From: "Van De Ven, Arjan" <arjan.van.de.ven@intel.com> To: Liran Alon <liran.alon@oracle.com>, "Hansen, Dave" <dave.hansen@intel.com> Cc: "labbott@redhat.com" <labbott@redhat.com>, "luto@kernel.org" <luto@kernel.org>, "Janakarajan.Natarajan@amd.com" <Janakarajan.Natarajan@amd.com>, "torvalds@linux-foundation.org" <torvalds@linux-foundation.org>, "bp@suse.de" <bp@suse.de>, "Mallick, Asit K" <asit.k.mallick@intel.com>, "rkrcmar@redhat.com" <rkrcmar@redhat.com>, "karahmed@amazon.de" <karahmed@amazon.de>, "hpa@zytor.com" <hpa@zytor.com>, "mingo@redhat.com" <mingo@redhat.com>, "Nakajima, Jun" <jun.nakajima@intel.com>, "x86@kernel.org" <x86@kernel.org>, "Raj, Ashok" <ashok.raj@intel.com>, "tim.c.chen@linux.intel.com" <tim.c.chen@linux.intel.com>, "pbonzini@redhat.com" <pbonzini@redhat.com>, "ak@linux.intel.com" <ak@linux.intel.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "dwmw2@infradead.org" <dwmw2@infradead.org>, "peterz@infradead.org" <peterz@infradead.org>, "tglx@linutronix.de" <tglx@linutronix.de>, "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>, "mhiramat@kernel.org" <mhiramat@kernel.org>, "arjan@linux.intel.com" <arjan@linux.intel.com>, "thomas.lendacky@amd.com" <thomas.lendacky@amd.com>, "Williams, Dan J" <dan.j.williams@intel.com>, "joro@8bytes.org" <joro@8bytes.org>, "kvm@vger.kernel.org" <kvm@vger.kernel.org>, "aarcange@redhat.com" <aarcange@redhat.com> Subject: RE: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation Date: Fri, 26 Jan 2018 02:55:07 +0000 [thread overview] Message-ID: <0575AF4FD06DD142AD198903C74E1CC87A60059A@ORSMSX103.amr.corp.intel.com> (raw) In-Reply-To: <23aae227-461c-4d0d-8ccb-df01bae98b2e@default> > -----Original Message----- > From: Liran Alon [mailto:liran.alon@oracle.com] > Sent: Thursday, January 25, 2018 6:50 PM > To: Hansen, Dave <dave.hansen@intel.com> > Cc: labbott@redhat.com; luto@kernel.org; Janakarajan.Natarajan@amd.com; > torvalds@linux-foundation.org; bp@suse.de; Mallick, Asit K > <asit.k.mallick@intel.com>; rkrcmar@redhat.com; karahmed@amazon.de; > hpa@zytor.com; mingo@redhat.com; Nakajima, Jun > <jun.nakajima@intel.com>; x86@kernel.org; Raj, Ashok <ashok.raj@intel.com>; > Van De Ven, Arjan <arjan.van.de.ven@intel.com>; tim.c.chen@linux.intel.com; > pbonzini@redhat.com; ak@linux.intel.com; linux-kernel@vger.kernel.org; > dwmw2@infradead.org; peterz@infradead.org; tglx@linutronix.de; > gregkh@linuxfoundation.org; mhiramat@kernel.org; arjan@linux.intel.com; > thomas.lendacky@amd.com; Williams, Dan J <dan.j.williams@intel.com>; > joro@8bytes.org; kvm@vger.kernel.org; aarcange@redhat.com > Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect > Branch Speculation > > > Google P0 blog-post > (https://googleprojectzero.blogspot.co.il/2018/01/reading-privileged-memory- > with-side.html) claims that BTB & BHB only use <31 low bits of the address of > the source instruction to lookup into the BTB. In addition, it claims that the > higher bits of the predicated destination change together with the higher bits of > the source instruction. > > Therefore, it should be possible to leak the low bits of high predicition-mode > code BTB/BHB entries from low prediction-mode code. Because the predicted > destination address will reside in user-space. > > What am I missing? I thought this email thread was about the RSB...
