Anon3 (anon3.delete@this.anon3.invalid) on August 17, 2020 4:10 pm wrote:
> Maynard Handley (name99.delete@this.name99.org) on August 17, 2020 11:51 am wrote:
> > Beyond that, my guess is that IBM's attitude to "jump to the second instruction of a pair"
>
> You can't determine what an arbitrary destination is. This is why x86 has terrible problems with gadgets
> made out of unintentional instructions produced by jumping in to the middle of intentional ones.
>
> The solution to this problem is control flow integrity instructions such as Intel
> CET or ARM BTI. I've not seen a similar proposal for POWER which surprises me.
>

You are talking about something different.
I am suggesting that IBM is allowed to, eg, mark in the I-cache, or a loop buffer, or a µOp cache or wherever that two paired instructions corresponds to a single unit. And that if you (deliberately, because the compiler isn't going to do this) choose to jump into the middle of this pair, IBM doesn't owe you any sort of rational execution from this point onward.

You are suggesting that jumping into the middle of a paid may be a security hole. Perhaps, who knows, but that's of little interest to me. I fail to see why it's any more of a security hold than an ability to jump anywhere in the instruction stream; it would very much depend on the details of exactly how these pair instructions are implemented.

x86 has this as a security problem because they promise that jumping into such an instruction stream will work. IBM has less of a problem if they don't make that promise. They don't even have to make an effort to catch every such jump; all they have to do is catch some of them and fault when they do detect such a jump (same way as the CPU would fault if you jumped to an odd address).
Question is: what is the ARCHITECTURAL promise regarding pairs? That jumping in the middle of one
- behaves like x86?
- is guaranteed to fault?
- or is undefined behavior (which could be a fault sometimes, other times random execution, behaving eg, as if you'd jumped to either one instruction earlier or one instruction later).