From: Peter Zijlstra <peterz@infradead.org>
To: Nick Desaulniers <ndesaulniers@google.com>
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>,
x86@kernel.org, joao@overdrivepizza.com, hjl.tools@gmail.com,
jpoimboe@redhat.com, andrew.cooper3@citrix.com,
linux-kernel@vger.kernel.org, keescook@chromium.org,
samitolvanen@google.com, mark.rutland@arm.com,
alyssa.milburn@intel.com, mbenes@suse.cz, rostedt@goodmis.org,
mhiramat@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
bpf@vger.kernel.org, llvm@lists.linux.dev
Subject: Re: [PATCH v4 00/45] x86: Kernel IBT
Date: Thu, 10 Mar 2022 10:05:04 +0100 [thread overview]
Message-ID: <Yim/QJhNBCDfuxsc@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <CAKwvOdk0ROSOSDKHcyH0kP+5MFH5QnasD6kbAu8gG8CCXO7OmQ@mail.gmail.com>
On Wed, Mar 09, 2022 at 04:30:28PM -0800, Nick Desaulniers wrote:
> I observed the following error when building with
> CONFIG_LTO_CLANG_FULL=y enabled:
>
> ld.lld: error: ld-temp.o <inline asm>:7:2: symbol 'ibt_selftest_ip' is
> already defined
> ibt_selftest_ip:
> ^
>
> Seems to come from
> commit a802350ba65a ("x86/ibt: Add IBT feature, MSR and #CP handling")
>
> Commenting out the label in the inline asm, I then observed:
> vmlinux.o: warning: objtool: identify_cpu()+0x6d0: sibling call from
> callable instruction with modified stack frame
> vmlinux.o: warning: objtool: identify_cpu()+0x6e0: stack state
> mismatch: cfa1=4+64 cfa2=4+8
> These seemed to disappear when I kept CONFIG_LTO_CLANG_FULL=y but then
> disabled CONFIG_X86_KERNEL_IBT. (perhaps due to the way I hacked out
> the ibt_selftest_ip label).
Urgh.. I'm thikning this is a clang bug :/
The code in question is:
void ibt_selftest_ip(void); /* code label defined in asm below */
DEFINE_IDTENTRY_ERRORCODE(exc_control_protection)
{
/* ... */
if (unlikely(regs->ip == (unsigned long)ibt_selftest_ip)) {
regs->ax = 0;
return;
}
/* ... */
}
bool ibt_selftest(void)
{
unsigned long ret;
asm (" lea ibt_selftest_ip(%%rip), %%rax\n\t"
ANNOTATE_RETPOLINE_SAFE
" jmp *%%rax\n\t"
"ibt_selftest_ip:\n\t"
UNWIND_HINT_FUNC
ANNOTATE_NOENDBR
" nop\n\t"
: "=a" (ret) : : "memory");
return !ret;
}
There is only a single definition of that symbol, the one in the asm.
The other is a declaration, which is used in the exception handler to
compare against regs->ip.
So what this code does is trigger an explicit #CP and special case that
in the handler. For that the handler needs to know the special IP that
will trigger the failure, this is cummunicated with that symbol.
> Otherwise defconfig and CONFIG_LTO_CLANG_THIN=y both built and booted
> in a vm WITHOUT IBT support.
>
> Any idea what's the status of IBT emulation in QEMU, and if it exists,
> what's the necessary `-cpu` flag to enable it?
I have a very ugly kvm patch that goes with a very ugly qemu patch to
make it work. I would very much not recommend those getting merged.
