x86/hvm/vmx/vmx.c                  |  23 +-
 xen/arch/x86/indirect_thunk.S               |  39 ++++
 xen/arch/x86/msr.c                          |  49 +++++
 xen/arch/x86/pv/domain.c                    |   1 -
 xen/arch/x86/pv/emul-priv-op.c              |  43 +++-
 xen/arch/x86/setup.c                        |   4 +
 xen/arch/x86/smpboot.c                      |   2 +
 xen/arch/x86/spec_ctrl.c                    | 328 ++++++++++++++++++++++++++++
 xen/arch/x86/x86_64/asm-offsets.c           |   6 +
 xen/arch/x86/x86_64/compat/entry.S          |  19 +-
 xen/arch/x86/x86_64/entry.S                 |  51 ++++-
 xen/arch/x86/x86_64/traps.c                 |  13 +-
 xen/arch/x86/x86_emulate.c                  |   1 -
 xen/arch/x86/x86_emulate/x86_emulate.c      |  12 +-
 xen/arch/x86/xen.lds.S                      |   1 +
 xen/common/kernel.c                         |  23 ++
 xen/common/wait.c                           |  38 +++-
 xen/include/asm-x86/alternative-asm.h       |  77 +++++++
 xen/include/asm-x86/alternative.h           |  13 +-
 xen/include/asm-x86/asm_defns.h             | 158 ++++----------
 xen/include/asm-x86/cpufeature.h            |   6 +
 xen/include/asm-x86/cpufeatures.h           |  10 +
 xen/include/asm-x86/current.h               |   6 +
 xen/include/asm-x86/domain.h                |   2 +
 xen/include/asm-x86/hvm/hvm.h               |   6 +-
 xen/include/asm-x86/indirect_thunk_asm.h    |  41 ++++
 xen/include/asm-x86/msr-index.h             |  12 +
 xen/include/asm-x86/msr.h                   |  15 ++
 xen/include/asm-x86/nops.h                  |  10 +-
 xen/include/asm-x86/spec_ctrl.h             |  78 +++++++
 xen/include/asm-x86/spec_ctrl_asm.h         | 276 +++++++++++++++++++++++
 xen/include/public/arch-x86/cpufeatureset.h |   3 +
 xen/include/xen/lib.h                       |   7 +
 xen/tools/gen-cpuid.py                      |   5 +
 53 files changed, 1497 insertions(+), 230 deletions(-)
 create mode 100644 xen/arch/x86/indirect_thunk.S
 create mode 100644 xen/arch/x86/spec_ctrl.c
 create mode 100644 xen/include/asm-x86/alternative-asm.h
 create mode 100644 xen/include/asm-x86/indirect_thunk_asm.h
 create mode 100644 xen/include/asm-x86/spec_ctrl.h
 create mode 100644 xen/include/asm-x86/spec_ctrl_asm.h

-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel