Skip to content

Commit

Permalink
x86/speculation: Add LFENCE to RSB fill sequence
Browse files Browse the repository at this point in the history 
RSB fill sequence does not have any protection for miss-prediction of
conditional branch at the end of the sequence. CPU can speculatively
execute code immediately after the sequence, while RSB filling hasn't
completed yet.

  #define __FILL_RETURN_BUFFER(reg, nr, sp)       \
          mov     $(nr/2), reg;                   \
  771:                                            \
          ANNOTATE_INTRA_FUNCTION_CALL;           \
          call    772f;                           \
  773:    /* speculation trap */                  \
          UNWIND_HINT_EMPTY;                      \
          pause;                                  \
          lfence;                                 \
          jmp     773b;                           \
  772:                                            \
          ANNOTATE_INTRA_FUNCTION_CALL;           \
          call    774f;                           \
  775:    /* speculation trap */                  \
          UNWIND_HINT_EMPTY;                      \
          pause;                                  \
          lfence;                                 \
          jmp     775b;                           \
  774:                                            \
          add     $(BITS_PER_LONG/8) * 2, sp;     \
          dec     reg;                            \
          jnz     771b;        <----- CPU can miss-predict here.

Before RSB is filled, RETs that come in program order after this macro
can be executed speculatively, making them vulnerable to RSB-based
attacks.

Mitigate it by adding an LFENCE after the conditional branch to prevent
speculation while RSB is being filled.

Suggested-by: Andrew Cooper <[email protected]>
Signed-off-by: Pawan Gupta <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
  • Loading branch information
@pa1gupta @suryasaimadhu
pa1gupta authored and suryasaimadhu committed Aug 3, 2022
1 parent 2b12993 commit ba6e31a
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion arch/x86/include/asm/nospec-branch.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,9 @@
774: \
add $(BITS_PER_LONG/8) * 2, sp; \
dec reg; \
jnz 771b;
jnz 771b; \
/* barrier for jnz misprediction */ \
lfence;

#ifdef __ASSEMBLY__

Expand Down

0 comments on commit ba6e31a

Please sign in to comment.