linux-kernel - Re: [PATCH] x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKwvOdk09OCeOrmHJBzRhp4XQykH_tkBGi9DY870C=suBzz9YQ@mail.gmail.com>
Date:   Tue, 4 Oct 2022 14:27:24 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Peter Zijlstra <peterz@...radead.org>,
        Borislav Petkov <bp@...en8.de>
Cc:     Nathan Chancellor <nathan@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        linux-kernel@...r.kernel.org, llvm@...ts.linux.dev,
        "Moreira, Joao" <joao.moreira@...el.com>
Subject: Re: [PATCH] x86/build: Move '-mindirect-branch-cs-prefix' out of
 GCC-only block

On Thu, Aug 18, 2022 at 12:45 AM Peter Zijlstra <peterz@...radead.org> wrote:
>
> On Wed, Aug 17, 2022 at 03:08:01PM -0700, Nick Desaulniers wrote:
> > On Wed, Aug 17, 2022 at 11:56 AM Nathan Chancellor <nathan@...nel.org> wrote:
> > >
> > > LLVM 16 will have support for this flag so move it out of the GCC-only
> > > block to allow LLVM builds to take advantage of it.
> > >
> > > Link: https://github.com/ClangBuiltLinux/linux/issues/1665
> > > Link: https://github.com/llvm/llvm-project/commit/6f867f9102838ebe314c1f3661fdf95700386e5a
> > > Signed-off-by: Nathan Chancellor <nathan@...nel.org>
> >
> > Thanks for the patch, I also boot tested this (in virtual guests for
> > both 64b and 32b).
> >
> > Reviewed-by: Nick Desaulniers <ndesaulniers@...gle.com>
> > Tested-by: Nick Desaulniers <ndesaulniers@...gle.com>
> >
> > Peter, is there anything else special about these prefixes needed to
> > make use of them?
>
> The thing to do is boot with (warning, *very* verbose):
>
>         "spectre_v2=retpoline,lfence debug-alternative"

ah, debug-alternative also needs loglevel=8. Was wondering why I
wasn't getting anything new in the output...

No kidding on the verbosity. For a defconfig, booting in QEMU and
redirecting stdout to a file produced a 95257 line file.

$ grep "SMP alternatives: retpoline" /tmp/log.txt | wc -l
18623
$ du -h /tmp/log.txt
11M /tmp/log.txt
$ grep "SMP alternatives: retpoline" /tmp/log.txt | tr -s ' '
...
[ 56.736261] SMP alternatives: retpoline at:
pm_check_save_msr+0x30/0x80 (ffffffffaa34b320) len: 6 to:
__x86_indirect_thunk_r11+0x0/0x20
$ grep "SMP alternatives: retpoline" /tmp/log.txt | tr -s ' ' | cut -d
' ' -f 10 | sort -u
5
6
# Curious about the 5, looks like there's only 2 cases:
$ grep "SMP alternatives: retpoline" /tmp/log.txt | grep 'len: 5'
[    0.147261] SMP alternatives: retpoline at: ret_from_fork+0x1d/0x30
(ffffffffa9601dbd) len: 5 to: __x86_indirect_thunk_rbx+0x0/0x20
[    2.274261] SMP alternatives: retpoline at: __efi_call+0x23/0x30
(ffffffffa9671663) len: 5 to: __x86_indirect_thunk_rdi+0x0/0x20


Is there anything else I can do to help verify Nathan and Joao's
patches?  If not, would you mind Ack'ing this so the x86 maintainers
can pick it up?


>
> and observe that the retpoline sites all replace:
>
>         "cs call __x86_indirect_thunk_r11" (6 bytes)
>
> with:
>
>         "lfence; jmp *%r11" (6 bytes)
>
>
> This being clang, you'll ofcourse still have a few weird:
>
>         "Jcc.d32 __x86_indirect_thunk_r11"
>
> sites that will not be able to be replaced, but there's nothing I can do
> about that other than to continue to encourage y'all to stop emitting
> them ;-)

Noting that Joao's patch was applied in my tests.
https://reviews.llvm.org/D134915
I plan to land Joao's patch imminently.
-- 
Thanks,
~Nick Desaulniers

View attachment "log.txt" of type "text/plain" (24985 bytes)