lkml.org 
[lkml]   [2018]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v8.1 12/12] x86/retpoline: Fill return stack buffer on vmexit
On Fri, 12 Jan 2018, David Woodhouse wrote:

> In accordance with the Intel and AMD documentation, we need to overwrite
> all entries in the RSB on exiting a guest, to prevent malicious branch
> target predictions from affecting the host kernel. This is needed both
> for retpoline and for IBRS.
>
> [ak: numbers again for the RSB stuffing labels]
> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
> Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> ---
> I love the smell of bikeshed paint in the morning. But to be fair, this
> one was actually an issue which might possibly have bitten in the future.
>
> Can we please stop arguing about asm labels now though? Let's get this
> stuff done, and we can set about the oh-so-important task of persuading
> Linus to eliminate all numeric labels and rely on human-readable labels
> with %= and \@ to make them unique, some time after the dust settles.

Fair enough. I surely like the below way more than the sloppy hackery from
Andi which completely removed any form of documentation.

> +#define __FILL_RETURN_BUFFER(reg, nr, sp) \
> + mov $(nr/2), reg; \
> +771: \
> + call 772f; \
> +773: /* speculation trap */ \
> + pause; \
> + jmp 773b; \
> +772: \
> + call 774f; \
> +775: /* speculation trap */ \
> + pause; \
> + jmp 775b; \
> +774: \
> + dec reg; \
> + jnz 771b; \
> + add $(BITS_PER_LONG/8) * nr, sp;
> +

\
 
 \ /
  Last update: 2018-01-14 23:25    [W:0.082 / U:0.860 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site