linux-kernel - Re: [PATCH] x86/nospec: Unwreck the RSB stuffing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <82d09944-9118-e727-705d-da513eca0bf1@citrix.com>
Date:   Tue, 16 Aug 2022 12:52:58 +0000
From:   Andrew Cooper <Andrew.Cooper3@...rix.com>
To:     Peter Zijlstra <peterz@...radead.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        Daniel Sneddon <daniel.sneddon@...ux.intel.com>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
        Borislav Petkov <bp@...e.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        "x86@...nel.org" <x86@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>
Subject: Re: [PATCH] x86/nospec: Unwreck the RSB stuffing

On 16/08/2022 13:28, Peter Zijlstra wrote:
> diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
> index e64fd20778b6..336f8e8cebf8 100644
> --- a/arch/x86/include/asm/nospec-branch.h
> +++ b/arch/x86/include/asm/nospec-branch.h
> @@ -35,33 +35,44 @@
>  #define RSB_CLEAR_LOOPS		32	/* To forcibly overwrite all entries */
>  
>  /*
> + * Common helper for __FILL_RETURN_BUFFER and __FILL_ONE_RETURN.
> + */
> +#define __FILL_RETURN_SLOT			\
> +	ANNOTATE_INTRA_FUNCTION_CALL;		\
> +	call	772f;				\
> +	int3;					\
> +772:
> +
> +/*
> + * Stuff the entire RSB.

One minor point.  Stuff 32 slots.

There are Intel parts out in the world with RSBs larger than 32 entries,
and this loop does not fill the entire RSB on those.

This is why the 32-entry stuffing loop is explicitly not supported on
eIBRS hardware as a general mechanism.

~Andrew