objtool: Add retpoline validation
David requested a objtool validation pass for CONFIG_RETPOLINE=y enabled builds, where it validates no unannotated indirect jumps or calls are left. Add an additional .discard.retpoline_safe section to allow annotating the few indirect sites that are required and safe. Requested-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Acked-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dan Williams <dan.j.williams@intel.com> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
parent
43a4525f80
commit
b5bc2231b8
|
@ -264,6 +264,10 @@ objtool_args += --no-unreachable
|
|||
else
|
||||
objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
|
||||
endif
|
||||
ifdef CONFIG_RETPOLINE
|
||||
objtool_args += --retpoline
|
||||
endif
|
||||
|
||||
|
||||
ifdef CONFIG_MODVERSIONS
|
||||
objtool_o = $(@D)/.tmp_$(@F)
|
||||
|
|
|
@ -29,7 +29,7 @@
|
|||
#include "builtin.h"
|
||||
#include "check.h"
|
||||
|
||||
bool no_fp, no_unreachable;
|
||||
bool no_fp, no_unreachable, retpoline;
|
||||
|
||||
static const char * const check_usage[] = {
|
||||
"objtool check [<options>] file.o",
|
||||
|
@ -39,6 +39,7 @@ static const char * const check_usage[] = {
|
|||
const struct option check_options[] = {
|
||||
OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"),
|
||||
OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"),
|
||||
OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"),
|
||||
OPT_END(),
|
||||
};
|
||||
|
||||
|
|
|
@ -20,7 +20,7 @@
|
|||
#include <subcmd/parse-options.h>
|
||||
|
||||
extern const struct option check_options[];
|
||||
extern bool no_fp, no_unreachable;
|
||||
extern bool no_fp, no_unreachable, retpoline;
|
||||
|
||||
extern int cmd_check(int argc, const char **argv);
|
||||
extern int cmd_orc(int argc, const char **argv);
|
||||
|
|
|
@ -497,6 +497,7 @@ static int add_jump_destinations(struct objtool_file *file)
|
|||
* disguise, so convert them accordingly.
|
||||
*/
|
||||
insn->type = INSN_JUMP_DYNAMIC;
|
||||
insn->retpoline_safe = true;
|
||||
continue;
|
||||
} else {
|
||||
/* sibling call */
|
||||
|
@ -548,7 +549,8 @@ static int add_call_destinations(struct objtool_file *file)
|
|||
if (!insn->call_dest && !insn->ignore) {
|
||||
WARN_FUNC("unsupported intra-function call",
|
||||
insn->sec, insn->offset);
|
||||
WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
|
||||
if (retpoline)
|
||||
WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
@ -1108,6 +1110,54 @@ static int read_unwind_hints(struct objtool_file *file)
|
|||
return 0;
|
||||
}
|
||||
|
||||
static int read_retpoline_hints(struct objtool_file *file)
|
||||
{
|
||||
struct section *sec, *relasec;
|
||||
struct instruction *insn;
|
||||
struct rela *rela;
|
||||
int i;
|
||||
|
||||
sec = find_section_by_name(file->elf, ".discard.retpoline_safe");
|
||||
if (!sec)
|
||||
return 0;
|
||||
|
||||
relasec = sec->rela;
|
||||
if (!relasec) {
|
||||
WARN("missing .rela.discard.retpoline_safe section");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (sec->len % sizeof(unsigned long)) {
|
||||
WARN("retpoline_safe size mismatch: %d %ld", sec->len, sizeof(unsigned long));
|
||||
return -1;
|
||||
}
|
||||
|
||||
for (i = 0; i < sec->len / sizeof(unsigned long); i++) {
|
||||
rela = find_rela_by_dest(sec, i * sizeof(unsigned long));
|
||||
if (!rela) {
|
||||
WARN("can't find rela for retpoline_safe[%d]", i);
|
||||
return -1;
|
||||
}
|
||||
|
||||
insn = find_insn(file, rela->sym->sec, rela->addend);
|
||||
if (!insn) {
|
||||
WARN("can't find insn for retpoline_safe[%d]", i);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (insn->type != INSN_JUMP_DYNAMIC &&
|
||||
insn->type != INSN_CALL_DYNAMIC) {
|
||||
WARN_FUNC("retpoline_safe hint not a indirect jump/call",
|
||||
insn->sec, insn->offset);
|
||||
return -1;
|
||||
}
|
||||
|
||||
insn->retpoline_safe = true;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int decode_sections(struct objtool_file *file)
|
||||
{
|
||||
int ret;
|
||||
|
@ -1146,6 +1196,10 @@ static int decode_sections(struct objtool_file *file)
|
|||
if (ret)
|
||||
return ret;
|
||||
|
||||
ret = read_retpoline_hints(file);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -1891,6 +1945,29 @@ static int validate_unwind_hints(struct objtool_file *file)
|
|||
return warnings;
|
||||
}
|
||||
|
||||
static int validate_retpoline(struct objtool_file *file)
|
||||
{
|
||||
struct instruction *insn;
|
||||
int warnings = 0;
|
||||
|
||||
for_each_insn(file, insn) {
|
||||
if (insn->type != INSN_JUMP_DYNAMIC &&
|
||||
insn->type != INSN_CALL_DYNAMIC)
|
||||
continue;
|
||||
|
||||
if (insn->retpoline_safe)
|
||||
continue;
|
||||
|
||||
WARN_FUNC("indirect %s found in RETPOLINE build",
|
||||
insn->sec, insn->offset,
|
||||
insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
|
||||
|
||||
warnings++;
|
||||
}
|
||||
|
||||
return warnings;
|
||||
}
|
||||
|
||||
static bool is_kasan_insn(struct instruction *insn)
|
||||
{
|
||||
return (insn->type == INSN_CALL &&
|
||||
|
@ -2051,6 +2128,13 @@ int check(const char *_objname, bool orc)
|
|||
if (list_empty(&file.insn_list))
|
||||
goto out;
|
||||
|
||||
if (retpoline) {
|
||||
ret = validate_retpoline(&file);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
warnings += ret;
|
||||
}
|
||||
|
||||
ret = validate_functions(&file);
|
||||
if (ret < 0)
|
||||
goto out;
|
||||
|
|
|
@ -45,6 +45,7 @@ struct instruction {
|
|||
unsigned char type;
|
||||
unsigned long immediate;
|
||||
bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
|
||||
bool retpoline_safe;
|
||||
struct symbol *call_dest;
|
||||
struct instruction *jump_dest;
|
||||
struct instruction *first_jump_src;
|
||||
|
|
Loading…
Reference in a new issue