1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
From 074b4c8987db235a0b86798810c045f68e4775b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
Date: Mon, 4 Mar 2024 18:08:48 +0100
Subject: [PATCH 52/67] x86/mm: add speculation barriers to open coded locks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add a speculation barrier to the clearly identified open-coded lock taking
functions.
Note that the memory sharing page_lock() replacement (_page_lock()) is left
as-is, as the code is experimental and not security supported.
This is part of XSA-453 / CVE-2024-2193
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 42a572a38e22a97d86a4b648a22597628d5b42e4)
---
xen/arch/x86/include/asm/mm.h | 4 +++-
xen/arch/x86/mm.c | 6 ++++--
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/xen/arch/x86/include/asm/mm.h b/xen/arch/x86/include/asm/mm.h
index a5d7fdd32e..5845b729c3 100644
--- a/xen/arch/x86/include/asm/mm.h
+++ b/xen/arch/x86/include/asm/mm.h
@@ -393,7 +393,9 @@ const struct platform_bad_page *get_platform_badpages(unsigned int *array_size);
* The use of PGT_locked in mem_sharing does not collide, since mem_sharing is
* only supported for hvm guests, which do not have PV PTEs updated.
*/
-int page_lock(struct page_info *page);
+int page_lock_unsafe(struct page_info *page);
+#define page_lock(pg) lock_evaluate_nospec(page_lock_unsafe(pg))
+
void page_unlock(struct page_info *page);
void put_page_type(struct page_info *page);
diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 330c4abcd1..8d19d719bd 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -2033,7 +2033,7 @@ static inline bool current_locked_page_ne_check(struct page_info *page) {
#define current_locked_page_ne_check(x) true
#endif
-int page_lock(struct page_info *page)
+int page_lock_unsafe(struct page_info *page)
{
unsigned long x, nx;
@@ -2094,7 +2094,7 @@ void page_unlock(struct page_info *page)
* l3t_lock(), so to avoid deadlock we must avoid grabbing them in
* reverse order.
*/
-static void l3t_lock(struct page_info *page)
+static always_inline void l3t_lock(struct page_info *page)
{
unsigned long x, nx;
@@ -2103,6 +2103,8 @@ static void l3t_lock(struct page_info *page)
cpu_relax();
nx = x | PGT_locked;
} while ( cmpxchg(&page->u.inuse.type_info, x, nx) != x );
+
+ block_lock_speculation();
}
static void l3t_unlock(struct page_info *page)
--
2.44.0
|
GitWeb
