linux-kernel - Re: [PATCH] x86/retpoline: Fix NOSPEC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Jan 2018 10:05:35 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Andi Kleen <andi@...stfloor.org>,
        Borislav Petkov <bp@...en8.de>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        the arch/x86 maintainers <x86@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Paul Turner <pjt@...gle.com>,
        Andrew Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Tom Lendacky <thomas.lendacky@....com>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Greg Kroah-Hartman <gregkh@...ux-foundation.org>,
        Dave Hansen <dave.hansen@...el.com>,
        Jiri Kosina <jikos@...nel.org>, Andi Kleen <ak@...ux.intel.com>
Subject: Re: [PATCH] x86/retpoline: Fix NOSPEC_JMP for tip

On Wed, 2018-01-10 at 07:15 +0000, David Woodhouse wrote:
> I'd really like to know what went wrong though. Did we merge Borislav's
> attempt to peek at jumps inside alternatives, perchance? Will take a
> look...

Ah, it only happens if I run in KVM, not with Qemu's CPU; that's why it
didn't show up in my testing. And it seems to have been introduced by
the addition of '.align 16' at the start of the RETPOLINE_JMP macro. So
this fixes it:

--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -15,7 +15,6 @@
  * invocation below less ugly.
  */
 .macro RETPOLINE_JMP reg:req
-       .align  16
        call    .Ldo_rop_\@
 .Lspec_trap_\@:
        pause

Borislav? Want to take a look at that please?

I'm going to go ahead and apply Andi's patches anyway. Once I admit
that I shoved the .align in there to precisely match up with Paul's
sequence, and since Linus got me to inline the thing at all the call
sites instead of using the out-of-line thunk, I don't think an
objection of "but it adds some extra bytes for the separate lfence" is
going to work... :)

But actually, I think I may also rip out the .align there. Because
inside alternatives it doesn't make a lot of sense. It may have aligned
the code by padding with NOPs in its *original* location, but once it
gets copied into the place it's executed from, the alignment could be
different.
Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5213 bytes)