[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen staging-4.15] x86/spec-ctrl: Use IST RSB protection for !SVM systems
commit 8ae0b4d1331c14fb9e30a42987c0152c9b00f530 Author: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> AuthorDate: Mon Aug 15 15:40:05 2022 +0200 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Mon Aug 15 15:40:05 2022 +0200 x86/spec-ctrl: Use IST RSB protection for !SVM systems There is a corner case where a VT-x guest which manages to reliably trigger non-fatal #MC's could evade the rogue RSB speculation protections that were supposed to be in place. This is a lack of defence in depth; Xen does not architecturally execute more RET than CALL instructions, so an attacker would have to locate a different gadget (e.g. SpectreRSB) first to execute a transient path of excess RET instructions. Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx> master commit: e570e8d520ab542d8d35666b95cb3a0125b7b110 master date: 2022-08-05 12:16:24 +0100 --- xen/arch/x86/spec_ctrl.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c index f7b0251c42..ac73806eac 100644 --- a/xen/arch/x86/spec_ctrl.c +++ b/xen/arch/x86/spec_ctrl.c @@ -1279,8 +1279,24 @@ void __init init_speculation_mitigations(void) * mappings. */ if ( opt_rsb_hvm ) + { setup_force_cpu_cap(X86_FEATURE_SC_RSB_HVM); + /* + * For SVM, Xen's RSB safety actions are performed before STGI, so + * behave atomically with respect to IST sources. + * + * For VT-x, NMIs are atomic with VMExit (the NMI gets queued but not + * delivered) whereas other IST sources are not atomic. Specifically, + * #MC can hit ahead the RSB safety action in the vmexit path. + * + * Therefore, it is necessary for the IST logic to protect Xen against + * possible rogue RSB speculation. + */ + if ( !cpu_has_svm ) + default_spec_ctrl_flags |= SCF_ist_rsb; + } + ibpb_calculations(); /* Check whether Eager FPU should be enabled by default. */ -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.15
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |