From: Jan Beulich <jbeulich@suse.com>
To: "xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>
Cc: "Andrew Cooper" <andrew.cooper3@citrix.com>,
"Wei Liu" <wl@xen.org>, "Roger Pau Monné" <roger.pau@citrix.com>
Subject: [PATCH v2 5/6] x86: guard against straight-line speculation past RET
Date: Mon, 28 Sep 2020 14:31:49 +0200 [thread overview]
Message-ID: <fd18939c-cfc7-6de8-07f2-217f810afde1@suse.com> (raw)
In-Reply-To: <62ffb078-d763-f845-c4b9-eeacb3358d02@suse.com>
Under certain conditions CPUs can speculate into the instruction stream
past a RET instruction. Guard against this just like 3b7dab93f240
("x86/spec-ctrl: Protect against CALL/JMP straight-line speculation")
did - by inserting an "INT $3" insn. It's merely the mechanics of how to
achieve this that differ: A set of macros gets introduced to post-
process RET insns issued by the compiler (or living in assembly files).
Unfortunately for clang this requires further features their built-in
assembler doesn't support: We need to be able to override insn mnemonics
produced by the compiler (which may be impossible, if internally
assembly mnemonics never get generated), and we want to use \(text)
escaping / quoting in the auxiliary macro.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
TBD: Should this depend on CONFIG_SPECULATIVE_HARDEN_BRANCH?
TBD: Would be nice to avoid the additions in .init.text, but a query to
the binutils folks regarding the ability to identify the section
stuff is in (by Peter Zijlstra over a year ago:
https://sourceware.org/pipermail/binutils/2019-July/107528.html)
has been left without helpful replies.
---
v2: Fix build with newer clang. Use int3 mnemonic. Also override retq.
--- a/xen/Makefile
+++ b/xen/Makefile
@@ -145,7 +145,15 @@ t2 = $(call as-insn,$(CC) -I$(BASEDIR)/i
# https://bugs.llvm.org/show_bug.cgi?id=36110
t3 = $(call as-insn,$(CC),".macro FOO;.endm"$(close); asm volatile $(open)".macro FOO;.endm",-no-integrated-as)
-CLANG_FLAGS += $(call or,$(t1),$(t2),$(t3))
+# Check whether \(text) escaping in macro bodies is supported.
+t4 = $(call as-insn,$(CC),".macro m ret:req; \\(ret) $$\\ret; .endm; m 8",,-no-integrated-as)
+
+# Check whether macros can override insn mnemonics in inline assembly.
+t5 = $(call as-insn,$(CC),".macro ret; .error; .endm; .macro retq; .error; .endm",-no-integrated-as)
+
+acc1 := $(call or,$(t1),$(t2),$(t3),$(t4))
+
+CLANG_FLAGS += $(call or,$(acc1),$(t5))
endif
CLANG_FLAGS += -Werror=unknown-warning-option
--- a/xen/include/asm-x86/asm-defns.h
+++ b/xen/include/asm-x86/asm-defns.h
@@ -50,3 +50,22 @@
.macro INDIRECT_JMP arg:req
INDIRECT_BRANCH jmp \arg
.endm
+
+/*
+ * To guard against speculation past RET, insert a breakpoint insn
+ * immediately after them.
+ */
+.macro ret operand:vararg
+ ret$ \operand
+.endm
+.macro retq operand:vararg
+ ret$ \operand
+.endm
+.macro ret$ operand:vararg
+ .purgem ret
+ ret \operand
+ int3
+ .macro ret operand:vararg
+ ret$ \\(operand)
+ .endm
+.endm
next prev parent reply other threads:[~2020-09-28 12:32 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-28 12:28 [PATCH v2 0/6] x86: some assembler macro rework Jan Beulich
2020-09-28 12:29 ` [PATCH v2 1/6] x86: replace __ASM_{CL,ST}AC Jan Beulich
2020-10-13 11:04 ` Andrew Cooper
2020-10-13 11:21 ` Jan Beulich
2020-09-28 12:30 ` [PATCH v2 2/6] x86: reduce CET-SS related #ifdef-ary Jan Beulich
2020-09-28 12:37 ` Jan Beulich
2020-10-13 11:40 ` Andrew Cooper
2020-10-13 13:24 ` Jan Beulich
2020-10-13 11:20 ` Andrew Cooper
2020-10-13 11:26 ` Jan Beulich
2020-09-28 12:30 ` [PATCH v2 3/6] x86: drop ASM_{CL,ST}AC Jan Beulich
2020-09-28 12:30 ` [PATCH v2 4/6] x86: fold indirect_thunk_asm.h into asm-defns.h Jan Beulich
2020-09-28 12:31 ` Jan Beulich [this message]
2020-10-08 16:28 ` [PATCH v2 5/6] x86: guard against straight-line speculation past RET Roger Pau Monné
2020-10-13 10:33 ` Jan Beulich
2020-10-13 12:00 ` Andrew Cooper
2020-10-13 13:34 ` Jan Beulich
2020-09-28 12:32 ` [PATCH v2 6/6] x86: limit amount of INT3 in IND_THUNK_* Jan Beulich
2020-10-08 16:35 ` Roger Pau Monné
2020-10-13 12:58 ` Andrew Cooper
2020-09-28 12:34 ` [PATCH v2 0/6] x86: some assembler macro rework Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fd18939c-cfc7-6de8-07f2-217f810afde1@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.