From: Peter Zijlstra <peterz@infradead.org>
To: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Nikolay Borisov <nik.borisov@suse.com>,
Andrew Cooper <andrew.cooper3@citrix.com>,
LKML <linux-kernel@vger.kernel.org>,
x86@kernel.org, Borislav Petkov <bp@alien8.de>,
Babu Moger <babu.moger@amd.com>,
David.Kaplan@amd.com, gregkh@linuxfoundation.org,
Thomas Gleixner <tglx@linutronix.de>
Subject: Re: [PATCH RFC 4/4] x86/srso: Use CALL-based return thunks to reduce overhead
Date: Wed, 13 Sep 2023 14:50:23 +0200 [thread overview]
Message-ID: <20230913125023.GG692@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <20230822221828.htnwidmr22gtjhcd@treble>
On Tue, Aug 22, 2023 at 03:18:28PM -0700, Josh Poimboeuf wrote:
> The problem is the call-site, not the thunk. Ideally we'd have an
> option which adds an INT3 after the 'JMP __x86_return_thunk'.
The -mharden-sls=all option *SHOULD* be extended to unconditionally emit
INT3 after everyt JMP instruction -- including the one used for
-mfunction-return=thunk-extern.
This is a known missing mitigation for an AMD SLS issue.
Due to the whole branch-type-confusion thing, AMD CPUs can predict the
JMP as 'not-a-branch' and continue to the next instruction.
I'm sure Andrew has the proper name and CVE stashed away somewhere. IIRC
he even has a GCC bugzilla entry for it.
next prev parent reply other threads:[~2023-09-13 12:50 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-21 11:27 [PATCH 0/4] x86/srso: Reduce overhead of the mitigation Andrew Cooper
2023-08-21 11:27 ` [PATCH 1/4] x86/srso: Rename srso_alias_*() to srso_fam19_*() Andrew Cooper
2023-09-13 13:46 ` Borislav Petkov
2023-09-13 14:27 ` Andrew Cooper
2023-09-13 14:46 ` Borislav Petkov
2023-08-21 11:27 ` [PATCH 2/4] x86/srso: Rename fam17 SRSO infrastructure to srso_fam17_*() Andrew Cooper
2023-09-13 13:15 ` Peter Zijlstra
2023-08-21 11:27 ` [PATCH RFC 3/4] x86/ret-thunk: Support CALL-ing to the ret-thunk Andrew Cooper
2023-08-21 11:27 ` [PATCH RFC 4/4] x86/srso: Use CALL-based return thunks to reduce overhead Andrew Cooper
2023-08-21 15:16 ` Josh Poimboeuf
2023-08-21 23:01 ` Andrew Cooper
2023-08-22 2:22 ` Josh Poimboeuf
2023-08-22 6:45 ` Nikolay Borisov
2023-08-22 22:18 ` Josh Poimboeuf
2023-08-23 6:08 ` Nikolay Borisov
2023-09-13 12:50 ` Peter Zijlstra [this message]
2023-08-21 21:19 ` kernel test robot
2023-08-22 7:23 ` kernel test robot
2023-09-13 13:17 ` Peter Zijlstra
-- strict thread matches above, loose matches on Subject: below --
2023-08-21 18:06 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230913125023.GG692@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=David.Kaplan@amd.com \
--cc=andrew.cooper3@citrix.com \
--cc=babu.moger@amd.com \
--cc=bp@alien8.de \
--cc=gregkh@linuxfoundation.org \
--cc=jpoimboe@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nik.borisov@suse.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.