[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH for-4.14] x86/spec-ctrl: Protect against CALL/JMP straight-line speculation

  • To: Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>
  • From: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
  • Date: Wed, 1 Jul 2020 12:58:42 +0100
  • Authentication-results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none
  • Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Paul Durrant <paul@xxxxxxx>, Wei Liu <wl@xxxxxxx>, Jan Beulich <JBeulich@xxxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>
  • Delivery-date: Wed, 01 Jul 2020 11:59:29 +0000
  • Ironport-sdr: weTeaknDV0sEqpvRdxIpQaRfhHXiDbIXWdTcnTH88GBzTgyz3JX8JaXUOk17WdXMqXxpz5NspV /pZWJz1PsVF1K3GJVKdZajwIQ0EWZ0hv29TC0n7QTrGIHrJaM2FAlT2/fDbxBUkGQmSw3WFDpL J7ptZ1N6CfavGbWnd2LjEYelswXS1D+UieFeqzKhwMDuoVQvzGzLM6OTYUgLo3yWGOZo+2a+bw trDDD055jEneNdtP0jDlA0p0zScAeWbA+ulnAvnUDvSF2ECOmlviBXIRlK2bEZkdOSIlv9qwhe thI=
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

Some x86 CPUs speculatively execute beyond indirect CALL/JMP instructions.

With CONFIG_INDIRECT_THUNK / Retpolines, indirect CALL/JMP instructions are
converted to direct CALL/JMP's to __x86_indirect_thunk_REG(), leaving just a
handful of indirect JMPs implementing those stubs.

There is no architectrual execution beyond an indirect JMP, so use INT3 as
recommended by vendors to halt speculative execution.  This is shorter than
LFENCE (which would also work fine), but also shows up in logs if we do
unexpected execute them.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Wei Liu <wl@xxxxxxx>
CC: Roger Pau Monné <roger.pau@xxxxxxxxxx>
CC: Paul Durrant <paul@xxxxxxx>

This wants backporting to all release, possibly even into the security trees,
and should therefore be considered for 4.14 at this point.
 xen/arch/x86/indirect-thunk.S | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/arch/x86/indirect-thunk.S b/xen/arch/x86/indirect-thunk.S
index 3c17f75c23..7392aee127 100644
--- a/xen/arch/x86/indirect-thunk.S
+++ b/xen/arch/x86/indirect-thunk.S
@@ -24,10 +24,12 @@
 .macro IND_THUNK_LFENCE reg:req
         jmp *%\reg
+        int3 /* Halt straight-line speculation */
 .macro IND_THUNK_JMP reg:req
         jmp *%\reg
+        int3 /* Halt straight-line speculation */



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.