News for hackers. Stuff that matters.

A comment on Avoid speculative indirect calls in kernel.

Re:Avoid speculative indirect calls in kernel by revelation on Wednesday January 03, 2018 @08:23PM (#16067190)
Love it, an LFENCE on every indirect jump in core 32/64bit entry assembler code, not to mention the cost of the trampoline itself. Linus is right to say that this hack should be reserved for configured as broken CPUs..
[ Parent | on HN ]
Re:Avoid speculative indirect calls in kernel by bewaretheirs on Thursday January 04, 2018 @03:13AM (#16068737)
If I'm reading it correctly, the lfence is never reached for real (only speculatively..)

code invoking the thunk pushes the target address on the stack, then branches to or calls the thunk.

The first instruction of the thunk is a "call" to a nearby address, skipping over an infinite loop (2: lfence; jmp 2b)

the lea n(%xsp),%xsp discards the return address pushed by "call", and the subsequent "ret" "returns" to the branch target rather than to label 2.

perhaps the speculative execution engine doesn't take the stack pointer adjustment into account and so gets stuck in the lfence loop, only being snapped back to its senses when the lea completes..

[ Parent | on HN ]