Messages in this thread | | | From | Sami Tolvanen <> | Date | Mon, 14 Feb 2022 13:38:18 -0800 | Subject | Re: [RFC][PATCH 6/6] objtool: Add IBT validation / fixups |
| |
On Fri, Feb 11, 2022 at 5:38 AM Peter Zijlstra <peterz@infradead.org> wrote: > I think we'll end up with something related to KCFI, but with distinct > differences: > > - 32bit immediates for smaller code
Sure, I don't see issues with that. Based on a quick test with defconfig, this reduces vmlinux size by 0.30%.
> - __kcfi_check_fail() is out for smaller code
I'm fine with adding a trap mode that's used by default, but having more helpful diagnostics when something fails is useful even in production systems in my experience. This change results in a vmlinux that's another 0.92% smaller.
> Which then yields: > > caller: > cmpl $0xdeadbeef, -0x4(%rax) # 7 bytes > je 1f # 2 bytes > ud2 # 2 bytes > 1: call __x86_indirect_thunk_rax # 5 bytes
Note that the compiler might not emit this *exact* sequence of instructions. For example, Clang generates this for events_sysfs_show with the modified KCFI patch:
2274: cmpl $0x4d7bed9e,-0x4(%r11) 227c: jne 22c0 <events_sysfs_show+0x6c> 227e: call 2283 <events_sysfs_show+0x2f> 227f: R_X86_64_PLT32 __x86_indirect_thunk_r11-0x4 ... 22c0: ud2
In this case the function has two indirect calls and Clang seems to prefer to emit just one ud2.
> .align 16 > .byte 0xef, 0xbe, 0xad, 0xde # 4 bytes > func: > endbr # 4 bytes
Here func is no longer aligned to 16 bytes, in case that's important.
> Further, Andrew put in the request for __attribute__((cfi_seed(blah))) > to allow distinguishing indirect functions with otherwise identical > signature; eg. cookie = hash32(blah##signature).
Sounds reasonable.
> Did I miss anything? Got anything wrong?
How would you like to deal with the 4-byte hashes in objtool? We either need to annotate all function symbols in the kernel, or we need a way to distinguish the hashes from random instructions, so we can also have functions that don't have a type hash.
Sami
| |