linux-kernel - Re: [PATCH] x86: add hintable NOPs emulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250821132807.0a898dfa@pumpkin>
Date: Thu, 21 Aug 2025 13:28:07 +0100
From: David Laight <david.laight.linux@...il.com>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Marcos Del Sol Vives <marcos@...a.pet>, linux-kernel@...r.kernel.org,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>, Brian Gerst
 <brgerst@...il.com>, Uros Bizjak <ubizjak@...il.com>, Ard Biesheuvel
 <ardb@...nel.org>, David Kaplan <david.kaplan@....com>, "Ahmed S. Darwish"
 <darwi@...utronix.de>, Kees Cook <kees@...nel.org>, Andrew Cooper
 <andrew.cooper3@...rix.com>, Oleg Nesterov <oleg@...hat.com>, "Xin Li
 (Intel)" <xin@...or.com>, Sabyrzhan Tasbolatov <snovitoll@...il.com>
Subject: Re: [PATCH] x86: add hintable NOPs emulation

On Wed, 20 Aug 2025 11:07:33 +0200
Peter Zijlstra <peterz@...radead.org> wrote:

> On Wed, Aug 20, 2025 at 03:34:46AM +0200, Marcos Del Sol Vives wrote:
> > Hintable NOPs are a series of instructions introduced by Intel with the
> > Pentium Pro (i686), and described in US patent US5701442A.
> > 
> > These instructions were reserved to allow backwards-compatible changes
> > in the instruction set possible, by having old processors treat them as
> > variable-length NOPs, while having other semantics in modern processors.
> > 
> > Some modern uses are:
> >  - Multi-byte/long NOPs
> >  - Indirect Branch Tracking (ENDBR32)
> >  - Shadow Stack (part of CET)
> > 
> > Some processors advertising i686 compatibility lack full support for
> > them, which may cause #UD to be incorrectly triggered, crashing software
> > that uses then with an unexpected SIGILL.
> > 
> > One such software is sudo in Debian bookworm, which is compiled with
> > GCC -fcf-protection=branch and contains ENDBR32 instructions. It crashes
> > on my Vortex86DX3 processor and VIA C3 Nehalem processors [1].
> > 
> > This patch is a much simplified version of my previous patch for x86
> > instruction emulation [2], that only emulates hintable NOPs.
> > 
> > When #UD is raised, it checks if the opcode corresponds to a hintable NOP
> > in user space. If true, it warns the user via the dmesg and advances the
> > instruction pointer, thus emulating its expected NOP behaviour.
> > 
> > [1]: https://lists.debian.org/debian-devel/2023/10/msg00118.html
> > [2]: https://lore.kernel.org/all/20210626130313.1283485-1-marcos@orca.pet/
> > 
> > Signed-off-by: Marcos Del Sol Vives <marcos@...a.pet>  
> 
> This is going to be terribly slow if there's a significant number of
> traps (like with endbr32), but yeah, this ought to work.

Could you patch the memory resident page to contain a supported nop?
(without marking it 'dirty')
Then the same function wouldn't trap until the code page was reloaded
from the source file.

	David