From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1516694466; cv=none; d=google.com; s=arc-20160816; b=1CURD3Xiw9OvLs8T8u+Jdjnlj+DPRL0PGWOlF2w7rejnjv8+oX2im6u1JSRK+pcGiO FNurdnaTUa+L70/eARqjf1BjQphfGe74b5sGMHGWj0kCfDKKG+Zy6qEcl+sAsZ51H3ex Pns94sziJkFwANeH/T7hUntIXzuVgKVZqMHrhzUcK+TS2Kfc9xVEgnRGoquBs6erZ9jZ IhwxBPTcLsBSvuvJpIQH6VE/SfUl4LhJ9pJGl0CbV17g/njv5Y86Gb0HiORJyMv02Unf cw/zakmFsWnhepV6x4gef3c+PnbK/ErrTw/7k31n0ER2NCpv4+OEJ+eMLzru0R2xn6Od +Ayg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:sender:dkim-signature :arc-authentication-results; bh=m7tRZUlGe9sucE/sFjk2lE1KlZlHIcrDlml0A0Hfbdo=; b=HuVVGVZo0ZF1zQDswYEJIOs14/UjnfM/ptUZY7fLazhtkj/Z3gNkIsJc/hbwF/xLW+ dnDMd2oy0BA3rxNDoIgfcG0idyZDIm67A8xiDVVWoHAGk2zXJwTS05Ga7FNnWDr+cmzl 6hEhO+4WIxZUup46CACvx4MHmVhOIsoOUllR46jsuqqrGgG1V8r6dcDjfP8CazgaVGqw ieQkkj5C4Z/Tx8T4BgdDTeqZxRynBVFEjoBsCqEMIjo3+wuuXvIHQtbuNw+Cz6Vp5Oxw HycxHhwQf6UyXRMIDZKJ4REJ5D+bcEXxo5IwSvcrX2UIeSSJScmbs5ibi0EHaJ81LAt7 FrkA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=f6DbJNKN; spf=pass (google.com: domain of mingo.kernel.org@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=mingo.kernel.org@gmail.com Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=f6DbJNKN; spf=pass (google.com: domain of mingo.kernel.org@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=mingo.kernel.org@gmail.com X-Google-Smtp-Source: AH8x224wbEllEAEUfNXiG1GOo4OnW44DWY6RXPKH1QDyvPCSiRV55Ef5A6YUb3WDHwjoL5IP0qcAaw== Sender: Ingo Molnar Date: Tue, 23 Jan 2018 09:01:01 +0100 From: Ingo Molnar To: Linus Torvalds Cc: Andy Lutomirski , the arch/x86 maintainers , LKML , Greg Kroah-Hartman , Alan Cox , Jann Horn , Samuel Neves , Dan Williams , Kernel Hardening , Borislav Petkov Subject: Re: [PATCH] x86/retpoline/entry: Disable the entire SYSCALL64 fast path with retpolines on Message-ID: <20180123080101.7udtt6wdl6jpglwa@gmail.com> References: <503224b776b9513885453756e44bab235221124e.1516644136.git.luto@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170609 (1.8.3) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590316784671066673?= X-GMAIL-MSGID: =?utf-8?q?1590369416702618669?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: * Linus Torvalds wrote: > On Mon, Jan 22, 2018 at 10:04 AM, Andy Lutomirski wrote: > > The existing retpoline code carefully and awkwardly retpolinifies > > the SYSCALL64 slow path. This stops the fast path from being > > particularly fast, and it's IMO rather messy. > > I'm not convinced your patch isn't messier still.. It's certainly > subtle. I had to look at that ptregs stub generator thing twice. > > Honestly, I'd rather get rid of the fast-path entirely. Compared to > all the PTI mess, it's not even noticeable. > > And if we ever get CPU's that have this all fixed, we can re-visit > introducing the fastpath. But this is all very messy and it doesn't > seem worth it right now. > > If we get rid of the fastpath, we can lay out the slow path slightly > better, and get rid of some of those jump-overs. And we'd get rid of > the ptregs hooks entirely. > > So we can try to make the "slow" path better while at it, but I really > don't think it matters much now in the post-PTI era. Sadly. Note that there's another advantage to your proposal: should other vulnerabilities arise in the future, requiring changes in the syscall entry path, we'd be more flexible to address them in the C space than in the assembly space. In hindsight a _LOT_ of the PTI complexity and fragility centered around interacting with x86 kernel entry assembly code - which entry code fortunately got much simpler (and easier to review) in the past 1-2 years due to the thorough cleanups and the conversion of most of it to C. But it was still painful. So I'm fully in favor of that. Thanks, Ingo