Someone with some actual kvm/qemu foo should do one. The complicating
factor is that IA32_S_CET also contains SHSTK enable bits, so a straight
passthrough like I use relies on the guest never setting those bits or
keeping the pieces. It either needs to filter the MSR or implement the
full CET mess.
next prev parent reply other threads:[~2022-03-10 9:05 UTC|newest]
Thread overview: 193+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-08 15:30 [PATCH v4 00/45] x86: Kernel IBT Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 01/45] static_call: Avoid building empty .static_call_sites Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 02/45] objtool: Add --dry-run Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 03/45] objtool: Default ignore INT3 for unreachable Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 04/45] objtool,efi: Update __efi64_thunk annotation Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-09 8:35 ` [PATCH v4 04/45] " Miroslav Benes
2022-03-15 10:44 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 05/45] objtool: Have WARN_FUNC fall back to sym+off Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 06/45] x86/ibt: Base IBT bits Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 07/45] x86/ibt: Add ANNOTATE_NOENDBR Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 08/45] x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 09/45] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 10/45] x86/entry: Cleanup PARAVIRT Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 11/45] x86/entry,xen: Early rewrite of restore_regs_and_return_to_kernel() Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 12/45] x86/ibt,xen: Sprinkle the ENDBR Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 13/45] x86/ibt,entry: Sprinkle ENDBR dust Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 14/45] x86/linkage: Add ENDBR to SYM_FUNC_START*() Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 15/45] x86/ibt,paravirt: Sprinkle ENDBR Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 16/45] x86/ibt,crypto: Add ENDBR for the jump-table entries Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 17/45] x86/ibt,kvm: Add ENDBR to fastops Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 18/45] x86/ibt,ftrace: Search for __fentry__ location Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 19/45] x86/livepatch: Validate " Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-09 8:58 ` [PATCH v4 19/45] " Miroslav Benes
2022-03-15 10:44 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 20/45] x86/ibt,ftrace: Make function-graph play nice Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 21/45] x86/ibt,kprobes: Cure sym+0 equals fentry woes Peter Zijlstra
2022-03-09 7:55 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 22/45] x86/ibt,bpf: Add ENDBR instructions to prologue and trampoline Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:44 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 23/45] x86/ibt,ftrace: Add ENDBR to samples/ftrace Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 24/45] x86/ibt: Add IBT feature, MSR and #CP handling Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-09 13:56 ` [PATCH v4 24/45] " Andrew Cooper
2022-03-15 10:43 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 25/45] x86/ibt,kexec: Disable CET on kexec Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 26/45] x86/alternative: Simplify int3_selftest_ip Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 27/45] x86/ibt: Disable IBT around firmware Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 28/45] x86/bugs: Disable Retpoline when IBT Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 29/45] x86/ibt: Annotate text references Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-22 4:43 ` [PATCH v4 29/45] " Masami Hiramatsu
2022-03-22 4:45 ` Alexei Starovoitov
