linux-kernel - Re: [PATCH 4/9] x86/alternative: Implement .retpoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211013220520.xzsp5q2amuwy6n6o@treble>
Date:   Wed, 13 Oct 2021 15:05:20 -0700
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     x86@...nel.org, andrew.cooper3@...rix.com,
        linux-kernel@...r.kernel.org, alexei.starovoitov@...il.com,
        ndesaulniers@...gle.com
Subject: Re: [PATCH 4/9] x86/alternative: Implement .retpoline_sites support

On Wed, Oct 13, 2021 at 11:43:43PM +0200, Peter Zijlstra wrote:
> On Wed, Oct 13, 2021 at 02:11:18PM -0700, Josh Poimboeuf wrote:
> > On Wed, Oct 13, 2021 at 02:22:21PM +0200, Peter Zijlstra wrote:
> > > +#ifdef CONFIG_X86_64
> > > +
> > > +/*
> > > + * CALL/JMP *%\reg
> > > + */
> > > +static int emit_indirect(int op, int reg, u8 *bytes)
> > 
> > X86_64 is already equivalent to STACK_VALIDATION these days, but might
> > as well clarify here where the retpoline_sites dependency comes from by
> > changing this to '#ifdef CONFIG_STACK_VALIDATION'.
> 
> Yeah, I was contemplating having x86_64 unconditionally select that.
> Maybe we should.

As far as I can tell, it already does that:

        select HAVE_STACK_VALIDATION            if X86_64
        select HAVE_STATIC_CALL_INLINE          if HAVE_STACK_VALIDATION
        select STACK_VALIDATION                 if HAVE_STACK_VALIDATION && (HAVE_STATIC_CALL_INLINE || RETPOLINE)

> Also, I think I've proposed it before, but what about:
> 
>  s/STACK_VALIDATION/OBJTOOL/
> 
> on all that?

How about keeping STACK_VALIDATION, but then having it depend on
OBJTOOL, in case anybody cares to extricate the two at some point.  Some
objtool features (like this one) don't rely on the full validation.

-- 
Josh