On Sat, Mar 6, 2021 at 4:25 AM Linus Walleij <linus.wall...@linaro.org> wrote: > > On Fri, Mar 5, 2021 at 12:23 AM Jian Cai <jian...@google.com> wrote: > > On Wed, Mar 3, 2021 at 7:04 AM Linus Walleij <linus.wall...@linaro.org> > > wrote: > > > > > > On Tue, Feb 23, 2021 at 3:36 AM Jian Cai <jian...@google.com> wrote: > > > > > > > This patch adds CONFIG_HARDEN_SLS_ALL that can be used to turn on > > > > -mharden-sls=all, which mitigates the straight-line speculation > > > > vulnerability, speculative execution of the instruction following some > > > > unconditional jumps. Notice -mharden-sls= has other options as below, > > > > and this config turns on the strongest option. > > > > > > > > all: enable all mitigations against Straight Line Speculation that are > > > > implemented. > > > > none: disable all mitigations against Straight Line Speculation. > > > > retbr: enable the mitigation against Straight Line Speculation for RET > > > > and BR instructions. > > > > blr: enable the mitigation against Straight Line Speculation for BLR > > > > instructions. > > > > > > I heard about compiler protection for this, so nice to see it happening! > > > > > > Would you happen to know if there is any plan to do the same for GCC? > > > I know you folks at Google like LLVM, but if you know let us know. > > > > I think gcc also has these options. > > https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html > > And how does that work with this part of your patch: > > +#define SLS_TEXT \ > + ALIGN_FUNCTION(); \ > + *(.text.__llvm_slsblr_thunk_*) > > This does not look compiler agnostic? >
You are right, GCC does generate different oraphan section names. I will address it in the next version of the patch. Also it seems only arm64 gcc supports -mharden-sls=* at this moment, arm32 gcc does not support it yet. I don't know if there is any plan to implement it for 32-bit gcc, but should we patch arm32 linker script preemptively, assuming the sections will be named with the same pattern like how clang does so the kernel would not fail to boot when the flag is implemented? Thanks, Jian > Yours, > Linus Walleij
