XSA-296: Don't rely on PV-L1TF side effects

When CONFIG_SHADOW_PAGING is compiled out, PV-L1TF defaults to domain_crash()
on vulnerable hardware.  While this has technically demonstrated that Xen
isn't vulnerable to XSA-296, it's an unclean exit.

The pv64 case can already spot and correct the race condition, while the
pv32pae test is no different to running on non-L1TF vulnerable hardware
already.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/tests/xsa-296/main.c b/tests/xsa-296/main.c
index 20d04f40b7b00e697bfac3bbd10a9479fba05a05..b3c1d67bb72da3e8ab793946adbcaf132d96b6ad 100644 (file)
--- a/tests/xsa-296/main.c
+++ b/tests/xsa-296/main.c
@@ -11,12 +11,9 @@
  * VCPUOP_initialise hypercall for PV guests.
  *
  * To tickle a continuation, we set up the new vCPU's pagetables to require
- * validation.  With PV-L1TF protections in place, we can force a continuation
- * by writing the first L1TF-vulnerable PTE for the domain.
- *
- * For less buggy (or unprotected) hardware, we have to be a bit more cunning
- * and (ab?)use the fact we can send ourselves an event by writing into evtchn
- * 2L block, rather than using a hypercall.
+ * validation.  In order to "force" a continuation, (ab)use the fact we can
+ * send ourselves an event by writing into evtchn 2L block.  This causes
+ * hypercall_preempt_check() in Xen to return true.
  *
  * This leaves a 1-instruction race window where, if Xen takes a real
  * interrupt, the pending evtchn would be delivered before issuing the
@@ -84,12 +81,7 @@ void test_main(void)
      *  * L4 validation is performed with preemption, but without actually
      *    checking, so it needs to decend a level before the hypercall will
      *    hit a contination point.
-     *
-     *  * t1[511] is deliberately chosen as an L1TF-vulnerable PTE, so that if
-     *    PV-L1TF protections are enabled, the hypercall will hit a
-     *    continuation point irrespective of pending event channels.
      */
-    t1[511] = pte_from_virt(t1, 0);
     t2[3] = pte_from_virt(t1, PF_SYM(P));
     vcpu1_ctx.ctrlreg[3] = xen_pfn_to_cr3(virt_to_gfn(t2));