Messages in this thread | | | Date | Wed, 20 Jul 2022 11:12:04 +0200 | From | Peter Zijlstra <> | Subject | Re: [RFC][PATCH] x86,nospec: Simplify {JMP,CALL}_NOSPEC |
| |
On Wed, Jul 20, 2022 at 02:01:39AM +0200, Maciej S. Szmigiero wrote: > > Obviously I meant: apply_retpolines() ... > > Will apply_retpolines() actually patch in that trailing int3 in > the X86_FEATURE_RETPOLINE_LFENCE case? > > Looking at its code it uses just ordinary NOPs as fill: > > /* > > * For RETPOLINE_LFENCE: prepend the indirect CALL/JMP with an LFENCE. > > */ > > if (cpu_feature_enabled(X86_FEATURE_RETPOLINE_LFENCE)) { > > bytes[i++] = 0x0f; > > bytes[i++] = 0xae; > > bytes[i++] = 0xe8; /* LFENCE */ > > } > > > > ret = emit_indirect(op, reg, bytes + i); > > if (ret < 0) > > return ret; > > i += ret; > > > > for (; i < insn->length;) > > bytes[i++] = BYTES_NOP1;
There is no space for int3 in that case. You get 3 bytes for LFENCE and {2,3} bytes for 'jmp *%reg', which fully consumes the {5,6} bytes available.
There will be no nops added.
But this is what all regular retpolines get to look like.
The plan was; and that's still pending, to get the INT3 from the AMD BTC mitigation that adds INT3 after regular JMPs but those compiler patches still need to happen I think.
| |