Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 10 Nov 2016 13:32:50 -0800
From: Kees Cook <keescook@...omium.org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Elena Reshetova <elena.reshetova@...el.com>, 
	"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, Arnd Bergmann <arnd@...db.de>, 
	Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, 
	"H. Peter Anvin" <h.peter.anvin@...el.com>, Will Deacon <will.deacon@....com>, 
	Hans Liljestrand <ishkamiel@...il.com>, David Windsor <dwindsor@...il.com>
Subject: Re: [RFC v4 PATCH 12/13] x86: implementation for HARDENED_ATOMIC

On Thu, Nov 10, 2016 at 1:16 PM, Peter Zijlstra <peterz@...radead.org> wrote:
> On Thu, Nov 10, 2016 at 01:04:20PM -0800, Kees Cook wrote:
>> On Thu, Nov 10, 2016 at 12:40 PM, Peter Zijlstra <peterz@...radead.org> wrote:
>> > On Thu, Nov 10, 2016 at 10:24:47PM +0200, Elena Reshetova wrote:
>> >>  static __always_inline void atomic_add(int i, atomic_t *v)
>> >>  {
>> >> +     asm volatile(LOCK_PREFIX "addl %1,%0\n"
>> >> +
>> >> +#ifdef CONFIG_HARDENED_ATOMIC
>> >> +                  "jno 0f\n"
>> >> +                  LOCK_PREFIX "subl %1,%0\n"
>> >> +                  "int $4\n0:\n"
>> >> +                  _ASM_EXTABLE(0b, 0b)
>> >
>> >
>> > This is unreadable gunk.
>> >
>> >> +#endif
>> >> +
>> >>                    : "+m" (v->counter)
>> >>                    : "ir" (i));
>> >>  }
>>
>> How would you suggest it be made readable? Or rather, what don't you
>> like about it?
>
> Try and find the label the jno jumps to.. I had to try 3 times.
>
> Also, I hate how #ifdef CONFIG_HARDENED_ATOMIC is sprinkled all over, it
> makes a huge trainwreck of that file.

I guess the question was "prefer copy/pasting" vs "sprinkled ifdef". I
tend to opt for reducing copy/paste, but this is just a code
organization issue. Likely, then, would be to have two separate
implementations in different .c files and have the Makefile select the
desired version.

> Ideally there'd be only a single #ifdef CONFIG_HARNDED_ATOMIC.
>
> I'm also not sure about atomic*_wrap() as an interface, these functions
> already have far too long names. We could simply overload the existing
> functions and select based off the argument type.

There was a concern over catching type errors when building without
CONFIG_HARDENED_ATOMIC. Again, this is just a code organization issue
-- I think whatever people prefer is fine. In theory, 0-day will
quickly catch the corner cases, but I'd love it if the types couldn't
get mixed up.

Out of curiosity, how would the arg-type selection look? Are there
other examples of this already in the kernel?

-Kees

-- 
Kees Cook
Nexus Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.