x86/speculation: Add LFENCE to RSB fill sequence
RSB fill sequence does not have any protection for miss-prediction of conditional branch at the end of the sequence. CPU can speculatively execute code immediately after the sequence, while RSB filling hasn't completed yet. #define __FILL_RETURN_BUFFER(reg, nr, sp) \ mov $(nr/2), reg; \ 771: \ ANNOTATE_INTRA_FUNCTION_CALL; \ call 772f; \ 773: /* speculation trap */ \ UNWIND_HINT_EMPTY; \ pause; \ lfence; \ jmp 773b; \ 772: \ ANNOTATE_INTRA_FUNCTION_CALL; \ call 774f; \ 775: /* speculation trap */ \ UNWIND_HINT_EMPTY; \ pause; \ lfence; \ jmp 775b; \ 774: \ add $(BITS_PER_LONG/8) * 2, sp; \ dec reg; \ jnz 771b; <----- CPU can miss-predict here. Before RSB is filled, RETs that come in program order after this macro can be executed speculatively, making them vulnerable to RSB-based attacks. Mitigate it by adding an LFENCE after the conditional branch to prevent speculation while RSB is being filled. Suggested-by:Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by:
Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Signed-off-by:
Borislav Petkov <bp@suse.de>
parent
2b129932
-
mentioned in commit b1c9f470
-
mentioned in commit 1bea03b4
-
mentioned in commit 5c5c7774
-
mentioned in commit fd2128cd
-
mentioned in commit f6664a40
-
mentioned in commit b58882c6
-
mentioned in commit 992d2fc2
-
mentioned in commit b864bc2a
-
mentioned in commit e5796ff9
-
mentioned in commit c7d4745b
-
mentioned in commit 4e8d7039
-
mentioned in commit 8afd1c7d
-
mentioned in commit 48bfe6ca
-
mentioned in commit 9f3330d4
-
mentioned in commit 30b541df
Please register or sign in to comment