From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C00012C81 for ; Sun, 31 Oct 2021 16:39:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=Rp8yNDT9JB3LRMzfJfNEleH+RHkEoWlw4lzlXDzKQ2Q=; b=UNp+S5lm+9UO/WwnKsquJL5VaW o1wjfKIigJwTbq/CJO1kPGEPcQq7Xr0g78T8w2aRUazqhwlewYudyFJRQiZRBRsnCD7Ff5YtQA0fH LmMXzNjOq0Erd2Fon1jLSDE0y+J8Vh1c/xwFsI1dKIQeBCRNcieZfM/hqH+OwoE6uv3Pt8ASQGlpt UwAkeHrXcpydWkCB4CQr3MN9uQX70AhHfNqM2nWJjck7DfndNX/LfLg/4heeY1phv/k6vSiskfpni QAIfQydKMvg5+E3b1rqEKrIs7/J0OT0gEUNa2znRPqFIPhrFE+VSHp7P6wbFw9OclAE6unWdwaT3W motZbuxQ==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=worktop.programming.kicks-ass.net) by desiato.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1mhDre-00DQF6-8i; Sun, 31 Oct 2021 16:39:22 +0000 Received: by worktop.programming.kicks-ass.net (Postfix, from userid 1000) id F1476984CD2; Sun, 31 Oct 2021 17:39:20 +0100 (CET) Date: Sun, 31 Oct 2021 17:39:20 +0100 From: Peter Zijlstra To: Ard Biesheuvel Cc: Sami Tolvanen , Mark Rutland , X86 ML , Kees Cook , Josh Poimboeuf , Nathan Chancellor , Nick Desaulniers , Sedat Dilek , Steven Rostedt , linux-hardening@vger.kernel.org, Linux Kernel Mailing List , llvm@lists.linux.dev Subject: Re: [PATCH] static_call,x86: Robustify trampoline patching Message-ID: <20211031163920.GV174703@worktop.programming.kicks-ass.net> References: <20211029200324.GR174703@worktop.programming.kicks-ass.net> <20211030074758.GT174703@worktop.programming.kicks-ass.net> <20211030180249.GU174703@worktop.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: llvm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Sun, Oct 31, 2021 at 05:24:13PM +0100, Ard Biesheuvel wrote: > On Sat, 30 Oct 2021 at 20:55, Ard Biesheuvel wrote: > > > > On Sat, 30 Oct 2021 at 20:03, Peter Zijlstra wrote: > > > > > > On Sat, Oct 30, 2021 at 07:19:53PM +0200, Ard Biesheuvel wrote: > > > > I just realized that arm64 has the exact same problem, which is not > > > > being addressed by my v5 of the static call support patch. > > > > > > Yeah, it would. > > > > > > > As it turns out, the v11 Clang that I have been testing with is broken > > > > wrt BTI landing pads, and omits them from the jump table entries. > > > > Clang 12+ adds them properly, which means that both the jump table > > > > entry and the static call trampoline may start with BTI C + direct > > > > branch, and we also need additional checks to disambiguate. > > > > > > I'm not sure, why would the static_call trampoline need a BTI C ? The > > > whole point of static_call() is to be a direct call, we should never > > > have an indirect call to the trampoline, that would defeat the whole > > > purpose. > > > > This might happen when the distance between the caller and the > > trampoline is more than 128 MB, in which case we emit a veneer that > > uses an indirect call as well. So we definitely need the landing pad > > in the trampoline. > > Something like the below seems to work to prevent getting the wrong > trampoline address into arch_static_call_transform: Is is also a terriblly gross hack. I really want the clang-cfi stuff to improve, not add layers of hacks on top of it.