[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen staging] x86/spec-ctrl: Use IST RSB protection for !SVM systems
commit e570e8d520ab542d8d35666b95cb3a0125b7b110 Author: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> AuthorDate: Tue Aug 2 14:30:30 2022 +0100 Commit: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> CommitDate: Fri Aug 5 12:16:24 2022 +0100 x86/spec-ctrl: Use IST RSB protection for !SVM systems There is a corner case where a VT-x guest which manages to reliably trigger non-fatal #MC's could evade the rogue RSB speculation protections that were supposed to be in place. This is a lack of defence in depth; Xen does not architecturally execute more RET than CALL instructions, so an attacker would have to locate a different gadget (e.g. SpectreRSB) first to execute a transient path of excess RET instructions. Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx> --- xen/arch/x86/spec_ctrl.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c index 44e86f3d67..d2cd545973 100644 --- a/xen/arch/x86/spec_ctrl.c +++ b/xen/arch/x86/spec_ctrl.c @@ -1327,8 +1327,24 @@ void __init init_speculation_mitigations(void) * mappings. */ if ( opt_rsb_hvm ) + { setup_force_cpu_cap(X86_FEATURE_SC_RSB_HVM); + /* + * For SVM, Xen's RSB safety actions are performed before STGI, so + * behave atomically with respect to IST sources. + * + * For VT-x, NMIs are atomic with VMExit (the NMI gets queued but not + * delivered) whereas other IST sources are not atomic. Specifically, + * #MC can hit ahead the RSB safety action in the vmexit path. + * + * Therefore, it is necessary for the IST logic to protect Xen against + * possible rogue RSB speculation. + */ + if ( !cpu_has_svm ) + default_spec_ctrl_flags |= SCF_ist_rsb; + } + ibpb_calculations(); /* Check whether Eager FPU should be enabled by default. */ -- generated by git-patchbot for /home/xen/git/xen.git#staging
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |