From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2091DC433F5 for ; Thu, 5 May 2022 07:36:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345355AbiEEHk1 (ORCPT ); Thu, 5 May 2022 03:40:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345357AbiEEHkY (ORCPT ); Thu, 5 May 2022 03:40:24 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ACF0248E59; Thu, 5 May 2022 00:36:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=wcYnBFlZFnuL55r/7R4vP4SWucs4Cfa2ZGuWm0/JeN4=; b=Mef7Zg8e6eUtD1INYhQtlDQDK2 TnLMqT87vd+VUwl51mcl7AmONX5pV/tgJ0uw7oTAwA7caDwbAukT4DnHzM8KLsHAsS9h9m+DgpXuG +vZiTI4lrPOlk+6McJj9+HclMTCtZGIETMOAMT5HqfbSX5vWN6kdGECWPnC2bc6QU14ROKZ/njaTk P/frbgH2tbsIm+YynyjOXa/y3RbefwHuSkpyLgOuwHCTiJpEqGhu595W7vOTiU7+3kkTAFKsBRGbx 2HEU+isTfSeF35GTlMtDZkhil0YktLztT2YFIxRy6Xht0XtGFMZdpMqVPuxA3tnx+vbxF/Ljm5v+Z GEa2qq6g==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=worktop.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1nmW2D-00HN1E-Dk; Thu, 05 May 2022 07:36:25 +0000 Received: by worktop.programming.kicks-ass.net (Postfix, from userid 1000) id EBDE8980DFE; Thu, 5 May 2022 09:36:22 +0200 (CEST) Date: Thu, 5 May 2022 09:36:22 +0200 From: Peter Zijlstra To: Sami Tolvanen Cc: Peter Collingbourne , Josh Poimboeuf , Joao Moreira , LKML , linux-hardening@vger.kernel.org, andrew.cooper3@citrix.com, Kees Cook , Mark Rutland , hjl.tools@gmail.com, alyssa.milburn@linux.intel.com, Nick Desaulniers , gabriel.gomes@linux.intel.com, rick.p.edgecombe@intel.com Subject: Re: [RFC PATCH 01/11] x86: kernel FineIBT Message-ID: <20220505073622.GC2501@worktop.programming.kicks-ass.net> References: <20220420004241.2093-1-joao@overdrivepizza.com> <20220420004241.2093-2-joao@overdrivepizza.com> <20220429013704.4n4lmadpstdioe7a@treble> <20220503220244.vyz5flk3gg3y6rbw@treble> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 04, 2022 at 05:28:57PM -0700, Sami Tolvanen wrote: > On Wed, May 4, 2022 at 11:17 AM Peter Zijlstra wrote: > > __cfi_\sym: __cfi_\sym: > > int3; int3 # 2 > > endbr # 4 mov \hash, %eax # 5 > > call __fineibt_\hash # 5 int3; int3 # 2 > > \sym: \sym: > > OK, that looks reasonable to me. > > > It seems to preserve the properties of the last one in that direct calls > > will already be correct and we don't need linker fixups, and objtool can > > simply parse the preamble as regular instructions without needing > > further help. > > Wouldn't objtool still print out unreachable instruction warnings here? Depends a bit on what kind of symbol they end up being, if they're STT_FUNC we'll probably get the complaint that it falls through into the next symbol, while if they're STT_NOTYPE then yes, we'll get the unreachable thing. So either way we need to special case the __cfi_\sym things anyway. But that should be relatively straight forward. I think I would lean towards making then STT_FUNC (they really are for FineIBT anyway) and then supressing the fallthrough warning for all functions that start with "__cfi_". This way we get an ORC entry for them and the unwinder will be happy.