From: Peter Zijlstra <peterz@infradead.org>
To: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Nikolay Borisov <nik.borisov@suse.com>,
Andrew Cooper <andrew.cooper3@citrix.com>,
LKML <linux-kernel@vger.kernel.org>,
x86@kernel.org, Borislav Petkov <bp@alien8.de>,
Babu Moger <babu.moger@amd.com>,
David.Kaplan@amd.com, gregkh@linuxfoundation.org,
Thomas Gleixner <tglx@linutronix.de>
Subject: Re: [PATCH RFC 4/4] x86/srso: Use CALL-based return thunks to reduce overhead
Date: Wed, 13 Sep 2023 14:50:23 +0200 [thread overview]
Message-ID: <20230913125023.GG692@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <20230822221828.htnwidmr22gtjhcd@treble>
On Tue, Aug 22, 2023 at 03:18:28PM -0700, Josh Poimboeuf wrote:
> The problem is the call-site, not the thunk. Ideally we'd have an
> option which adds an INT3 after the 'JMP __x86_return_thunk'.
The -mharden-sls=all option *SHOULD* be extended to unconditionally emit
INT3 after everyt JMP instruction -- including the one used for
-mfunction-return=thunk-extern.
This is a known missing mitigation for an AMD SLS issue.
Due to the whole branch-type-confusion thing, AMD CPUs can predict the
JMP as 'not-a-branch' and continue to the next instruction.
I'm sure Andrew has the proper name and CVE stashed away somewhere. IIRC
he even has a GCC bugzilla entry for it.
next prev parent reply other threads:[~2023-09-13 12:50 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-21 11:27 [PATCH 0/4] x86/srso: Reduce overhead of the mitigation Andrew Cooper
2023-08-21 11:27 ` [PATCH 1/4] x86/srso: Rename srso_alias_*() to srso_fam19_*() Andrew Cooper
2023-09-13 13:46 ` Borislav Petkov
2023-09-13 14:27 ` Andrew Cooper
2023-09-13 14:46 ` Borislav Petkov
2023-08-21 11:27 ` [PATCH 2/4] x86/srso: Rename fam17 SRSO infrastructure to srso_fam17_*() Andrew Cooper
2023-09-13 13:15 ` Peter Zijlstra
2023-08-21 11:27 ` [PATCH RFC 3/4] x86/ret-thunk: Support CALL-ing to the ret-thunk Andrew Cooper
2023-08-21 11:27 ` [PATCH RFC 4/4] x86/srso: Use CALL-based return thunks to reduce overhead Andrew Cooper
2023-08-21 15:16 ` Josh Poimboeuf
2023-08-21 23:01 ` Andrew Cooper
2023-08-22 2:22 ` Josh Poimboeuf
2023-08-22 6:45 ` Nikolay Borisov
2023-08-22 22:18 ` Josh Poimboeuf
2023-08-23 6:08 ` Nikolay Borisov
2023-09-13 12:50 ` Peter Zijlstra [this message]
2023-09-13 13:17 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230913125023.GG692@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=David.Kaplan@amd.com \
--cc=andrew.cooper3@citrix.com \
--cc=babu.moger@amd.com \
--cc=bp@alien8.de \
--cc=gregkh@linuxfoundation.org \
--cc=jpoimboe@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nik.borisov@suse.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®