From: Jan Beulich <JBeulich@suse.com>
To: George Dunlap <george.dunlap@citrix.com>
Cc: "Petre Ovidiu PIRCALABU" <ppircalabu@bitdefender.com>,
"Kevin Tian" <kevin.tian@intel.com>,
"Tamas K Lengyel" <tamas@tklengyel.com>, "Wei Liu" <wl@xen.org>,
"Razvan COJOCARU" <rcojocaru@bitdefender.com>,
"George Dunlap" <george.dunlap@eu.citrix.com>,
"Andrew Cooper" <andrew.cooper3@citrix.com>,
"Jun Nakajima" <jun.nakajima@intel.com>,
"Alexandru Stefan ISAILA" <aisaila@bitdefender.com>,
"xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>,
"Roger Pau Monné" <roger.pau@citrix.com>
Subject: Re: [Xen-devel] [PATCH V6 1/4] x86/mm: Add array_index_nospec to guest provided index values
Date: Fri, 27 Dec 2019 07:59:56 +0000 [thread overview]
Message-ID: <1b5be15d-f93d-f2c4-736d-bba2fdd5bfb6@suse.com> (raw)
In-Reply-To: <1e097c0e-1a99-2251-68f7-72f99f64c3bd@citrix.com>
On 23.12.2019 19:08, George Dunlap wrote:
> What about the attached series of patches (compile-tested only)?
This ...
>+#define nospec_clip(index, size) \
>+ ({ \
>+ bool clipped = (index >= size); \
>+ index = array_index_nospec(index, size); \
>+ clipped; \
>+ })
... in particular may misguide people on its use: If the clipped
"index" gets stored in a register, all is going to be fine (afaict),
but if it ends up in memory, there's be new (mis-)speculation
opportunities. Some of the clipping done in the patches is already
not fully safe against this, but in some other cases (especially
once array_access_nospec() would be used where possible) would at
least make things as safe as they can be made without compiler aid.
(As an aside, the suggested macro, if we were to put it in, would
need proper parenthesization of the macro parameter uses.)
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2019-12-27 8:01 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-23 14:04 [Xen-devel] [PATCH V6 1/4] x86/mm: Add array_index_nospec to guest provided index values Alexandru Stefan ISAILA
2019-12-23 14:04 ` [Xen-devel] [PATCH V6 2/4] x86/altp2m: Add hypercall to set a range of sve bits Alexandru Stefan ISAILA
2019-12-23 16:31 ` Tamas K Lengyel
2020-01-06 9:21 ` Alexandru Stefan ISAILA
2019-12-24 8:30 ` George Dunlap
2019-12-24 8:48 ` Alexandru Stefan ISAILA
2019-12-24 8:58 ` George Dunlap
2019-12-24 9:04 ` Alexandru Stefan ISAILA
2019-12-24 9:25 ` George Dunlap
2019-12-27 8:01 ` Jan Beulich
2019-12-23 14:04 ` [Xen-devel] [PATCH V6 3/4] x86/mm: Pull out the p2m specifics from p2m_init_altp2m_ept Alexandru Stefan ISAILA
2019-12-24 8:01 ` George Dunlap
2019-12-24 10:08 ` Alexandru Stefan ISAILA
2019-12-24 10:15 ` George Dunlap
2020-01-06 11:55 ` Alexandru Stefan ISAILA
2020-01-06 12:42 ` Jan Beulich
2020-01-06 14:15 ` George Dunlap
2020-01-06 14:18 ` George Dunlap
2019-12-23 14:04 ` [Xen-devel] [PATCH V6 4/4] x86/mm: Make use of the default access param from xc_altp2m_create_view Alexandru Stefan ISAILA
2019-12-24 8:48 ` George Dunlap
2019-12-24 10:19 ` Alexandru Stefan ISAILA
2019-12-23 16:38 ` [Xen-devel] [PATCH V6 1/4] x86/mm: Add array_index_nospec to guest provided index values Tamas K Lengyel
2019-12-23 18:08 ` George Dunlap
2019-12-27 7:52 ` Jan Beulich
2019-12-27 7:59 ` Jan Beulich [this message]
2019-12-27 10:52 ` George Dunlap
2019-12-27 12:17 ` Jan Beulich
2019-12-27 8:01 ` Jan Beulich
2020-01-07 13:25 ` Alexandru Stefan ISAILA
2020-01-07 13:55 ` Jan Beulich
2020-01-07 14:31 ` Alexandru Stefan ISAILA
2020-01-07 15:06 ` Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1b5be15d-f93d-f2c4-736d-bba2fdd5bfb6@suse.com \
--to=jbeulich@suse.com \
--cc=aisaila@bitdefender.com \
--cc=andrew.cooper3@citrix.com \
--cc=george.dunlap@citrix.com \
--cc=george.dunlap@eu.citrix.com \
--cc=jun.nakajima@intel.com \
--cc=kevin.tian@intel.com \
--cc=ppircalabu@bitdefender.com \
--cc=rcojocaru@bitdefender.com \
--cc=roger.pau@citrix.com \
--cc=tamas@tklengyel.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.