linux-kernel - Re: [PATCH 6/6] s390: introduce execute-trampolines for branches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 07 Feb 2018 12:20:04 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     Martin Schwidefsky <schwidefsky@...ibm.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Pavel Machek <pavel@....cz>, linux-kernel@...r.kernel.org,
        linux-s390@...r.kernel.org,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        Christian Borntraeger <borntraeger@...ibm.com>,
        Cornelia Huck <cohuck@...hat.com>,
        David Hildenbrand <david@...hat.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jon Masters <jcm@...hat.com>,
        Marcus Meissner <meissner@...e.de>,
        Jiri Kosina <jkosina@...e.cz>,
        Dominik Brodowski <linux@...inikbrodowski.net>,
        Alan Cox <gnomes@...rguk.ukuu.org.uk>
Subject: Re: [PATCH 6/6] s390: introduce execute-trampolines for branches



On Wed, 2018-02-07 at 13:17 +0100, Martin Schwidefsky wrote:
> On Wed, 07 Feb 2018 12:07:55 +0000
> David Woodhouse <dwmw2@...radead.org> wrote:
> 
> > 
> > On Wed, 2018-02-07 at 11:07 +0100, Pavel Machek wrote:
> > > 
> > > This is really unfortunate naming of kernel option.
> > > 
> > > spectre_v2=off sounds like we are turning the "bug" off, but i somehow
> > > suspect you are turning the bug _workaround_ off.  
> > That's consistent with what we have on x86.
> > 
> > > 
> > > > 
> > > > +ifdef CONFIG_EXPOLINE
> > > > +  ifeq ($(call cc-option-yn,$(CC_FLAGS_MARCH) -mindirect-branch=thunk),y)
> > > > +    CC_FLAGS_EXPOLINE := -mindirect-branch=thunk
> > > > +    CC_FLAGS_EXPOLINE += -mfunction-return=thunk
> > > > +    CC_FLAGS_EXPOLINE += -mindirect-branch-table
> > > > +    export CC_FLAGS_EXPOLINE
> > > > +    cflags-y += $(CC_FLAGS_EXPOLINE)
> > > > +  else
> > > > +    $(warning "Your gcc lacks the -mindirect-branch= option")
> > > > +  endif
> > > > +endif  
> > That isn't, though. Linus asked us to drop the $(warning) part.
> > 
> > ... and then spent a week building with a non-retpoline compiler and
> > not noticing, so he might have changed his mind ;)
>
> I found the warning to have some value, it helps for the case where my
> fingers are faster than my brain and I type "make" instead of "smake"
> which uses the alternative compiler with the required support.
> 
> @Linus: do you want a warning or prefer not to have one ?

FWIW I agreed to drop it when the plan in my head was "we'll just turn
on IBRS instead if the compiler doesn't do full retpoline support".

Now that Linus has expressed a disinclination to take IBRS support in
that form, I might be more inclined to defend the $(warning) too.
Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5213 bytes)