From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED,USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B8C7C43441 for ; Thu, 29 Nov 2018 20:12:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 428E921104 for ; Thu, 29 Nov 2018 20:12:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 428E921104 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726551AbeK3HT2 (ORCPT ); Fri, 30 Nov 2018 02:19:28 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51646 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725871AbeK3HT2 (ORCPT ); Fri, 30 Nov 2018 02:19:28 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7E41885541; Thu, 29 Nov 2018 20:12:51 +0000 (UTC) Received: from treble (ovpn-123-4.rdu2.redhat.com [10.10.123.4]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 45DC15D736; Thu, 29 Nov 2018 20:12:49 +0000 (UTC) Date: Thu, 29 Nov 2018 14:12:47 -0600 From: Josh Poimboeuf To: Linus Torvalds Cc: Steven Rostedt , Andy Lutomirski , Peter Zijlstra , Andrew Lutomirski , the arch/x86 maintainers , Linux List Kernel Mailing , Ard Biesheuvel , Ingo Molnar , Thomas Gleixner , mhiramat@kernel.org, jbaron@akamai.com, Jiri Kosina , David.Laight@aculab.com, bp@alien8.de, julia@ni.com, jeyu@kernel.org, Peter Anvin Subject: Re: [PATCH v2 4/4] x86/static_call: Add inline static call implementation for x86-64 Message-ID: <20181129201247.hhkak4paqyja6d6d@treble> References: <0A629D30-ADCF-4159-9443-E5727146F65F@amacapital.net> <20181129121307.12393c57@gandalf.local.home> <20181129124404.2fe55dd0@gandalf.local.home> <20181129125857.75c55b96@gandalf.local.home> <20181129134725.6d86ade6@gandalf.local.home> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20180716 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Thu, 29 Nov 2018 20:12:51 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Nov 29, 2018 at 10:58:40AM -0800, Linus Torvalds wrote: > On Thu, Nov 29, 2018 at 10:47 AM Steven Rostedt wrote: > > > > Note, we do have a bit of control at what is getting called. The patch > > set requires that the callers are wrapped in macros. We should not > > allow just any random callers (like from asm). > > Actually, I'd argue that asm is often more controlled than C code. > > Right now you can do odd things if you really want to, and have the > compiler generate indirect calls to those wrapper functions. > > For example, I can easily imagine a pre-retpoline compiler turning > > if (cond) > fn1(a,b) > else > fn2(a,b); > > into a function pointer conditional > > (cond ? fn1 : fn2)(a,b); > > and honestly, the way "static_call()" works now, can you guarantee > that the call-site doesn't end up doing that, and calling the > trampoline function for two different static calls from one indirect > call? > > See what I'm talking about? Saying "callers are wrapped in macros" > doesn't actually protect you from the compiler doing things like that. > > In contrast, if the call was wrapped in an inline asm, we'd *know* the > compiler couldn't turn a "call wrapper(%rip)" into anything else. I think objtool could warn about many such issues, including function pointer references to trampolines and short tail call jumps. -- Josh