WARNING: multiple messages have this Message-ID (diff)
From: "Van De Ven, Arjan" <arjan.van.de.ven@intel.com> To: Liran Alon <liran.alon@oracle.com>, "Hansen, Dave" <dave.hansen@intel.com> Cc: "labbott@redhat.com" <labbott@redhat.com>, "luto@kernel.org" <luto@kernel.org>, "Janakarajan.Natarajan@amd.com" <Janakarajan.Natarajan@amd.com>, "torvalds@linux-foundation.org" <torvalds@linux-foundation.org>, "bp@suse.de" <bp@suse.de>, "Mallick, Asit K" <asit.k.mallick@intel.com>, "rkrcmar@redhat.com" <rkrcmar@redhat.com>, "karahmed@amazon.de" <karahmed@amazon.de>, "hpa@zytor.com" <hpa@zytor.com>, "mingo@redhat.com" <mingo@redhat.com>, "Nakajima, Jun" <jun.nakajima@intel.com>, "x86@kernel.org" <x86@kernel.org>, "Raj, Ashok" <ashok.raj@intel.com>, "tim.c.chen@linux.intel.com" <tim.c.chen@linux.intel.com>, "pbonzini@redhat.com" <pbonzini@redhat.com>, "ak@linux.intel.com" <ak@linux.intel.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Subject: RE: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation Date: Fri, 26 Jan 2018 02:55:07 +0000 [thread overview] Message-ID: <0575AF4FD06DD142AD198903C74E1CC87A60059A@ORSMSX103.amr.corp.intel.com> (raw) In-Reply-To: <23aae227-461c-4d0d-8ccb-df01bae98b2e@default> > -----Original Message----- > From: Liran Alon [mailto:liran.alon@oracle.com] > Sent: Thursday, January 25, 2018 6:50 PM > To: Hansen, Dave <dave.hansen@intel.com> > Cc: labbott@redhat.com; luto@kernel.org; Janakarajan.Natarajan@amd.com; > torvalds@linux-foundation.org; bp@suse.de; Mallick, Asit K > <asit.k.mallick@intel.com>; rkrcmar@redhat.com; karahmed@amazon.de; > hpa@zytor.com; mingo@redhat.com; Nakajima, Jun > <jun.nakajima@intel.com>; x86@kernel.org; Raj, Ashok <ashok.raj@intel.com>; > Van De Ven, Arjan <arjan.van.de.ven@intel.com>; tim.c.chen@linux.intel.com; > pbonzini@redhat.com; ak@linux.intel.com; linux-kernel@vger.kernel.org; > dwmw2@infradead.org; peterz@infradead.org; tglx@linutronix.de; > gregkh@linuxfoundation.org; mhiramat@kernel.org; arjan@linux.intel.com; > thomas.lendacky@amd.com; Williams, Dan J <dan.j.williams@intel.com>; > joro@8bytes.org; kvm@vger.kernel.org; aarcange@redhat.com > Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect > Branch Speculation > > > Google P0 blog-post > (https://googleprojectzero.blogspot.co.il/2018/01/reading-privileged-memory- > with-side.html) claims that BTB & BHB only use <31 low bits of the address of > the source instruction to lookup into the BTB. In addition, it claims that the > higher bits of the predicated destination change together with the higher bits of > the source instruction. > > Therefore, it should be possible to leak the low bits of high predicition-mode > code BTB/BHB entries from low prediction-mode code. Because the predicted > destination address will reside in user-space. > > What am I missing? I thought this email thread was about the RSB...
