Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5bc2231 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Ingo Molnar
Browse files

objtool: Add retpoline validation 



David requested a objtool validation pass for CONFIG_RETPOLINE=y enabled
builds, where it validates no unannotated indirect  jumps or calls are
left.

Add an additional .discard.retpoline_safe section to allow annotating
the few indirect sites that are required and safe.

Requested-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarDavid Woodhouse <dwmw@amazon.co.uk>
Acked-by: default avatarThomas Gleixner <tglx@linutronix.de>
Acked-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 43a4525f

scripts/Makefile.build

+4 −0
Original line number Diff line number Diff line
@@ -264,6 +264,10 @@ objtool_args += --no-unreachable 
else

objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)

endif

ifdef CONFIG_RETPOLINE

  objtool_args += --retpoline

endif





ifdef CONFIG_MODVERSIONS

objtool_o = $(@D)/.tmp_$(@F)

tools/objtool/builtin-check.c

+2 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ 
#include "builtin.h"

#include "check.h"



bool no_fp, no_unreachable;

bool no_fp, no_unreachable, retpoline;



static const char * const check_usage[] = {

	"objtool check [<options>] file.o",
@@ -39,6 +39,7 @@ static const char * const check_usage[] = { 
const struct option check_options[] = {

	OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"),

	OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"),

	OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"),

	OPT_END(),

};

tools/objtool/builtin.h

+1 −1
Original line number Diff line number Diff line
@@ -20,7 +20,7 @@ 
#include <subcmd/parse-options.h>



extern const struct option check_options[];

extern bool no_fp, no_unreachable;

extern bool no_fp, no_unreachable, retpoline;



extern int cmd_check(int argc, const char **argv);

extern int cmd_orc(int argc, const char **argv);

tools/objtool/check.c

+85 −1
Original line number Diff line number Diff line
@@ -497,6 +497,7 @@ static int add_jump_destinations(struct objtool_file *file) 
			 * disguise, so convert them accordingly.

			 */

			insn->type = INSN_JUMP_DYNAMIC;

			insn->retpoline_safe = true;

			continue;

		} else {

			/* sibling call */
@@ -548,6 +549,7 @@ static int add_call_destinations(struct objtool_file *file) 
			if (!insn->call_dest && !insn->ignore) {

				WARN_FUNC("unsupported intra-function call",

					  insn->sec, insn->offset);

				if (retpoline)

					WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");

				return -1;

			}
@@ -1108,6 +1110,54 @@ static int read_unwind_hints(struct objtool_file *file) 
	return 0;

}



static int read_retpoline_hints(struct objtool_file *file)

{

	struct section *sec, *relasec;

	struct instruction *insn;

	struct rela *rela;

	int i;



	sec = find_section_by_name(file->elf, ".discard.retpoline_safe");

	if (!sec)

		return 0;



	relasec = sec->rela;

	if (!relasec) {

		WARN("missing .rela.discard.retpoline_safe section");

		return -1;

	}



	if (sec->len % sizeof(unsigned long)) {

		WARN("retpoline_safe size mismatch: %d %ld", sec->len, sizeof(unsigned long));

		return -1;

	}



	for (i = 0; i < sec->len / sizeof(unsigned long); i++) {

		rela = find_rela_by_dest(sec, i * sizeof(unsigned long));

		if (!rela) {

			WARN("can't find rela for retpoline_safe[%d]", i);

			return -1;

		}



		insn = find_insn(file, rela->sym->sec, rela->addend);

		if (!insn) {

			WARN("can't find insn for retpoline_safe[%d]", i);

			return -1;

		}



		if (insn->type != INSN_JUMP_DYNAMIC &&

		    insn->type != INSN_CALL_DYNAMIC) {

			WARN_FUNC("retpoline_safe hint not a indirect jump/call",

				  insn->sec, insn->offset);

			return -1;

		}



		insn->retpoline_safe = true;

	}



	return 0;

}



static int decode_sections(struct objtool_file *file)

{

	int ret;
@@ -1146,6 +1196,10 @@ static int decode_sections(struct objtool_file *file) 
	if (ret)

		return ret;



	ret = read_retpoline_hints(file);

	if (ret)

		return ret;



	return 0;

}
@@ -1891,6 +1945,29 @@ static int validate_unwind_hints(struct objtool_file *file) 
	return warnings;

}



static int validate_retpoline(struct objtool_file *file)

{

	struct instruction *insn;

	int warnings = 0;



	for_each_insn(file, insn) {

		if (insn->type != INSN_JUMP_DYNAMIC &&

		    insn->type != INSN_CALL_DYNAMIC)

			continue;



		if (insn->retpoline_safe)

			continue;



		WARN_FUNC("indirect %s found in RETPOLINE build",

			  insn->sec, insn->offset,

			  insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");



		warnings++;

	}



	return warnings;

}



static bool is_kasan_insn(struct instruction *insn)

{

	return (insn->type == INSN_CALL &&
@@ -2051,6 +2128,13 @@ int check(const char *_objname, bool orc) 
	if (list_empty(&file.insn_list))

		goto out;



	if (retpoline) {

		ret = validate_retpoline(&file);

		if (ret < 0)

			return ret;

		warnings += ret;

	}



	ret = validate_functions(&file);

	if (ret < 0)

		goto out;

tools/objtool/check.h

+1 −0
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ struct instruction { 
	unsigned char type;

	unsigned long immediate;

	bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;

	bool retpoline_safe;

	struct symbol *call_dest;

	struct instruction *jump_dest;

	struct instruction *first_jump_src;