search for: funneled

The proposed mitigation for variant 2 of CVE-2017-5715, “branch target injection”, is to send all indirect branches through an instruction sequence known as a retpoline. Because the purpose of a retpoline is to prevent attacker-controlled speculation, we also end up losing the benefits of benign speculation, which can lead to a measurable loss of performance. We can regain some of those benefits

We have these transforms from funnel shift to a simpler shift op: // fshl(X, 0, C) -> shl X, C // fshl(X, undef, C) -> shl X, C // fshl(0, X, C) -> lshr X, (BW-C) // fshl(undef, X, C) -> lshr X, (BW-C) These were part of: https://reviews.llvm.org/D54778 In all cases, one operand must be 0 or undef and the shift amount is a constant, so I think these are safe.

Don't we need to distinguish funnel shift from the more specific rotate? I'm not seeing how rotate (a single input op shifted by some amount) gets into trouble like funnel shift (two variables concatenated and shifted by some amount). Eg, if in pseudo IR we have: %funnel_shift = fshl %x, %y, %sh ; this is problematic because either x or y can be poison, but we may not touch the poison when

Wouldn't a branch funnel open the door to a type 1 attack? E.g. if the code looks like this, then a branch funnel basically turns into a standard type 1 pattern AFAICT: struct Base { virtual int f(long) = 0; }; struct A : Base { int f(long x) override { return 0; }; }; struct B : Base { int f(long x) override { // As in listing 1 in

If I got poison propagation right, it's probably only by luck! Hopefully, the funnel shift bug is fixed here: https://reviews.llvm.org/rL354905 Nuno, IIUC this means that you do *not* need to change the funnel shift semantics in Alive. So I think that means we're still on track to go with John's suggestion that only select and phi can block poison? (I don't know of any

Hi, Sean Silva via llvm-dev wrote: > Wouldn't a branch funnel open the door to a type 1 attack? Only if the code looks exactly as you wrote it. If I understand this correctly the problem with indirect branches is that the "gadget", the code leaking the data, could be *anywhere* in the binary, giving the attacker much more freedom. So restricting these calls to one of the

There's a question about the behavior of funnel shift [1] + select and poison here that reminds me of previous discussions about select and poison [2]: https://github.com/AliveToolkit/alive2/pull/32#discussion_r257528880 Example: define i8 @fshl_zero_shift_guard(i8 %x, i8 %y, i8 %sh) { %c = icmp eq i8 %sh, 0 %f = fshl i8 %x, i8 %y, i8 %sh %s = select i1 %c, i8 %x, i8 %f ; shift amount is 0

On 7/2/2018 3:16 PM, Sanjay Patel wrote: > I also agree that the per-element rotate for vectors is what we want for > this intrinsic. > > So I have this so far: > > declare i32 @llvm.catshift.i32(i32 %a, i32 %b, i32 %shift_amount) > declare <2 x i32> @llvm.catshift.v2i32(<2 x i32> %a, <2 x i32> %b, <2 x i32> %shift_amount) > > For

for the function funnelplot(), how do I include 95% confidence intervals for the effect estimate ( ie. / \ )? -- View this message in context: http://www.nabble.com/funnel-plots-tp24003106p24003106.html Sent from the R help mailing list archive at Nabble.com.

I know OpenSSH currently supports PKCS11 devices (such as smartcards) for publickey authentication, but I would love to see PKCS11 extended further. It is currently possible to perform PKCS11 certificate authentication, via pam_krb5.so (on Linux at least and likely something similar on other *NIX) which allows smartcard auth to a Kerberos (including AD) server, where a TGT can also be granted.

On 2/25/2019 11:15 AM, John Regehr via llvm-dev wrote: > I'd just like to add that the general question here is "where does > poison stop propagating" and this question needs to be definitively > answered by this community. Does a call stop poison? Whatever the decision is may be contradicted after inlining, so what should such a call return? A superposition of poison

On 2/25/2019 12:28 PM, John Regehr via llvm-dev wrote: > Poison has to propagate through calls and loads/stores, or else > basically nothing works. Consider this: %v0 = call i32 @foo(poison) nounwind/readnone store i32 %v0, i32* %valid_address If we assume that poison propagates through calls, we could then optimize this to %v0 = poison store poison, i32* %valid_address If

On 2/25/2019 1:24 PM, John Regehr via llvm-dev wrote: > > This is a sound transformation only if foo() returns poison when it is > called with poison as an argument. Then how do you interpret "poison has to propagate through calls"? A typical analysis of a function will either see a call or the inlined body. If "call(poison)" cannot be assumed to be a poison, then

The R code below produces (after running for a few minutes on a decent computer) the plot shown at the following location: http://n2.nabble.com/Is-there-a-physical-and-quantitative-explanation-for-this-plot--td2542321.html I'm just taking the mean of a given set of random variables, where the set size is increased. There appears to be a quick convergence and then a pretty steady variance

Version 2.0-0 of meta (an R package for meta-analysis) is now available on CRAN. Changes are described below. Yours, Guido Major revision R package meta linked to R package metafor by Wolfgang Viechtbauer to provide additional statistical methods, e.g. meta-regression and other estimates for tau-squared (REML, ...) New functions: - metareg (meta-regression) - metabias

Version 2.0-0 of meta (an R package for meta-analysis) is now available on CRAN. Changes are described below. Yours, Guido Major revision R package meta linked to R package metafor by Wolfgang Viechtbauer to provide additional statistical methods, e.g. meta-regression and other estimates for tau-squared (REML, ...) New functions: - metareg (meta-regression) - metabias

> Transforms/InstCombine/select.ll > ================================ > define i1 @trueval_is_true(i1 %C, i1 %X) { >  %R = select i1 %C, i1 1, i1 %X >  ret i1 %R > } > => > define i1 @trueval_is_true(i1 %C, i1 %X) { >  %R = or i1 %C, %X >  ret i1 %R > } > ERROR: Target is more poisonous than source (when %C = #x1 & %X = poison) > > (there are

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000066"> <small><font face="Verdana" size="-1"><small><big>Hi

Alon, I should have provided more background. You are assuming that I could perform the PKINIT prior to connecting to the SSH server. In this case (and others) there is an interest in not exposing the kerberos servers to the world and thus someone connecting remotely would not be able to obtain a TGT or do a PKINIT. The goal would be for SSH to handle all the auth and only after connecting to

Chapter 9 might be of interest: https://bookdown.org/MathiasHarrer/Doing_Meta_Analysis_in_R/ And specifically, for funnel plots in R: https://wviechtb.github.io/metafor/reference/funnel.html Best, Rob On 7/25/2024 6:40 AM, Richard O'Keefe wrote: > I know you didn't want to stimulate discussion, but the problem is not > confined to publication. "Adverse reaction to