2022-03-08 15:30 ` [PATCH v4 30/45] x86/ibt,ftrace: Annotate ftrace code patching Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 31/45] x86/ibt,sev: Annotations Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 32/45] x86/ibt: Dont generate ENDBR in .discard.text Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 33/45] x86/ibt: Ensure module init/exit points have references Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 34/45] objtool: Rename --duplicate to --lto Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 35/45] objtool: Ignore extra-symbol code Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 36/45] x86: Mark stop_this_cpu() __noreturn Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 37/45] exit: Mark do_group_exit() __noreturn Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 38/45] objtool: Rework ASM_REACHABLE Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 39/45] x86: Annotate call_on_stack() Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 40/45] Kbuild: Allow whole module objtool runs Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 41/45] objtool: Read the NOENDBR annotation Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 42/45] objtool: Add IBT/ENDBR decoding Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 43/45] objtool: Validate IBT assumptions Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 44/45] objtool: Find unused ENDBR instructions Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-15 15:39 ` David Laight
2022-03-17 22:22 ` Josh Poimboeuf
2022-03-18 10:49 ` Peter Zijlstra
2022-03-08 15:30 ` [PATCH v4 45/45] x86/alternative: Use .ibt_endbr_seal to seal indirect calls Peter Zijlstra
2022-03-09 7:54 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` tip-bot2 for Peter Zijlstra
2022-03-08 20:00 ` [PATCH v4 00/45] x86: Kernel IBT Alexei Starovoitov
2022-03-08 22:01 ` Peter Zijlstra
2022-03-08 22:32 ` Peter Zijlstra
2022-03-09 1:02 ` Peter Zijlstra
2022-03-09 19:09 ` Alexei Starovoitov
2022-03-10 9:35 ` Peter Zijlstra
2022-03-10 13:47 ` Peter Zijlstra
2022-03-10 14:37 ` Steven Rostedt
2022-03-11 15:23 ` Peter Zijlstra
2022-03-10 16:29 ` Peter Zijlstra
2022-03-11 10:40 ` Peter Zijlstra
2022-03-11 17:09 ` Alexei Starovoitov
2022-03-12 15:44 ` Peter Zijlstra
2022-03-13 1:33 ` Alexei Starovoitov
2022-03-13 8:52 ` Peter Zijlstra
2022-03-14 14:59 ` Peter Zijlstra
2022-03-15 8:15 ` Peter Zijlstra
2022-03-15 16:28 ` Masahiro Yamada
2022-03-17 19:44 ` Peter Zijlstra
2022-03-18 2:07 ` David Laight
2022-03-17 18:15 ` Masahiro Yamada
2022-03-17 19:52 ` Peter Zijlstra
2022-03-18 15:36 ` [tip: x86/core] kbuild: Fixup the IBT kbuild changes tip-bot2 for Peter Zijlstra
2022-03-18 16:15 ` Masahiro Yamada
2022-03-22 20:24 ` tip-bot2 for Peter Zijlstra
2022-03-15 16:26 ` [PATCH v4 00/45] x86: Kernel IBT Masahiro Yamada
2022-03-17 19:36 ` Peter Zijlstra
2022-03-14 15:33 ` Peter Zijlstra
2022-03-15 10:43 ` [tip: x86/core] x86: Annotate idtentry_df() tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` [tip: x86/core] x86,objtool: Move the ASM_REACHABLE annotation to objtool.h tip-bot2 for Peter Zijlstra
2022-03-15 10:43 ` [tip: x86/core] x86: Mark __invalid_creds() __noreturn tip-bot2 for Peter Zijlstra
2022-03-14 20:44 ` [PATCH v4 00/45] x86: Kernel IBT Kumar Kartikeya Dwivedi
2022-03-15 9:00 ` Peter Zijlstra
2022-03-15 10:05 ` Kumar Kartikeya Dwivedi
2022-03-15 10:07 ` Peter Zijlstra
2022-03-15 10:39 ` Peter Zijlstra
2022-03-16 9:35 ` Peter Zijlstra
2022-03-16 11:12 ` Kumar Kartikeya Dwivedi
2022-03-15 18:26 ` Alexei Starovoitov
2022-03-17 20:27 ` Peter Zijlstra
2022-03-11 14:40 ` [tip: x86/core] x86,ftrace: Fix modify_ftrace_direct() tip-bot2 for Peter Zijlstra
2022-03-10 0:30 ` [PATCH v4 00/45] x86: Kernel IBT Nick Desaulniers
2022-03-10 9:05 ` Peter Zijlstra [this message]
2022-03-10 9:22 ` David Laight
2022-03-10 10:16 ` Peter Zijlstra
2022-03-10 20:49 ` Nick Desaulniers
2022-03-11 14:40 ` [tip: x86/core] x86: Fix {int3,ibt}_selftest() vs LTO tip-bot2 for Peter Zijlstra
2022-03-08 20:06 ` [PATCH v4 00/45] x86: Kernel IBT Josh Poimboeuf
2022-03-09 6:57 ` Josh Poimboeuf
2022-03-09 13:37 ` David Laight
2022-03-10 14:27 ` Peter Zijlstra
2022-03-09 12:51 ` Miroslav Benes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Yim/QJhNBCDfuxsc@hirez.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=alexei.starovoitov@gmail.com \
--cc=alyssa.milburn@intel.com \
--cc=andrew.cooper3@citrix.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=hjl.tools@gmail.com \
--cc=joao@overdrivepizza.com \
--cc=jpoimboe@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=mark.rutland@arm.com \
--cc=mbenes@suse.cz \
--cc=mhiramat@kernel.org \
--cc=ndesaulniers@google.com \
--cc=rostedt@goodmis.org \
--cc=samitolvanen@google.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.