From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 97932 invoked by alias); 8 Feb 2018 12:17:21 -0000 Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Received: (qmail 97915 invoked by uid 89); 8 Feb 2018 12:17:21 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.3 required=5.0 tests=AWL,BAYES_00,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_LOW autolearn=no version=3.3.2 spammy=krebbel, Krebbel, Hx-languages-length:2593, H*MI:4de8 X-HELO: mx0a-001b2d01.pphosted.com Received: from mx0b-001b2d01.pphosted.com (HELO mx0a-001b2d01.pphosted.com) (148.163.158.5) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 08 Feb 2018 12:17:20 +0000 Received: from pps.filterd (m0098416.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w18CEuVf030225 for ; Thu, 8 Feb 2018 07:17:18 -0500 Received: from e06smtp13.uk.ibm.com (e06smtp13.uk.ibm.com [195.75.94.109]) by mx0b-001b2d01.pphosted.com with ESMTP id 2g0pcx02y8-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 08 Feb 2018 07:17:18 -0500 Received: from localhost by e06smtp13.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 8 Feb 2018 12:17:16 -0000 Received: from b06cxnps4074.portsmouth.uk.ibm.com (9.149.109.196) by e06smtp13.uk.ibm.com (192.168.101.143) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 8 Feb 2018 12:17:14 -0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w18CHDgb47644694; Thu, 8 Feb 2018 12:17:13 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ED99352049; Thu, 8 Feb 2018 11:09:20 +0000 (GMT) Received: from [9.152.212.134] (unknown [9.152.212.134]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id CEB7852045; Thu, 8 Feb 2018 11:09:20 +0000 (GMT) Subject: Re: [PATCH] S/390: Disable prediction of indirect branches To: Richard Biener Cc: GCC Patches References: <20180207120112.16852-1-krebbel@linux.vnet.ibm.com> From: Andreas Krebbel Date: Thu, 08 Feb 2018 12:17:00 -0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 18020812-0012-0000-0000-000005ACB3AA X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18020812-0013-0000-0000-000019286E29 Message-Id: <74726c82-83ee-4de8-df68-05f0b5c943ee@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-02-08_06:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1802080132 X-IsSubscribed: yes X-SW-Source: 2018-02/txt/msg00411.txt.bz2 On 02/08/2018 12:33 PM, Richard Biener wrote: > On Wed, Feb 7, 2018 at 1:01 PM, Andreas Krebbel > wrote: >> This patch implements GCC support for mitigating vulnerability >> CVE-2017-5715 known as Spectre #2 on IBM Z. >> >> In order to disable prediction of indirect branches the implementation >> makes use of an IBM Z specific feature - the execute instruction. >> Performing an indirect branch via execute prevents the branch from >> being subject to dynamic branch prediction. >> >> The implementation tries to stay close to the x86 solution regarding >> user interface. >> >> x86 style options supported (without thunk-inline): >> >> -mindirect-branch=(keep|thunk|thunk-extern) >> -mfunction-return=(keep|thunk|thunk-extern) >> >> IBM Z specific options: >> >> -mindirect-branch-jump=(keep|thunk|thunk-extern|thunk-inline) >> -mindirect-branch-call=(keep|thunk|thunk-extern) >> -mfunction-return-reg=(keep|thunk|thunk-extern) >> -mfunction-return-mem=(keep|thunk|thunk-extern) >> >> These options allow us to enable/disable the branch conversion at a >> finer granularity. >> >> -mindirect-branch sets the value of -mindirect-branch-jump and >> -mindirect-branch-call. >> >> -mfunction-return sets the value of -mfunction-return-reg and >> -mfunction-return-mem. >> >> All these options are supported on GCC command line as well as >> function attributes. >> >> 'thunk' triggers the generation of out of line thunks (expolines) and >> replaces the formerly indirect branch with a direct branch to the >> thunk. Depending on the -march= setting two different types of thunks >> are generated. With -march=z10 or higher exrl (execute relative long) >> is being used while targeting older machines makes use of larl/ex >> instead. From a security perspective the exrl variant is preferable. >> >> 'thunk-extern' does the branch replacement like 'thunk' but does not >> emit the thunks. >> >> 'thunk-inline' is only available for indirect jumps. It should be used >> in environments where correct CFI is important - known as user space. >> >> Additionally the patch introduces the -mindirect-branch-table option >> which generates tables pointing to the locations which have been >> modified. This is supposed to allow reverting the changes without >> re-compilation in situations where it isn't required. The sections are >> split up into one section per option. >> >> I plan to commit the patch tomorrow. > > Do you also plan to backport this to the GCC 7 branch? Yes, I'm working on it. -Andreas-