There are legitimate circumstance where array hardening is not wanted or
needed. Allow it to be turned off.
Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com>
Release-acked-by: Juergen Gross <jgr...@suse.com>
---
CC: Jan Beulich <jbeul...@suse.com>
CC: Wei Liu <w...@xen.org>
CC: Roger Pau Monné <roger....@citrix.com>
CC: Juergen Gross <jgr...@suse.com>
v2:
* Rename to CONFIG_SPECULATIVE_HARDEN_ARRAY
* Simplify the stub array_index_nospec()
---
xen/common/Kconfig | 24 ++++++++++++++++++++++++
xen/include/xen/nospec.h | 5 +++++
2 files changed, 29 insertions(+)
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 16829f6274..911333357a 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -77,6 +77,30 @@ config HAS_CHECKPOLICY
string
option env="XEN_HAS_CHECKPOLICY"
+menu "Speculative hardening"
+
+config SPECULATIVE_HARDEN_ARRAY
+ bool "Speculative Array Hardening"
+ default y
+ ---help---
+ Contemporary processors may use speculative execution as a
+ performance optimisation, but this can potentially be abused by an
+ attacker to leak data via speculative sidechannels.
+
+ One source of data leakage is via speculative out-of-bounds array
+ accesses.
+
+ When enabled, specific array accesses which have been deemed liable
+ to be speculatively abused will be hardened to avoid out-of-bounds
+ accesses.
+
+ This is a best-effort mitigation. There are no guarantees that all
+ areas of code open to abuse have been hardened.
+
+ If unsure, say Y.
+
+endmenu
+
config KEXEC
bool "kexec support"
default y
diff --git a/xen/include/xen/nospec.h b/xen/include/xen/nospec.h
index 2ac8feccc2..76255bc46e 100644
--- a/xen/include/xen/nospec.h
+++ b/xen/include/xen/nospec.h
@@ -33,6 +33,7 @@ static inline unsigned long array_index_mask_nospec(unsigned
long index,
}
#endif
+#ifdef CONFIG_SPECULATIVE_HARDEN_ARRAY
/*
* array_index_nospec - sanitize an array index after a bounds check
*
@@ -58,6 +59,10 @@ static inline unsigned long array_index_mask_nospec(unsigned
long index,
\
(typeof(_i)) (_i & _mask); \
})
+#else
+/* No index hardening. */
+#define array_index_nospec(index, size) ((void)(size), (index))
+#endif /* CONFIG_SPECULATIVE_HARDEN_ARRAY */
/*
* array_access_nospec - allow nospec access for static size arrays
--
2.11.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
