From: Julien Grall <julien@xen.org>
To: xen-devel@lists.xenproject.org
Cc: bertrand.marquis@arm.com, Julien Grall <jgrall@amazon.com>,
Stefano Stabellini <sstabellini@kernel.org>,
Julien Grall <julien@xen.org>,
Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
Subject: [PATCH v3 0/2] xen/arm: Mitigate straight-line speculation
Date: Thu, 1 Apr 2021 17:44:42 +0100 [thread overview]
Message-ID: <20210401164444.20377-1-julien@xen.org> (raw)
From: Julien Grall <jgrall@amazon.com>
Hi all,
Last year, Arm released a whitepaper about a new category of speculation.
(see [1] and [2]). In short, a processor may be able to speculate past
some of the unconditional control flow instructions (e.g eret, smc, br).
In some of the cases, the registers will contain values controlled by
the guest. While there is no known gadget afterwards, we still want to
prevent any leakage in the future.
The mitigation is planned in two parts:
1) Arm provided patches for both GCC and LLVM to add speculation barrier
and remove problematic code sequence.
2) Inspection of assembly code and call to higher level (e.g smc in our case).
I still haven't looked at 1) and how to mitigate properly Arm32 (see
patch #1) and SMC call. So this issue is not fully addressed.
Note that the ERET instruction was already addressed as part of XSA-312.
Cheers,
[1] https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
[2] https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation
Julien Grall (2):
xen/arm: Include asm/asm-offsets.h and asm/macros.h on every assembly
files
xen/arm64: Place a speculation barrier following an ret instruction
xen/arch/arm/Makefile | 2 +-
xen/arch/arm/arm32/entry.S | 2 +-
xen/arch/arm/arm32/head.S | 1 -
xen/arch/arm/arm32/lib/lib1funcs.S | 1 +
xen/arch/arm/arm32/proc-v7.S | 1 -
xen/arch/arm/arm64/debug-cadence.inc | 1 -
xen/arch/arm/arm64/debug-pl011.inc | 2 --
xen/arch/arm/arm64/entry.S | 2 --
xen/arch/arm/arm64/head.S | 2 --
xen/arch/arm/arm64/smc.S | 3 ---
xen/include/asm-arm/arm64/macros.h | 6 ++++++
xen/include/asm-arm/config.h | 6 ++++++
xen/include/asm-arm/macros.h | 18 +++++++++---------
13 files changed, 24 insertions(+), 23 deletions(-)
--
2.17.1
next reply other threads:[~2021-04-01 16:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-01 16:44 Julien Grall [this message]
2021-04-01 16:44 ` [PATCH v3 1/2] xen/arm: Include asm/asm-offsets.h and asm/macros.h on every assembly files Julien Grall
2021-04-01 16:44 ` [PATCH v3 2/2] xen/arm64: Place a speculation barrier following an ret instruction Julien Grall
2021-04-13 23:03 ` Stefano Stabellini
2021-04-18 18:04 ` Julien Grall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210401164444.20377-1-julien@xen.org \
--to=julien@xen.org \
--cc=Volodymyr_Babchuk@epam.com \
--cc=bertrand.marquis@arm.com \
--cc=jgrall@amazon.com \
--cc=sstabellini@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).