mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Andrew Cooper
0a5387a011
Branch Type Confusion affects AMD/Hygon CPUs on Zen2 and earlier. To
mitigate, we require SMT safety (STIBP on Zen2, no-SMT on Zen1), and to issue
an IBPB on each entry to Xen, to flush the BTB.
Due to performance concerns, dom0 (which is trusted in most configurations) is
excluded from protections by default.
Therefore:
* Use STIBP by default on Zen2 too, which now means we want it on by default
on all hardware supporting STIBP.
* Break the current IBPB logic out into a new function, extending it with
IBPB-at-entry logic.
* Change the existing IBPB-at-ctxt-switch boolean to be tristate, and disable
it by default when IBPB-at-entry is providing sufficient safety.
If all PV guests on the system are trusted, then it is recommended to boot
with `spec-ctrl=ibpb-entry=no-pv`, as this will provide an additional marginal
perf improvement.
This is part of XSA-407 / CVE-2022-23825.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit d8cb7e0f06)
Sphinx documentation:
All source rendered by Sphinx is licensed under CC-BY-4.0.
You are free to:
Share:
Copy and redistribute the material in any medium or format.
Adapt:
Remix, transform, and build upon the material for any purpose, even
commercially.
Under the following terms:
Attribution:
You must give appropriate credit, provide a link to the license, and
indicate if changes were made. You may do so in any reasonable manner, but
not in any way that suggests the licensor endorses you or your use.
No additional restrictions:
You may not apply legal terms or technological measures that legally
restrict others from doing anything the license permits.
See https://creativecommons.org/licenses/by/4.0/ for full details.
This includes:
* All ReStructured Text files: docs/*/*.rst
* The Sphinx configuration file: docs/conf.py
* Content in Sphinx-exclusive subdirs: docs/*-guide/*
Other documentation:
There are a variety of text documents in various formats. These, given no
explicit license guidance, fall under Xen's default GPL-2.0 license.