lkml.org 
[lkml]   [2022]   [Jul]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [patch 00/38] x86/retbleed: Call depth tracking mitigation
On Mon, Jul 18, 2022 at 2:18 PM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Mon, Jul 18, 2022 at 10:44:14PM +0200, Thomas Gleixner wrote:
> > And we need input from the Clang folks because their CFI work also puts
> > stuff in front of the function entry, which nicely collides.
>
> Right, I need to go look at the latest kCFI patches, that sorta got
> side-tracked for working on all the retbleed muck :/
>
> Basically kCFI wants to preface every (indirect callable) function with:
>
> __cfi_\func:
> int3
> movl $0x12345678, %rax
> int3
> int3
> \func:

Yes, and in order to avoid scattering the code with call target
gadgets, the preamble should remain immediately before the function.

> Ofc, we can still put the whole:
>
> sarq $5, PER_CPU_VAR(__x86_call_depth);
> jmp \func_direct
>
> thing in front of that.

Sure, that would work.

> But it does somewhat destroy the version I had that only needs the
> 10 bytes padding for the sarq.

There's also the question of how function alignment should work in the
KCFI case. Currently, the __cfi_ preamble is 16-byte aligned, which
obviously means the function itself isn't.

Sami

\
 
 \ /
  Last update: 2022-07-19 00:49    [W:0.232 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site