next prev parent reply other threads:[~2018-01-26 2:55 UTC|newest] Thread overview: 120+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-01-26 2:50 [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation Liran Alon 2018-01-26 2:55 ` Van De Ven, Arjan [this message] 2018-01-26 2:55 ` Van De Ven, Arjan -- strict thread matches above, loose matches on Subject: below -- 2018-01-26 2:11 Liran Alon 2018-01-26 2:23 ` Dave Hansen 2018-01-26 9:11 ` David Woodhouse 2018-01-26 9:11 ` David Woodhouse 2018-01-26 17:19 ` Linus Torvalds 2018-01-26 17:19 ` Linus Torvalds 2018-01-26 17:27 ` Borislav Petkov 2018-01-26 17:27 ` Borislav Petkov 2018-01-26 17:29 ` David Woodhouse 2018-01-26 17:29 ` David Woodhouse 2018-01-26 17:31 ` David Woodhouse 2018-01-26 17:31 ` David Woodhouse 2018-01-26 17:59 ` Andi Kleen 2018-01-26 17:59 ` Andi Kleen 2018-01-26 18:11 ` David Woodhouse 2018-01-26 18:11 ` David Woodhouse 2018-01-26 18:12 ` Arjan van de Ven 2018-01-26 18:12 ` Arjan van de Ven 2018-01-26 18:26 ` David Woodhouse 2018-01-26 18:26 ` David Woodhouse 2018-01-26 18:28 ` Van De Ven, Arjan 2018-01-26 18:28 ` Van De Ven, Arjan 2018-01-26 18:43 ` David Woodhouse 2018-01-26 18:43 ` David Woodhouse 2018-01-26 18:44 ` Van De Ven, Arjan 2018-01-26 18:44 ` Van De Ven, Arjan 2018-01-26 18:53 ` David Woodhouse 2018-01-26 18:53 ` David Woodhouse 2018-01-26 19:02 ` Konrad Rzeszutek Wilk 2018-01-26 19:02 ` Konrad Rzeszutek Wilk 2018-01-26 19:11 ` Hansen, Dave 2018-01-26 19:11 ` Hansen, Dave 2018-01-27 13:42 ` Konrad Rzeszutek Wilk 2018-01-27 13:42 ` Konrad Rzeszutek Wilk 2018-01-27 15:55 ` Dave Hansen 2018-01-27 15:55 ` Dave Hansen 2018-01-26 19:11 ` David Woodhouse 2018-01-26 19:11 ` David Woodhouse 2018-01-26 8:46 ` David Woodhouse 2018-01-26 8:46 ` David Woodhouse 2018-01-23 11:13 Liran Alon 2018-01-25 22:20 ` Dave Hansen 2018-01-22 22:15 Luke Kenneth Casson Leighton 2018-01-20 19:22 [RFC 00/10] Speculation Control feature support KarimAllah Ahmed 2018-01-20 19:23 ` [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation KarimAllah Ahmed 2018-01-20 19:23 ` KarimAllah Ahmed 2018-01-21 19:14 ` Andy Lutomirski 2018-01-21 19:14 ` Andy Lutomirski 2018-01-23 16:12 ` Tom Lendacky 2018-01-23 16:12 ` Tom Lendacky 2018-01-23 16:20 ` Woodhouse, David 2018-01-23 16:20 ` Woodhouse, David 2018-01-23 22:37 ` Tom Lendacky 2018-01-23 22:37 ` Tom Lendacky 2018-01-23 22:49 ` Andi Kleen 2018-01-23 22:49 ` Andi Kleen 2018-01-23 23:14 ` Woodhouse, David 2018-01-23 23:14 ` Woodhouse, David 2018-01-23 23:22 ` Andi Kleen 2018-01-23 23:22 ` Andi Kleen 2018-01-24 0:47 ` Tim Chen 2018-01-24 0:47 ` Tim Chen 2018-01-24 1:00 ` Andy Lutomirski 2018-01-24 1:00 ` Andy Lutomirski 2018-01-24 1:22 ` David Woodhouse 2018-01-24 1:22 ` David Woodhouse 