From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 801B229CA for ; Tue, 2 Nov 2021 15:15:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=Lji0Q0mKscbCR4s6xv/OULJVtCJGnkPpvCozvtfPKyM=; b=rQyjFmdABWfQuxVIFtBoZm6409 f7Q8mBnnIbnhARKu8AfsBA+4oU06whRCygb0Kmatd7/iZv1bYZsEWfsGsixFCGVYvb84ZDTeWPrCp Q6jCl/jLsDBIJ0mcDOI6pJvQ8RlkyBRHWj8FjpOu/YcCrGs13flAN4Igvu4smCRzFdUkiQYzuSUb1 6es1pUMYkJOvoNjyCsH0ehnNGvmn8bAy43xYzwsGy3VH+5/D/uiBNNq0DomJQKUaKqwYD21X2okrq VEuxt2Gfwz+P27cZgCnyOIvyi6YhiZE/m01nwh44rhuizmTlrOLtuZ0qOfiu//1K+/L7/4sth9g6M 5L7zz5Wg==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=noisy.programming.kicks-ass.net) by desiato.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1mhvVb-00DluO-H2; Tue, 02 Nov 2021 15:15:31 +0000 Received: from hirez.programming.kicks-ass.net (hirez.programming.kicks-ass.net [192.168.1.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (Client did not present a certificate) by noisy.programming.kicks-ass.net (Postfix) with ESMTPS id 989D1300366; Tue, 2 Nov 2021 16:15:30 +0100 (CET) Received: by hirez.programming.kicks-ass.net (Postfix, from userid 1000) id 7D7AA2D5FE2D6; Tue, 2 Nov 2021 16:15:30 +0100 (CET) Date: Tue, 2 Nov 2021 16:15:30 +0100 From: Peter Zijlstra To: Ard Biesheuvel Cc: Sami Tolvanen , Mark Rutland , X86 ML , Kees Cook , Josh Poimboeuf , Nathan Chancellor , Nick Desaulniers , Sedat Dilek , Steven Rostedt , linux-hardening@vger.kernel.org, Linux Kernel Mailing List , llvm@lists.linux.dev, joao@overdrivepizza.com Subject: Re: [PATCH] static_call,x86: Robustify trampoline patching Message-ID: References: <20211031163920.GV174703@worktop.programming.kicks-ass.net> <20211101090155.GW174703@worktop.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: llvm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Nov 02, 2021 at 01:57:44PM +0100, Peter Zijlstra wrote: > So how insane is something like this, have each function: > > foo.cfi: > endbr64 > xorl $0xdeadbeef, %r10d > jz foo > ud2 > nop # make it 16 bytes > foo: > # actual function text goes here > > > And for each hash have two thunks: > > > # arg: r11 > # clobbers: r10, r11 > __x86_indirect_cfi_deadbeef: > movl -9(%r11), %r10 # immediate in foo.cfi > xorl $0xdeadbeef, %r10 # our immediate > jz 1f > ud2 > 1: ALTERNATIVE_2 "jmp *%r11", > "jmp __x86_indirect_thunk_r11", X86_FEATURE_RETPOLINE > "lfence; jmp *%r11", X86_FEATURE_RETPOLINE_AMD > > > > # arg: r11 > # clobbers: r10, r11 > __x86_indirect_ibt_deadbeef: > movl $0xdeadbeef, %r10 > subq $0x10, %r11 > ALTERNATIVE "", "lfence", X86_FEATURE_RETPOLINE > jmp *%r11 > These two thunks could of course be one big alternative. > And have the actual indirect callsite look like: > > # r11 - &foo > ALTERNATIVE_2 "cs call __x86_indirect_thunk_r11", > "cs call __x86_indirect_cfi_deadbeef", X86_FEATURE_CFI > "cs call __x86_indirect_ibt_deadbeef", X86_FEATURE_IBT Also simplifying this. > Although if the compiler were to emit: > > cs call __x86_indirect_cfi_deadbeef > > we could probaly fix it up from there. > > > Then we can at runtime decide between: > > {!cfi, cfi, ibt} x {!retpoline, retpoline, retpoline-amd} >