From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEEFEC433C1 for ; Tue, 23 Mar 2021 22:41:54 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3448B619D8 for ; Tue, 23 Mar 2021 22:41:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3448B619D8 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=M0Mb8e6ALeH1LuceSGsb9lLIoRrxHw2WvRXFNLR3Bq0=; b=JdeTiAzc50gqBeYMj70EkHENV Ls7VDqlDaaXFyTSEX1NjIGFTl8sJ0j+YpRxqxfTdNo1p/zI1O3w4gDnEV9cdg9kRxx0CjGPMxSFOV yh2xuF6xXoORBu5UdtocoPrjDUqnOuqsJzy9SbCM1EWIvfu2wrDpPzCwv+Gr57fPrAmZiUoNjJqP9 TQ4gdOndDk1opG4jGzn2mKLh0EViBu8A42iIcUPXtLFmjt9kzeiP+Tcql3cyQKjn+VAK1VNNS3rn9 OychuwqE1JX27xoS6AmU395qe/smd1ja3KfxV6hN6XeYaB8pQAp+aPHBYADHdtjy5ysvPx/ni12WU 1QlOXI+qw==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lOph9-00FuoU-MT; Tue, 23 Mar 2021 22:40:15 +0000 Received: from mail-oi1-x22a.google.com ([2607:f8b0:4864:20::22a]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lOpgz-00FukZ-FF for linux-arm-kernel@lists.infradead.org; Tue, 23 Mar 2021 22:40:11 +0000 Received: by mail-oi1-x22a.google.com with SMTP id w70so18792121oie.0 for ; Tue, 23 Mar 2021 15:40:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2K8tLkChb+506zF+z/6B3jJAVVp0oMTr1r3/3aTgbn4=; b=Pe81cQ60l5HI2BEwB08JrmJgjyYI5GsI3IG5+NoNvN7VxFUlwWmEy8vXEIyGwtmzwW PMhpc0Uoys2+0YlJncs+JwzktMZ4f7sMDoja0mnZeF9Av0u9MAKIbVp6r2SqjdHhCwl4 91CyfWajYrMgrHW+aut9mDhFzzUElhDwht9/MjUcojOa+L+0nxzHZiE2W5ucqb5Cm/G+ 0kn9cLuHDDhFx2cfgZs538uCneOninzEY03vpioj/99K2O9tZk5aEH1w8TsBOYitABPk NEKvMo6kq01IAKkKBlZAOaNYMcnXQJyDKKPo5l1L5qhGIO8xwAtsCn3VcYlm69I5+d+w DZaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2K8tLkChb+506zF+z/6B3jJAVVp0oMTr1r3/3aTgbn4=; b=RL/FDBkew4OPZNlf2V8XzVy0IxMfUs5rKv0WZSCImbYxSWcuakMY0nwLVkFeY/gSPc u6RRPdUAVJnYkPINr3/jaVb90jBrEBvdNK9ECmSQsEbhdoiAa3c6R87S968WxWb941Rr CrvzU/fEhqxYMmVZcw26iFBL/70sCWnV6dDFFWCS+BHjtz+2in9qc2T5o+uuosjQGHuP 9XHKcKxDll6Z83Y8fYiZjkrN941d1iyBVwnBPp8lswffWQ0MB4FNiXVwFcwFoqiCn0zn AGPCMLlhjqccDLaeznI3R8VGIQlvCUpfOmi/ZTlyHqGwiBnHix1H684sUFrWelxz9mHK oZAg== X-Gm-Message-State: AOAM5317vLBpIUcdtbkMPcIHHY2qpZYamMblITi7I3YjWrZL7BTUGgS3 T2wK+2Nyb4Px6Fu6p1wI5IFObMsq9RNQYKcykFL1ow== X-Google-Smtp-Source: ABdhPJzKT7oZFNSdPkzKR6RwxWfh1Wycs7N3YoemOpk0yIsAn2ibj4rUZ4fk7mjWToK526aRsi+/tUqJdhVxceAbusw= X-Received: by 2002:aca:c683:: with SMTP id w125mr263549oif.43.1616539201756; Tue, 23 Mar 2021 15:40:01 -0700 (PDT) MIME-Version: 1.0 References: <20210223023125.2265845-1-jiancai@google.com> <20210223023542.2287529-1-jiancai@google.com> In-Reply-To: From: Jian Cai Date: Tue, 23 Mar 2021 15:39:50 -0700 Message-ID: Subject: Re: [PATCH v5] ARM: Implement SLS mitigation To: Linus Walleij Cc: Nick Desaulniers , Manoj Gupta , Luis Lozano , clang-built-linux , Nathan Chancellor , David Laight , Will Deacon , Russell King , Russell King , Catalin Marinas , James Morris , "Serge E. Hallyn" , Arnd Bergmann , Masahiro Yamada , Krzysztof Kozlowski , Marc Zyngier , Kees Cook , =?UTF-8?Q?Andreas_F=C3=A4rber?= , Ard Biesheuvel , Ingo Molnar , Andrew Morton , Mike Rapoport , Mark Rutland , David Brazdil , James Morse , Linux ARM , "linux-kernel@vger.kernel.org" , linux-security-module@vger.kernel.org X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210323_224009_424877_7AF99450 X-CRM114-Status: GOOD ( 32.61 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Thanks for the suggestion. I've sent an inquiry to the author of -mharden-sls* in GCC and hopefully that would shed some more light. We do get warnings for oraphon sections when using lld. The other linkers do not seem to provide such warnings, although the boot failure also does not seem to happen with them. On Mon, Mar 22, 2021 at 4:45 AM Linus Walleij wrote: > > On Wed, Mar 10, 2021 at 5:43 AM Jian Cai wrote: > > On Sat, Mar 6, 2021 at 4:25 AM Linus Walleij wrote: > > > On Fri, Mar 5, 2021 at 12:23 AM Jian Cai wrote: > > > > On Wed, Mar 3, 2021 at 7:04 AM Linus Walleij wrote: > > > > > I think gcc also has these options. > > > > https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html > > > > > > And how does that work with this part of your patch: > > > > > > +#define SLS_TEXT \ > > > + ALIGN_FUNCTION(); \ > > > + *(.text.__llvm_slsblr_thunk_*) > > > > > > This does not look compiler agnostic? > > > > You are right, GCC does generate different oraphan section names. I > > will address it in the next version of the patch. Also it seems only > > arm64 gcc supports -mharden-sls=* at this moment, arm32 gcc does not > > support it yet. I don't know if there is any plan to implement it for > > 32-bit gcc, but should we patch arm32 linker script preemptively, > > assuming the sections will be named with the same pattern like how > > clang does so the kernel would not fail to boot when the flag is > > implemented? > > I think the best thing is to have something like this: > Implement a macro such as this in > include/linux/compiler-clang.h > > #define SLS_TEXT_SECTION *(.text.__llvm_slsblr_thunk_*) > > then the corresponding in include/linux/compiler-gcc.h > but here also add a > > #define SLS_TEXT_SECTION #error "no compiler support" > > if the compiler version does not have this. > > I don't know the exact best approach sadly, as the patch > looks now it seems a bit fragile, I wonder if you get linker > warnings when this section is unused? > > Yours, > Linus Walleij _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel