linux-kernel - Re: [PATCH v3 2/3] x86/retpoline: Use better sequences for NOSPEC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1515590771.22302.157.camel@amazon.co.uk>
Date:   Wed, 10 Jan 2018 13:26:11 +0000
From:   "Woodhouse, David" <dwmw@...zon.co.uk>
To:     Andi Kleen <andi@...stfloor.org>, <tglx@...utronix.de>
CC:     <x86@...nel.org>, <linux-kernel@...r.kernel.org>,
        <torvalds@...ux-foundation.org>, <pjt@...gle.com>,
        <luto@...nel.org>, <peterz@...radead.org>,
        <thomas.lendacky@....com>, <tim.c.chen@...ux.intel.com>,
        <gregkh@...ux-foundation.org>, <dave.hansen@...el.com>,
        <jikos@...nel.org>, Andi Kleen <ak@...ux.intel.com>
Subject: Re: [PATCH v3 2/3] x86/retpoline: Use better sequences for
 NOSPEC_CALL/JMP

On Tue, 2018-01-09 at 18:28 -0800, Andi Kleen wrote:
> From: Andi Kleen <ak@...ux.intel.com>
> 
> [This fixes a boot failure in the earlier patches
> so may want to be moved earlier to keep git bisect
> happy]
>
> With the latest tip x86/pti I get oopses when booting
> a 64bit VM in qemu with RETPOLINE/gcc7 and PTI enabled.
> Something is wrong with the ALTERNATIVE_2 sequence
> used in NOSPEC_JMP
> 
> Linus suggested a better sequence that is shorter
> and simpler and avoids the problem.

This is just masking a problem which has now been fixed properly
elsewhere — by removing the NOPs from the start of the underlying
RETPOLINE_JMP sequence, *and* by fixing the alternatives mechanism not
to get confused when the altinstr sequence starts with a NOP.

I'm not really convinced by the alternative. It's actually *longer*,
because the lfence can no longer be tucked away in the space that the
full retpoline implementation would have taken. You've prepended a
three-byte 'nop' to the full retpoline.

And I'm not really sure it's simpler either. We go from "do <this>, or
<this> or <this>", with each alternative being a complete and
equivalent way to branch to the register, to a more complex matrix
based on two conditions.

On the whole, given that the actual bug is fixed already, I am inclined
to dismiss this — albeit carefully, since it was partly Linus'
suggestion — as bikeshedding.

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5210 bytes)