linux-kernel - Re: [tip:x86/pti] x86/retpoline: Fill return stack buffer on vmexit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180125151024.bidjr26r667vs7h5@treble>
Date:   Thu, 25 Jan 2018 09:10:24 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     David Woodhouse <dwmw2@...radead.org>, tim.c.chen@...ux.intel.com,
        pjt@...gle.com, jikos@...nel.org, gregkh@...ux-foundation.org,
        dave.hansen@...el.com, mingo@...nel.org, riel@...hat.com,
        luto@...capital.net, torvalds@...ux-foundation.org,
        ak@...ux.intel.com, keescook@...gle.com, peterz@...radead.org,
        tglx@...utronix.de, hpa@...or.com, linux-kernel@...r.kernel.org,
        linux-tip-commits@...r.kernel.org
Subject: Re: [tip:x86/pti] x86/retpoline: Fill return stack buffer on vmexit

On Thu, Jan 25, 2018 at 01:45:54PM +0100, Borislav Petkov wrote:
> > > +/* Like alternative_io, but for replacing a direct call with another one. */
> > > +#define alternative_void_call(oldfunc, newfunc, feature, input...)		\
> > > +	asm volatile (ALTERNATIVE("call %P[old]", "call %P[new]", feature)	\
> > > +		: : [old] "i" (oldfunc), [new] "i" (newfunc), ## input)
> > 
> > But you aren't doing the call at all in the other case, and
> > alternatives *always* handled the case where the first 'alternative'
> > instruction was a branch, didn't it?
> > 
> > So couldn't it just be alternative(nop, call __fill_rsb_func)?
> > 
> > But I still don't understand why it matters.
> 
> You need for both to be CALL instructions there so that gcc can manage
> the callee clobbers properly - i.e., recognize that there's a function
> call there.

Huh?  GCC doesn't even look inside the inline asm.  That's why we had to
implement ASM_CALL_CONSTRAINT.

And the seg fault is objtool's way of telling you you need a
ANNOTATE_NOSPEC_ALTERNATIVE above the alternative ;-)

(I know that's not the best answer, will fix it soon.)

-- 
Josh