• Michael Ellerman's avatar
    KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel · af2e8c68
    Michael Ellerman authored
    On some systems that are vulnerable to Spectre v2, it is up to
    software to flush the link stack (return address stack), in order to
    protect against Spectre-RSB.
    
    When exiting from a guest we do some house keeping and then
    potentially exit to C code which is several stack frames deep in the
    host kernel. We will then execute a series of returns without
    preceeding calls, opening up the possiblity that the guest could have
    poisoned the link stack, and direct speculative execution of the host
    to a gadget of some sort.
    
    To prevent this we add a flush of the link stack on exit from a guest.
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    af2e8c68
security.c 12.6 KB