[Xen-devel] [PATCH v7 00/17] x86: Mitigations for SP2/CVE-2017-5715/Branch Target Injection

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

In addition to this software series, you will need the following:

  1) A compiler which understands -mindirect-branch=thunk-external and
     -mindirect-branch-register.  A GCC patch series implementing this should
     be available imminently.  In the meantime, a development branch can be
     obtained from:

     https://github.com/hjl-tools/gcc/commits/hjl/indirect/gcc-7-branch/master

  2) New microcode from Intel and AMD.  These provide new MSRs for Xen to use,
     and virtualise for guest kernels to use.

There are some limitations, even with the work presented here.

  1) vCPU-to-vCPU SP2 attacks can only be mitigated at the hypervisor level
     with IBPB support, which for internal pipeline reasons, we do not expect
     to be made available on older processors.  For now, I will leave these
     details to the hardware vendors.

  2) Hardware lacking SMEP is in a worse position than hardware with SMEP.  If
     you have SMEP (Intel IvyBridge and later, Some AMD Fam16h and all Fam17h
     and later), make absolutely sure it is enabled in the BIOS and working.

  3) On hardware lacking SMEP support, it is still an open question how to
     protect against RSB-to-SMM speculation.  Native operating systems can fix
     this by prohibiting userspace from mmap()'ing addresses which alias the
     SMM range, but Xen has no feasible way of enforcing this restriction on
     PV guests, even if we could tolerate the ABI breakage.  (However, see the
     forthcoming SP3 mitigation series for alternatives for un trusted PV
     guests).

Please see the commit messages and comments for more details about mitigation
details and available options/impacts.  Its more complicated than I care to
reproduce here (and risk introducing a contradition).

~Andrew

Major changes in v7:
 * Adjust thunks to latest upstream gcc
 * Fix clang build
 * Rework RSB filling from scratch

Andrew Cooper (17):
  x86: Support compiling with indirect branch thunks
  x86: Support indirect thunks from assembly code
  x86/boot: Report details of speculative mitigations
  x86/amd: Try to set lfence as being Dispatch Serialising
  x86: Introduce alternative indirect thunks
  x86/feature: Definitions for Indirect Branch Controls
  x86/cmdline: Introduce a command line option to disable IBRS/IBPB, STIBP and 
IBPB
  x86/msr: Emulation of MSR_{SPEC_CTRL,PRED_CMD} for guests
  x86/migrate: Move MSR_SPEC_CTRL on migrate
  x86/hvm: Permit guests direct access to MSR_{SPEC_CTRL,PRED_CMD}
  x86: Protect unaware domains from meddling hyperthreads
  x86/entry: Organise the use of MSR_SPEC_CTRL at each entry/exit point
  x86/boot: Calculate the most appropriate BTI mitigation to use
  x86/entry: Clobber the Return Stack Buffer/Return Address Stack on entry to 
Xen
  x86/ctxt: Issue a speculation barrier between vcpu contexts
  x86/cpuid: Offer Indirect Branch Controls to guests
  x86/idle: Clear SPEC_CTRL while idle

 docs/misc/xen-command-line.markdown         |  39 ++++
 tools/libxc/xc_cpuid_x86.c                  |   4 +-
 tools/libxl/libxl_cpuid.c                   |   3 +
 tools/misc/xen-cpuid.c                      |  12 +-
 xen/Rules.mk                                |   4 +-
 xen/arch/x86/Makefile                       |   2 +
 xen/arch/x86/Rules.mk                       |  13 ++
 xen/arch/x86/acpi/cpu_idle.c                |  21 ++
 xen/arch/x86/boot/trampoline.S              |  24 ++-
 xen/arch/x86/cpu/amd.c                      |  35 +++-
 xen/arch/x86/cpu/mwait-idle.c               |   7 +
 xen/arch/x86/cpuid.c                        |  43 ++++
 xen/arch/x86/domain.c                       |  19 ++
 xen/arch/x86/domctl.c                       |  21 ++
 xen/arch/x86/extable.c                      |   4 +-
 xen/arch/x86/hvm/hvm.c                      |   2 +
 xen/arch/x86/hvm/svm/entry.S                |   8 +-
 xen/arch/x86/hvm/svm/svm.c                  |   5 +
 xen/arch/x86/hvm/vmx/entry.S                |  11 ++
 xen/arch/x86/hvm/vmx/vmx.c                  |  18 ++
 xen/arch/x86/indirect-thunk.S               |  38 ++++
 xen/arch/x86/msr.c                          |  37 ++++
 xen/arch/x86/pv/emul-priv-op.c              |  42 ++--
 xen/arch/x86/setup.c                        |   4 +
 xen/arch/x86/smpboot.c                      |   2 +
 xen/arch/x86/spec_ctrl.c                    | 295 ++++++++++++++++++++++++++++
 xen/arch/x86/x86_64/asm-offsets.c           |   6 +
 xen/arch/x86/x86_64/compat/entry.S          |  12 ++
 xen/arch/x86/x86_64/entry.S                 |  39 +++-
 xen/arch/x86/x86_emulate/x86_emulate.c      |   4 +-
 xen/arch/x86/xen.lds.S                      |   1 +
 xen/common/kernel.c                         |  23 +++
 xen/common/wait.c                           |   8 +-
 xen/include/asm-x86/asm_defns.h             |  11 ++
 xen/include/asm-x86/cpufeature.h            |   4 +
 xen/include/asm-x86/cpufeatures.h           |   8 +
 xen/include/asm-x86/current.h               |   6 +
 xen/include/asm-x86/indirect_thunk_asm.h    |  41 ++++
 xen/include/asm-x86/msr-index.h             |   9 +
 xen/include/asm-x86/msr.h                   |  15 ++
 xen/include/asm-x86/nops.h                  |   7 +
 xen/include/asm-x86/spec_ctrl.h             | 101 ++++++++++
 xen/include/asm-x86/spec_ctrl_asm.h         | 270 +++++++++++++++++++++++++
 xen/include/public/arch-x86/cpufeatureset.h |   3 +
 xen/include/xen/lib.h                       |   7 +
 xen/tools/gen-cpuid.py                      |   5 +
 46 files changed, 1263 insertions(+), 30 deletions(-)
 create mode 100644 xen/arch/x86/indirect-thunk.S
 create mode 100644 xen/arch/x86/spec_ctrl.c
 create mode 100644 xen/include/asm-x86/indirect_thunk_asm.h
 create mode 100644 xen/include/asm-x86/spec_ctrl.h
 create mode 100644 xen/include/asm-x86/spec_ctrl_asm.h

-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel