[xen staging-4.19] x86/svm: Separate STI and VMRUN instructions in svm_asm_do_resume()

[patchbot@xxxxxxx]

commit b067751570d77e661e22c8b177d1fff4980c4b6a
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Mar 20 13:14:51 2025 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Mar 20 13:14:51 2025 +0100

    x86/svm: Separate STI and VMRUN instructions in svm_asm_do_resume()
    
    There is a corner case in the VMRUN instruction where its INTR_SHADOW state
    leaks into guest state if a VMExit occurs before the VMRUN is complete.  An
    example of this could be taking #NPF due to event injection.
    
    Xen can safely execute STI anywhere between CLGI and VMRUN, as CLGI blocks
    external interrupts too.  However, an exception (while fatal) will appear to
    be in an irqs-on region (as GIF isn't considered), so position the STI after
    the speculation actions but prior to the GPR pops.
    
    Link: 
https://lore.kernel.org/all/CADH9ctBs1YPmE4aCfGPNBwA10cA8RuAk2gO7542DjMZgs4uzJQ@xxxxxxxxxxxxxx/
    Fixes: 66b245d9eaeb ("SVM: limit GIF=0 region")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: c989ff614f6bad48b3bd4b32694f711b31c7b2d6
    master date: 2025-02-19 12:45:48 +0000
---
 xen/arch/x86/hvm/svm/entry.S | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S
index 6fd9652c04..91edb33459 100644
--- a/xen/arch/x86/hvm/svm/entry.S
+++ b/xen/arch/x86/hvm/svm/entry.S
@@ -74,6 +74,14 @@ __UNLIKELY_END(nsvm_hap)
         ALTERNATIVE "", svm_vmentry_spec_ctrl, X86_FEATURE_SC_MSR_HVM
         ALTERNATIVE "", DO_SPEC_CTRL_DIV, X86_FEATURE_SC_DIV
 
+        /*
+         * Set EFLAGS.IF after CLGI covers us from real interrupts, but not
+         * immediately prior to VMRUN.  The VMRUN instruction leaks it's
+         * INTR_SHADOW into guest state if a VMExit occurs before VMRUN
+         * completes (e.g. taking #NPF during event injecting.)
+         */
+        sti
+
         pop  %r15
         pop  %r14
         pop  %r13
@@ -91,7 +99,6 @@ __UNLIKELY_END(nsvm_hap)
         pop  %rsi
         pop  %rdi
 
-        sti
         vmrun
 
         SAVE_ALL
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.19