[v3,3/7] xen/nospec: Introduce CONFIG_SPECULATIVE_HARDEN_BRANCH
diff mbox series

Message ID 20191023135812.21348-4-andrew.cooper3@citrix.com
State New
Headers show
Series
  • Unbreak evaluate_nospec() and livepatching
Related show

Commit Message

Andrew Cooper Oct. 23, 2019, 1:58 p.m. UTC
Just as with CONFIG_SPECULATIVE_HARDEN_ARRAY, branch hardening should be
configurable at compile time.

The previous CONFIG_HVM was a consequence of what could be discussed publicly
at the time the patches were submitted, and wasn't actually correct.  Later
patches will make further corrections.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Wei Liu <wl@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Juergen Gross <jgross@suse.com>

v3:
 * Reduce to just the Kconfig option.  Split other changes out into separate
   patches.

v2:
 * Expand the commit message to describe how the generated code is broken.
 * Rename to CONFIG_SPECULATIVE_HARDEN_BRANCH
 * Switch alternative() to asm()
 * Fix a comment typo
---
 xen/common/Kconfig           | 23 +++++++++++++++++++++++
 xen/include/asm-x86/nospec.h |  2 +-
 2 files changed, 24 insertions(+), 1 deletion(-)

Comments

Jürgen Groß Oct. 23, 2019, 2:45 p.m. UTC | #1
On 23.10.19 15:58, Andrew Cooper wrote:
> Just as with CONFIG_SPECULATIVE_HARDEN_ARRAY, branch hardening should be
> configurable at compile time.
> 
> The previous CONFIG_HVM was a consequence of what could be discussed publicly
> at the time the patches were submitted, and wasn't actually correct.  Later
> patches will make further corrections.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Release-acked-by: Juergen Gross <jgross@suse.com>


Juergen
Jan Beulich Oct. 25, 2019, 12:04 p.m. UTC | #2
On 23.10.2019 15:58, Andrew Cooper wrote:
> Just as with CONFIG_SPECULATIVE_HARDEN_ARRAY, branch hardening should be
> configurable at compile time.
> 
> The previous CONFIG_HVM was a consequence of what could be discussed publicly
> at the time the patches were submitted, and wasn't actually correct.  Later
> patches will make further corrections.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>

Patch
diff mbox series

diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 7b5dd9d495..c9e671869e 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -102,6 +102,29 @@  config SPECULATIVE_HARDEN_ARRAY
 
 	  If unsure, say Y.
 
+config SPECULATIVE_HARDEN_BRANCH
+	bool "Speculative Branch Hardening"
+	default y
+	depends on X86
+        ---help---
+	  Contemporary processors may use speculative execution as a
+	  performance optimisation, but this can potentially be abused by an
+	  attacker to leak data via speculative sidechannels.
+
+	  One source of misbehaviour is by executing the wrong basic block
+	  following a conditional jump.
+
+	  When enabled, specific conditions which have been deemed liable to
+	  be speculatively abused will be hardened to avoid entering the wrong
+	  basic block.
+
+	  This is a best-effort mitigation.  There are no guarantees that all
+	  areas of code open to abuse have been hardened, nor that
+	  optimisations in the compiler haven't subverted the attempts to
+	  harden.
+
+	  If unsure, say Y.
+
 endmenu
 
 config KEXEC
diff --git a/xen/include/asm-x86/nospec.h b/xen/include/asm-x86/nospec.h
index 427b5ff9df..154e92aed8 100644
--- a/xen/include/asm-x86/nospec.h
+++ b/xen/include/asm-x86/nospec.h
@@ -9,7 +9,7 @@ 
 /* Allow to insert a read memory barrier into conditionals */
 static always_inline bool barrier_nospec_true(void)
 {
-#ifdef CONFIG_HVM
+#ifdef CONFIG_SPECULATIVE_HARDEN_BRANCH
     alternative("", "lfence", X86_FEATURE_SC_L1TF_VULN);
 #endif
     return true;