lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <944ef479f1104c4a97d0e3f629a9b765@AcuMS.aculab.com> Date: Sat, 25 Sep 2021 17:46:23 +0000 From: David Laight <David.Laight@...LAB.COM> To: 'Mark Rutland' <mark.rutland@....com>, Ard Biesheuvel <ardb@...nel.org> CC: Peter Zijlstra <peterz@...radead.org>, Frederic Weisbecker <frederic@...nel.org>, Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>, LKML <linux-kernel@...r.kernel.org>, James Morse <james.morse@....com>, Quentin Perret <qperret@...gle.com>, Christophe Leroy <christophe.leroy@...roup.eu> Subject: RE: [PATCH 2/4] arm64: implement support for static call trampolines From: Mark Rutland > Sent: 21 September 2021 17:28 > > On Tue, Sep 21, 2021 at 05:55:11PM +0200, Ard Biesheuvel wrote: > > On Tue, 21 Sept 2021 at 17:33, Mark Rutland <mark.rutland@....com> wrote: > > > > > > On Tue, Sep 21, 2021 at 04:44:56PM +0200, Ard Biesheuvel wrote: > > > > On Tue, 21 Sept 2021 at 09:10, Peter Zijlstra <peterz@...radead.org> wrote: > > ... ... > > > > > > I think so, yes. We can do sligntly better with an inline literal pool > > > and a PC-relative LDR to fold the ADRP+LDR, e.g. > > > > > > .align 3 > > > tramp: > > > BTI C > > > {B <func> | RET | NOP} > > > LDR X16, 1f > > > BR X16 > > > 1: .quad <literal> > > > > > > Since that's in the .text, it's RO for regular accesses anyway. > > > > > > > I tried to keep the literal in .rodata to avoid inadvertent gadgets > > and/or anticipate exec-only mappings of .text, but that may be a bit > > overzealous. > > I think that in practice the risk of gadgetisation is minimal, and > having it inline means we only need to record a single address per > trampoline, so there's less risk that we get the patching wrong. But doesn't that mean that it is almost certainly a data cache miss? You really want an instruction that reads the constant from the I-cache. Or at least be able to 'bunch together' the constants so they stand a chance of sharing a D-cache line. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
Powered by blists - more mailing lists