2018-01-24 1:59 ` Van De Ven, Arjan 2018-01-24 1:59 ` Van De Ven, Arjan 2018-01-24 3:25 ` Andy Lutomirski 2018-01-24 3:25 ` Andy Lutomirski 2018-01-21 19:34 ` Linus Torvalds 2018-01-21 20:28 ` David Woodhouse 2018-01-21 20:28 ` David Woodhouse 2018-01-21 21:35 ` Linus Torvalds 2018-01-21 21:35 ` Linus Torvalds 2018-01-21 22:00 ` David Woodhouse 2018-01-21 22:00 ` David Woodhouse 2018-01-21 22:27 ` Linus Torvalds 2018-01-21 22:27 ` Linus Torvalds 2018-01-22 16:27 ` David Woodhouse 2018-01-22 16:27 ` David Woodhouse 2018-01-23 7:29 ` Ingo Molnar 2018-01-23 7:29 ` Ingo Molnar 2018-01-23 7:53 ` Ingo Molnar 2018-01-23 7:53 ` Ingo Molnar 2018-01-23 9:27 ` Ingo Molnar 2018-01-23 9:27 ` Ingo Molnar 2018-01-23 9:37 ` David Woodhouse 2018-01-23 9:37 ` David Woodhouse 2018-01-23 15:01 ` Dave Hansen 2018-01-23 15:01 ` Dave Hansen 2018-01-23 9:30 ` David Woodhouse 2018-01-23 9:30 ` David Woodhouse 2018-01-23 10:15 ` Ingo Molnar 2018-01-23 10:15 ` Ingo Molnar 2018-01-23 10:27 ` David Woodhouse 2018-01-23 10:27 ` David Woodhouse 2018-01-23 10:44 ` Ingo Molnar 2018-01-23 10:44 ` Ingo Molnar 2018-01-23 10:57 ` David Woodhouse 2018-01-23 10:23 ` Ingo Molnar 2018-01-23 10:23 ` Ingo Molnar 2018-01-23 10:35 ` David Woodhouse 2018-02-04 18:43 ` Thomas Gleixner 2018-02-04 18:43 ` Thomas Gleixner 2018-02-04 20:22 ` David Woodhouse 2018-02-04 20:22 ` David Woodhouse 2018-02-06 9:14 ` David Woodhouse 2018-02-06 9:14 ` David Woodhouse 2018-01-25 16:19 ` Mason 2018-01-25 16:19 ` Mason 2018-01-25 17:16 ` Greg Kroah-Hartman 2018-01-25 17:16 ` Greg Kroah-Hartman 2018-01-29 11:59 ` Mason 2018-01-29 11:59 ` Mason 2018-01-24 0:05 ` Andi Kleen 2018-01-23 20:16 ` Pavel Machek 2018-01-23 20:16 ` Pavel Machek
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=0575AF4FD06DD142AD198903C74E1CC87A60059A@ORSMSX103.amr.corp.intel.com \ --to=arjan.van.de.ven@intel.com \ --cc=Janakarajan.Natarajan@amd.com \ --cc=aarcange@redhat.com \ --cc=ak@linux.intel.com \ --cc=arjan@linux.intel.com \ --cc=ashok.raj@intel.com \ --cc=asit.k.mallick@intel.com \ --cc=bp@suse.de \ --cc=dan.j.williams@intel.com \ --cc=dave.hansen@intel.com \ --cc=dwmw2@infradead.org \ --cc=gregkh@linuxfoundation.org \ --cc=hpa@zytor.com \ --cc=joro@8bytes.org \ --cc=jun.nakajima@intel.com \ --cc=karahmed@amazon.de \ --cc=kvm@vger.kernel.org \ --cc=labbott@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=liran.alon@oracle.com \ --cc=luto@kernel.org \ --cc=mhiramat@kernel.org \ --cc=mingo@redhat.com \ --cc=pbonzini@redhat.com \ --cc=peterz@infradead.org \ --cc=rkrcmar@redhat.com \ --cc=tglx@linutronix.de \ --cc=thomas.lendacky@amd.com \ --cc=tim.c.chen@linux.intel.com \ --cc=torvalds@linux-foundation.org \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.