Andrew Cooper d95703eb83 docs/guest-guide: Discuss when not use a hypercall page ...

The Linux rethunk and safe-ret speculative safety techniques involve
transforming `ret` to `jmp __x86_return_thunk` at compile time.  Placing naked
`ret`s back in executable .text breaks these mitigations.

CET-IBT requires ENDBR instructions, and while we could in principle fix that,
the need to select between ENDBR32 or ENDBR64 means that the contents of the
hypercall page would need to become more mode-specific than it currently
is (HVM hypercall pages are currently 32bit and 64bit compatbile).  However,
there's no feasible way to make a hypercall page compatible with fine-grain
CFI schemes such as FineIBT.

OSes which care about either of these things are better off avoiding the
hypercall page.

This is part of XSA-466.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

2024-12-17 12:21:22 +00:00

..

x86

docs/guest-guide: Discuss when not use a hypercall page

2024-12-17 12:21:22 +00:00

index.rst

docs/sphinx: License content with CC-BY-4.0

2019-12-06 18:45:43 +00:00