| Message ID | 20200701115842.18583-1-andrew.cooper3@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [for-4.14] x86/spec-ctrl: Protect against CALL/JMP straight-line speculation | expand |
On 01.07.2020 13:58, Andrew Cooper wrote: > Some x86 CPUs speculatively execute beyond indirect CALL/JMP instructions. > > With CONFIG_INDIRECT_THUNK / Retpolines, indirect CALL/JMP instructions are > converted to direct CALL/JMP's to __x86_indirect_thunk_REG(), leaving just a > handful of indirect JMPs implementing those stubs. > > There is no architectrual execution beyond an indirect JMP, so use INT3 as > recommended by vendors to halt speculative execution. This is shorter than > LFENCE (which would also work fine), but also shows up in logs if we do > unexpected execute them. > > Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
> -----Original Message----- > From: Jan Beulich <jbeulich@suse.com> > Sent: 01 July 2020 13:27 > To: Andrew Cooper <andrew.cooper3@citrix.com> > Cc: Xen-devel <xen-devel@lists.xenproject.org>; Wei Liu <wl@xen.org>; Roger Pau Monné > <roger.pau@citrix.com>; Paul Durrant <paul@xen.org> > Subject: Re: [PATCH for-4.14] x86/spec-ctrl: Protect against CALL/JMP straight-line speculation > > On 01.07.2020 13:58, Andrew Cooper wrote: > > Some x86 CPUs speculatively execute beyond indirect CALL/JMP instructions. > > > > With CONFIG_INDIRECT_THUNK / Retpolines, indirect CALL/JMP instructions are > > converted to direct CALL/JMP's to __x86_indirect_thunk_REG(), leaving just a > > handful of indirect JMPs implementing those stubs. > > > > There is no architectrual execution beyond an indirect JMP, so use INT3 as > > recommended by vendors to halt speculative execution. This is shorter than > > LFENCE (which would also work fine), but also shows up in logs if we do > > unexpected execute them. > > > > Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> > > Reviewed-by: Jan Beulich <jbeulich@suse.com> Release-acked-by: Paul Durrant <paul@xen.org>
diff --git a/xen/arch/x86/indirect-thunk.S b/xen/arch/x86/indirect-thunk.S index 3c17f75c23..7392aee127 100644 --- a/xen/arch/x86/indirect-thunk.S +++ b/xen/arch/x86/indirect-thunk.S @@ -24,10 +24,12 @@ .macro IND_THUNK_LFENCE reg:req lfence jmp *%\reg + int3 /* Halt straight-line speculation */ .endm .macro IND_THUNK_JMP reg:req jmp *%\reg + int3 /* Halt straight-line speculation */ .endm /*
Some x86 CPUs speculatively execute beyond indirect CALL/JMP instructions. With CONFIG_INDIRECT_THUNK / Retpolines, indirect CALL/JMP instructions are converted to direct CALL/JMP's to __x86_indirect_thunk_REG(), leaving just a handful of indirect JMPs implementing those stubs. There is no architectrual execution beyond an indirect JMP, so use INT3 as recommended by vendors to halt speculative execution. This is shorter than LFENCE (which would also work fine), but also shows up in logs if we do unexpected execute them. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> --- CC: Jan Beulich <JBeulich@suse.com> CC: Wei Liu <wl@xen.org> CC: Roger Pau Monné <roger.pau@citrix.com> CC: Paul Durrant <paul@xen.org> This wants backporting to all release, possibly even into the security trees, and should therefore be considered for 4.14 at this point. --- xen/arch/x86/indirect-thunk.S | 2 ++ 1 file changed, 2 insertions(+)