Re: Plumbers CF MCs

[Kees Cook <keescook@chromium.org>]

On Tue, Mar 30, 2021 at 03:13:12PM +0100, Will Deacon wrote:
> On Tue, Mar 23, 2021 at 09:35:10AM +0100, Peter Zijlstra wrote:
> > On Mon, Mar 22, 2021 at 01:23:03PM -0700, Nick Desaulniers wrote:
> > > Hi all,
> > > I saw plumbers opened call for microconferences:
> > > https://www.linuxplumbersconf.org/blog/2021/index.php/2021/03/18/cfp-open-microconferences/
> > > 
> > > I was going to put together a submission; do we want to do a combined
> > > toolchain MC, or have distinct ones this year?
> > > 
> > > I know in 2020 the GNU cauldron was co-located with Plumbers, as well
> > > as a GNU Tools Track MC and LLVM MC.
> > 
> > A combined MC focussed on kernel issues seems very interesting. We still
> > have the control dependency (volatile-if?) thing pending. We had a bit
> > of a discussion on that after last year, but I don't think anything
> > really came of that, can we pick that up? Ideally a compiler person does
> > an actual proposal for this year.
> > 
> > If we can sort that, there's the rest of the dependencies Will outlined
> > :-)
> > 
> > Then there seemed to be people that thought __always_inline was a
> > suggestion... I think we need to explore how that was ever possible.
> > 
> > There's the endless UB debate... can we define more to reduce the UB? I
> > mean, we're already bound by architecture ABI on the one hand, and
> > actual use on the other. It would be so very nice to be able to get more
> > -fwrapv and -fno-strict-aliasing knobs that define UBs away.
> > 
> > There also is talk about straight line speculation mitigations. for x86
> > we should probably emit an INT3 after every JMP and RET. Although this
> > might not be controversial and be sorted by the time Plumbers happens.
> > 
> > There was some talk about how compilers could help objtool make sense of
> > jump tables.
> > 
> > GCC's status on asm-goto with outputs?
> > 
> > Clang's getting asm-constraints wrong ("rm" and it always picks "m").
> > 
> > 
> > And I'm sure there was more..
> 
> One thing I'd like to add, and which I think is possibly relevant to the SLS
> mitigation for arm64, is whether there is scope for allowing the compiler to
> generate alternative instruction sequences (e.g. in a separate section),
> which the kernel could then patch in during boot. We already do a tonne of
> code patching on arm64 for things like CPU errata workarounds but also
> for enabling support for optional architecture features, where the kernel
> code would trap on CPUs without hardware support.
> 
> Another use of this would be to enable stack-taggging with MTE, where the
> instrumentation is generated by the compiler but may use instructions which
> are undefined if the CPU doesn't support MTE.

Or swapping out SCS and stack-protector for PAC when the hardware
supports it...

-- 
Kees Cook