On 30.11.2021 11:04, Andrew Cooper wrote: > Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com> > --- > CC: Jan Beulich <jbeul...@suse.com> > CC: Roger Pau Monné <roger....@citrix.com> > CC: Wei Liu <w...@xen.org> > > RFC. I don't know if this is something we'd want to keep or not. > > Getting extable handling working for test_nx_data is proving tricky, and while > I can't spot anything that should stop the extable from working with NX > faults, from a security hardening perspective, there really ought to > be. > > (Spurious faults aside), there are no circumstances where an NX fault is > legitimate, and restricting extable's ability to interfere with the fatality > of an NX fault provides a better security posture.
Gating the extable_fixup() invocation accordingly should be possible. A respective check could live even earlier, but the window between the !guest_mode() check and the function's invocation isn't very large anyway. Since we can't have both testability and such faults being uniformly fatal, but since otoh we use pre_extable quite sparingly, how about forcing the fixup to take that path by disabling interrupts around the test? In any event this touches the insufficient selectiveness of the fixup machinery again: Any kind of fault will be recovered from whenever a fixup record is attached to an insn. Jan
