mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Andrew Cooper
d7b78041dc
In the Zen1 microarchitecure, there is one divider in the pipeline which
services uops from both threads. In the case of #DE, the latched result from
the previous DIV to execute will be forwarded speculatively.
This is an interesting covert channel that allows two threads to communicate
without any system calls. In also allows userspace to obtain the result of
the most recent DIV instruction executed (even speculatively) in the core,
which can be from a higher privilege context.
Scrub the result from the divider by executing a non-faulting divide. This
needs performing on the exit-to-guest paths, and ist_exit-to-Xen.
Alternatives in IST context is believed safe now that it's done in NMI
context.
This is XSA-439 / CVE-2023-20588.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit b5926c6ecf)
Sphinx documentation:
All source rendered by Sphinx is licensed under CC-BY-4.0.
You are free to:
Share:
Copy and redistribute the material in any medium or format.
Adapt:
Remix, transform, and build upon the material for any purpose, even
commercially.
Under the following terms:
Attribution:
You must give appropriate credit, provide a link to the license, and
indicate if changes were made. You may do so in any reasonable manner, but
not in any way that suggests the licensor endorses you or your use.
No additional restrictions:
You may not apply legal terms or technological measures that legally
restrict others from doing anything the license permits.
See https://creativecommons.org/licenses/by/4.0/ for full details.
This includes:
* All ReStructured Text files: docs/*/*.rst
* The Sphinx configuration file: docs/conf.py
* Content in Sphinx-exclusive subdirs: docs/*-guide/*
Other documentation:
There are a variety of text documents in various formats. These, given no
explicit license guidance, fall under Xen's default GPL-2.0 license.