From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6F1DC43334 for ; Sun, 17 Jul 2022 17:56:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229760AbiGQR4i convert rfc822-to-8bit (ORCPT ); Sun, 17 Jul 2022 13:56:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229487AbiGQR4g (ORCPT ); Sun, 17 Jul 2022 13:56:36 -0400 Received: from eu-smtp-delivery-151.mimecast.com (eu-smtp-delivery-151.mimecast.com [185.58.86.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id EA39213D5C for ; Sun, 17 Jul 2022 10:56:33 -0700 (PDT) Received: from AcuMS.aculab.com (156.67.243.121 [156.67.243.121]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id uk-mta-103-sQvoyu-PNDWk0UHk7-hF4g-1; Sun, 17 Jul 2022 18:56:31 +0100 X-MC-Unique: sQvoyu-PNDWk0UHk7-hF4g-1 Received: from AcuMS.Aculab.com (fd9f:af1c:a25b:0:994c:f5c2:35d6:9b65) by AcuMS.aculab.com (fd9f:af1c:a25b:0:994c:f5c2:35d6:9b65) with Microsoft SMTP Server (TLS) id 15.0.1497.36; Sun, 17 Jul 2022 18:56:28 +0100 Received: from AcuMS.Aculab.com ([fe80::994c:f5c2:35d6:9b65]) by AcuMS.aculab.com ([fe80::994c:f5c2:35d6:9b65%12]) with mapi id 15.00.1497.036; Sun, 17 Jul 2022 18:56:28 +0100 From: David Laight To: 'Thomas Gleixner' , LKML CC: "x86@kernel.org" , Linus Torvalds , Tim Chen , "Josh Poimboeuf" , Andrew Cooper , Pawan Gupta , Johannes Wikner , Alyssa Milburn , Jann Horn , "H.J. Lu" , Joao Moreira , Joseph Nuzman , "Steven Rostedt" , Juergen Gross , "Peter Zijlstra (Intel)" , Masami Hiramatsu , Alexei Starovoitov , Daniel Borkmann Subject: RE: [patch 00/38] x86/retbleed: Call depth tracking mitigation Thread-Topic: [patch 00/38] x86/retbleed: Call depth tracking mitigation Thread-Index: AQHYmWozi03gNC/QIkePUsvbFv4MOq2CTJVggABNmoCAADzr8A== Date: Sun, 17 Jul 2022 17:56:28 +0000 Message-ID: <24673619e9e2411bb1d5f287aab2aa87@AcuMS.aculab.com> References: <20220716230344.239749011@linutronix.de> <8735ezye00.ffs@tglx> In-Reply-To: <8735ezye00.ffs@tglx> Accept-Language: en-GB, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.202.205.107] MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=C51A453 smtp.mailfrom=david.laight@aculab.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: aculab.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Thomas Gleixner > Sent: 17 July 2022 16:07 > > On Sun, Jul 17 2022 at 09:45, David Laight wrote: > > From: Thomas Gleixner > >> > >> 3) Utilize the retbleed return thunk mechanism by making the jump > >> target run-time configurable. Add the accounting counterpart and > >> stuff RSB on underflow in that alternate implementation. > > > > What happens to indirect calls? > > The above would imply that they miss the function entry thunk, but > > get the return one. > > Won't this lead to mis-counting of the RSB? > > That's accounted in the indirect call thunk. This mitigation requires > retpolines enabled. Thanks, that wasn't in the summary. > > I also thought that retpolines would trash the return stack? > > No. They prevent that the CPU misspeculates an indirect call due to a > mistrained BTB. > > > Using a single retpoline thunk would pretty much ensure that > > they are never correctly predicted from the BTB, but it only > > gives a single BTB entry that needs 'setting up' to get mis- > > prediction. > > BTB != RSB I was thinking about what happens after the RSB has underflowed. Which is when (I presume) the BTB based speculation happens. > The intra function call in the retpoline is of course adding a RSB entry > which points to the speculation trap, but that gets popped immediately > after that by the return which goes to the called function. I'm remembering the 'active' instructions in a retpoline being 'push; ret'. Which is an RSB imbalance. ... > > I'm also sure I managed to infer from a document of instruction > > timings and architectures that some x86 cpu actually used the BTB > > for normal conditional jumps? > > That's relevant to the problem at hand in which way? The next problem :-) David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)