Messages in this thread | | | Subject | Re: [PATCH v38 21/24] x86/vdso: Implement a vDSO for Intel SGX enclave call | From | "Yu, Yu-cheng" <> | Date | Mon, 28 Sep 2020 08:43:16 -0700 |
| |
On 9/25/2020 11:23 AM, Andrew Cooper wrote: > On 15/09/2020 12:28, Jarkko Sakkinen wrote: >> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S >> new file mode 100644 >> index 000000000000..adbd59d41517 >> --- /dev/null >> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S >> @@ -0,0 +1,157 @@ >> +SYM_FUNC_START(__vdso_sgx_enter_enclave) >> <snip> >> +.Lretpoline: >> + call 2f >> +1: pause >> + lfence >> + jmp 1b >> +2: mov %rax, (%rsp) >> + ret > > I hate to throw further spanners in the work, but this is not compatible > with CET, and the user shadow stack work in progress.
Hi Jarkko,
These 1: and 2: targets are reached only from these few lines? If they are direct call/jmp targets, I think it is OK in terms of CET. If they are reached from an instruction like "jmp *%rax", then we need to put in an "endbr64".
Yu-cheng
> > Whichever of these two large series lands first is going to inflict > fixing this problem on the other. > > As the vdso text is global (to a first approximation), it must not be a > retpoline if any other process is liable to want to use CET-SS. > > If the retpoline really does need to stay, then the vdso probably needs > to gain suitable __x86_indirect_thunk_%reg thunks which are patched at > boot based on the system properties. > > ~Andrew >
| |