Messages in this thread Patch in this message | | | Date | Thu, 14 Apr 2022 11:25:05 -0700 | From | Josh Poimboeuf <> | Subject | Re: [PATCH 10/18] objtool: Extricate ibt from stack validation |
| |
On Thu, Apr 14, 2022 at 10:05:53AM -0700, Josh Poimboeuf wrote: > On Thu, Apr 14, 2022 at 06:38:16PM +0200, Peter Zijlstra wrote: > > On Thu, Apr 14, 2022 at 08:44:49AM -0700, Josh Poimboeuf wrote: > > > > > Ok. That was subtle, it needs a comment or two. I had the distinct > > > feeling I was introducing a bug, then I got distracted ;-) > > > > Right, lemme try and not forget to write one ;-) > > I'm rewriting the code anyway, I'll add some comments. > > > > Doesn't the compiler give those special cases ENDBR anyway? Just > > > wondering why we avoid the warning for those. > > > > Sure, but this is about not scribbling that ENDBR with a NOP. > > Right, but it only prints warnings for data sections, despite marking > others: > > - dest = validate_ibt_reloc(file, reloc); > - if (is_data && dest && !dest->noendbr) > - warn_noendbr("data ", sec, reloc->offset, dest);
How about this? This way it doesn't silence warnings for non .data/.rodata, as other sections (including ksymtab) can also have valid function pointers. It also caught a bug(?) in putuser.S, as some of the exported inner labels didn't have ENDBR.
diff --git a/arch/x86/include/asm/static_call.h b/arch/x86/include/asm/static_call.h index 2455d721503e..2d8dacd02643 100644 --- a/arch/x86/include/asm/static_call.h +++ b/arch/x86/include/asm/static_call.h @@ -26,6 +26,7 @@ ".align 4 \n" \ ".globl " STATIC_CALL_TRAMP_STR(name) " \n" \ STATIC_CALL_TRAMP_STR(name) ": \n" \ + ANNOTATE_NOENDBR \ insns " \n" \ ".byte 0x53, 0x43, 0x54 \n" \ ".type " STATIC_CALL_TRAMP_STR(name) ", @function \n" \ diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S index ecb2049c1273..b7dfd60243b7 100644 --- a/arch/x86/lib/putuser.S +++ b/arch/x86/lib/putuser.S @@ -48,6 +48,7 @@ SYM_FUNC_START(__put_user_1) cmp %_ASM_BX,%_ASM_CX jae .Lbad_put_user SYM_INNER_LABEL(__put_user_nocheck_1, SYM_L_GLOBAL) + ENDBR ASM_STAC 1: movb %al,(%_ASM_CX) xor %ecx,%ecx @@ -62,6 +63,7 @@ SYM_FUNC_START(__put_user_2) cmp %_ASM_BX,%_ASM_CX jae .Lbad_put_user SYM_INNER_LABEL(__put_user_nocheck_2, SYM_L_GLOBAL) + ENDBR ASM_STAC 2: movw %ax,(%_ASM_CX) xor %ecx,%ecx @@ -76,6 +78,7 @@ SYM_FUNC_START(__put_user_4) cmp %_ASM_BX,%_ASM_CX jae .Lbad_put_user SYM_INNER_LABEL(__put_user_nocheck_4, SYM_L_GLOBAL) + ENDBR ASM_STAC 3: movl %eax,(%_ASM_CX) xor %ecx,%ecx @@ -90,6 +93,7 @@ SYM_FUNC_START(__put_user_8) cmp %_ASM_BX,%_ASM_CX jae .Lbad_put_user SYM_INNER_LABEL(__put_user_nocheck_8, SYM_L_GLOBAL) + ENDBR ASM_STAC 4: mov %_ASM_AX,(%_ASM_CX) #ifdef CONFIG_X86_32 diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S index 5f87bab4fb8d..b2b2366885a2 100644 --- a/arch/x86/lib/retpoline.S +++ b/arch/x86/lib/retpoline.S @@ -31,6 +31,7 @@ .align RETPOLINE_THUNK_SIZE SYM_INNER_LABEL(__x86_indirect_thunk_\reg, SYM_L_GLOBAL) UNWIND_HINT_EMPTY + ANNOTATE_NOENDBR ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *%\reg), \ __stringify(RETPOLINE \reg), X86_FEATURE_RETPOLINE, \ @@ -55,7 +56,6 @@ SYM_INNER_LABEL(__x86_indirect_thunk_\reg, SYM_L_GLOBAL) .align RETPOLINE_THUNK_SIZE SYM_CODE_START(__x86_indirect_thunk_array) - ANNOTATE_NOENDBR // apply_retpolines #define GEN(reg) THUNK reg #include <asm/GEN-for-each-reg.h> diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S index ac17196e2518..3a2cd93bf059 100644 --- a/arch/x86/xen/xen-head.S +++ b/arch/x86/xen/xen-head.S @@ -45,6 +45,7 @@ SYM_CODE_END(hypercall_page) __INIT SYM_CODE_START(startup_xen) UNWIND_HINT_EMPTY + ANNOTATE_NOENDBR cld /* Clear .bss */ diff --git a/tools/objtool/check.c b/tools/objtool/check.c index b09c416432b6..10e375c84088 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -3794,7 +3794,10 @@ static int validate_ibt_data_reloc(struct objtool_file *file, return 1; } - +/* + * Validate IBT rules and mark used ENDBR instructions so the non-used ones can + * be sealed later by create_ibt_endbr_seal_sections(). + */ static int validate_ibt(struct objtool_file *file) { struct section *sec; @@ -3807,12 +3810,36 @@ static int validate_ibt(struct objtool_file *file) for_each_sec(file, sec) { - if (!strstr(sec->name, ".data") && !strstr(sec->name, ".rodata")) + /* Already done by validate_ibt_insn() */ + if (sec->sh.sh_flags & SHF_EXECINSTR) continue; if (!sec->reloc) continue; + /* + * These sections can reference text addresses, but not with + * the intent to indirect branch to them. + */ + if (!strncmp(sec->name, ".discard", 8) || + !strncmp(sec->name, ".debug", 6) || + !strcmp(sec->name, ".altinstructions") || + !strcmp(sec->name, ".ibt_endbr_seal") || + !strcmp(sec->name, ".orc_unwind_ip") || + !strcmp(sec->name, ".parainstructions") || + !strcmp(sec->name, ".retpoline_sites") || + !strcmp(sec->name, ".smp_locks") || + !strcmp(sec->name, ".static_call_sites") || + !strcmp(sec->name, ".static_call_tramp_key") || + !strcmp(sec->name, "_error_injection_whitelist") || + !strcmp(sec->name, "_kprobe_blacklist") || + !strcmp(sec->name, "__bug_table") || + !strcmp(sec->name, "__ex_table") || + !strcmp(sec->name, "__jump_table") || + !strcmp(sec->name, "__mcount_loc") || + !strcmp(sec->name, "__tracepoints")) + continue; + list_for_each_entry(reloc, &sec->reloc->reloc_list, list) warnings += validate_ibt_data_reloc(file, reloc); }
| |