Cache-load gadgets exploitable with L1TF

ISSUE DESCRIPTION

Previously reported vulnerabilities CVE-2017-5753 / XSA-254 (Spectre V1) and CVE-2018-3646 / XSA-273 (L1TF) can, when combined, be leveraged to more easily gather leaked information.
A Spectre v1 gadget is a speculation sequence which starts with a conditional branch, contains a memory load who’s address is attacker-influenced, and a second action dependent on the content of the first memory load, which opens a sidechannel with the attacker.
These gadgets are rare in code, and so far, none have been discovered in Xen. However, the first half of this gadget (i.e. to the first memory load) is a very common sequence to find in compiled C, and forms an arbitrary cache-load gadget.
An attacker can combine cache-load gadgets like this to bring data into the cache on on hyperthread of a given CPU core, while L1TF is used on another hyperthread to read the cached data.
A number of specific exploitable gadgets have been identified.
There are no new vulnerabilities. There is only new information about existing vulnerabilities: specifically, confirmation that existing, previously disclosed, vulnerabilities, can be exploited in specific ways. (Previously, it was merely expected, and stated in XSA-254 and XSA-273, that such the vulnerabilities would be exploitable.)

IMPACT

An attacker can potentially read arbitrary host RAM. This includes data belonging to Xen, data belonging to other guests, and data belonging to different security contexts within the same guest.
An attacker could be a guest kernel (which can manipulate the pagetables directly), or could be guest userspace either directly (e.g. with mprotect() or similar system call) or indirectly (by gaming the guest kernel’s paging subsystem).
See XSA-254 and XSA-273 for more general information about the underlying vulnerabilities.

VULNERABLE SYSTEMS

Systems running all versions of Xen are affected.
Only x86 processors are vulnerable. ARM processors are not known to be affected.
Only systems with Symmetric Multi Threading (SMT, aka hyperthreading) available and enabled are vulnerable.
Only Intel Core based processors (from at least Merom onwards) are potentially affected. Other processor designs (Intel Atom/Knights range), and other manufacturers (AMD) are not known to be affected.
Only x86 HVM or PVH guests can exploit the vulnerability. x86 PV guests cannot exploit the vulnerability.