linux-kernel - Re: [PATCH] x86: add hintable NOPs emulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250821124659.GO3289052@noisy.programming.kicks-ass.net>
Date: Thu, 21 Aug 2025 14:46:59 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: David Laight <david.laight.linux@...il.com>
Cc: Marcos Del Sol Vives <marcos@...a.pet>, linux-kernel@...r.kernel.org,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>, Brian Gerst <brgerst@...il.com>,
	Uros Bizjak <ubizjak@...il.com>, Ard Biesheuvel <ardb@...nel.org>,
	David Kaplan <david.kaplan@....com>,
	"Ahmed S. Darwish" <darwi@...utronix.de>,
	Kees Cook <kees@...nel.org>,
	Andrew Cooper <andrew.cooper3@...rix.com>,
	Oleg Nesterov <oleg@...hat.com>, "Xin Li (Intel)" <xin@...or.com>,
	Sabyrzhan Tasbolatov <snovitoll@...il.com>
Subject: Re: [PATCH] x86: add hintable NOPs emulation

On Thu, Aug 21, 2025 at 01:28:07PM +0100, David Laight wrote:
> On Wed, 20 Aug 2025 11:07:33 +0200
> Peter Zijlstra <peterz@...radead.org> wrote:
> 
> > On Wed, Aug 20, 2025 at 03:34:46AM +0200, Marcos Del Sol Vives wrote:
> > > Hintable NOPs are a series of instructions introduced by Intel with the
> > > Pentium Pro (i686), and described in US patent US5701442A.
> > > 
> > > These instructions were reserved to allow backwards-compatible changes
> > > in the instruction set possible, by having old processors treat them as
> > > variable-length NOPs, while having other semantics in modern processors.
> > > 
> > > Some modern uses are:
> > >  - Multi-byte/long NOPs
> > >  - Indirect Branch Tracking (ENDBR32)
> > >  - Shadow Stack (part of CET)
> > > 
> > > Some processors advertising i686 compatibility lack full support for
> > > them, which may cause #UD to be incorrectly triggered, crashing software
> > > that uses then with an unexpected SIGILL.
> > > 
> > > One such software is sudo in Debian bookworm, which is compiled with
> > > GCC -fcf-protection=branch and contains ENDBR32 instructions. It crashes
> > > on my Vortex86DX3 processor and VIA C3 Nehalem processors [1].
> > > 
> > > This patch is a much simplified version of my previous patch for x86
> > > instruction emulation [2], that only emulates hintable NOPs.
> > > 
> > > When #UD is raised, it checks if the opcode corresponds to a hintable NOP
> > > in user space. If true, it warns the user via the dmesg and advances the
> > > instruction pointer, thus emulating its expected NOP behaviour.
> > > 
> > > [1]: https://lists.debian.org/debian-devel/2023/10/msg00118.html
> > > [2]: https://lore.kernel.org/all/20210626130313.1283485-1-marcos@orca.pet/
> > > 
> > > Signed-off-by: Marcos Del Sol Vives <marcos@...a.pet>  
> > 
> > This is going to be terribly slow if there's a significant number of
> > traps (like with endbr32), but yeah, this ought to work.
> 
> Could you patch the memory resident page to contain a supported nop?
> (without marking it 'dirty')
> Then the same function wouldn't trap until the code page was reloaded
> from the source file.

It would mean cloning the page as private. Yes you can do it, uprobes
has all the code for this. But it has non-trivial memory overhead.