From: Peter Zijlstra <peterz@infradead.org>
To: David Woodhouse <dwmw2@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Josh Poimboeuf <jpoimboe@redhat.com>
Cc: linux-kernel@vger.kernel.org, Dave Hansen <dave.hansen@intel.com>,
Ashok Raj <ashok.raj@intel.com>,
Tim Chen <tim.c.chen@linux.intel.com>,
Andy Lutomirski <luto@kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Greg KH <gregkh@linuxfoundation.org>,
Andrea Arcangeli <aarcange@redhat.com>,
Andi Kleen <ak@linux.intel.com>,
Arjan Van De Ven <arjan.van.de.ven@intel.com>,
Dan Williams <dan.j.williams@intel.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Jun Nakajima <jun.nakajima@intel.com>,
Asit Mallick <asit.k.mallick@intel.com>,
Jason Baron <jbaron@akamai.com>,
Peter Zijlstra <peterz@infradead.org>,
Borislav Petkov <bp@alien8.de>
Subject: [PATCH 13/24] objtool: Implement base jump_assert support
Date: Tue, 23 Jan 2018 16:25:52 +0100 [thread overview]
Message-ID: <20180123152638.759469449@infradead.org> (raw)
In-Reply-To: 20180123152539.374360046@infradead.org
[-- Attachment #1: peter_zijlstra-q-objtool_vs_jump_label.patch --]
[-- Type: text/plain, Size: 4058 bytes --]
Implement a jump_label assertion that asserts that the code location
is indeed only reachable through a static_branch. Because if GCC is
absolutely retaded it could generate code like:
xor rax,rax
NOP/JMP 1f
mov $1, rax
1:
test rax,rax
jz 2f
<do-code>
2:
instead of the sensible:
NOP/JMP 1f
<do-code>
1:
This implements objtool infrastructure for ensuring the code ends up
sane, since we'll rely on that for correctness and security.
We tag the instructions after the static branch with static_jump_dest=true;
that is the instruction after the NOP and the instruction at the
JMP+disp site.
Then, when we read the .discard.jump_assert section, we assert that
each entry points to an instruction that has static_jump_dest set.
With this we can assert that the code emitted for the if statement
ends up at the static jump location and nothing untowards happened.
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
---
tools/objtool/check.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++--
tools/objtool/check.h | 2 -
2 files changed, 69 insertions(+), 3 deletions(-)
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -686,8 +686,17 @@ static int handle_jump_alt(struct objtoo
struct instruction *orig_insn,
struct instruction **new_insn)
{
- if (orig_insn->type == INSN_NOP)
+ struct instruction *next_insn = list_next_entry(orig_insn, list);
+
+ if (orig_insn->type == INSN_NOP) {
+ /*
+ * If orig_insn is a NOP, then new_insn is the branch target
+ * for when it would've been a JMP.
+ */
+ next_insn->static_jump_dest = true;
+ (*new_insn)->static_jump_dest = true;
return 0;
+ }
if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
WARN_FUNC("unsupported instruction at jump label",
@@ -695,7 +704,16 @@ static int handle_jump_alt(struct objtoo
return -1;
}
- *new_insn = list_next_entry(orig_insn, list);
+ /*
+ * Otherwise, orig_insn is a JMP and it will have orig_insn->jump_dest.
+ * In this case we'll effectively NOP the alt by pointing new_insn at
+ * next_insn.
+ */
+ orig_insn->jump_dest->static_jump_dest = true;
+ next_insn->static_jump_dest = true;
+
+ *new_insn = next_insn;
+
return 0;
}
@@ -1114,6 +1132,50 @@ static int read_retpoline_hints(struct o
return 0;
}
+static int assert_static_jumps(struct objtool_file *file)
+{
+ struct section *sec, *relasec;
+ struct instruction *insn;
+ struct rela *rela;
+ int i;
+
+ sec = find_section_by_name(file->elf, ".discard.jump_assert");
+ if (!sec)
+ return 0;
+
+ relasec = sec->rela;
+ if (!relasec) {
+ WARN("missing .rela.discard.jump_assert section");
+ return -1;
+ }
+
+ if (sec->len % sizeof(unsigned long)) {
+ WARN("jump_assert size mismatch: %d %ld", sec->len, sizeof(unsigned long));
+ return -1;
+ }
+
+ for (i = 0; i < sec->len / sizeof(unsigned long); i++) {
+ rela = find_rela_by_dest(sec, i * sizeof(unsigned long));
+ if (!rela) {
+ WARN("can't find rela for jump_assert[%d]", i);
+ return -1;
+ }
+
+ insn = find_insn(file, rela->sym->sec, rela->addend);
+ if (!insn) {
+ WARN("can't find insn for jump_assert[%d]", i);
+ return -1;
+ }
+
+ if (!insn->static_jump_dest) {
+ WARN_FUNC("static assert FAIL", insn->sec, insn->offset);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
static int decode_sections(struct objtool_file *file)
{
int ret;
@@ -2073,6 +2135,10 @@ int check(const char *_objname, bool orc
goto out;
warnings += ret;
+ ret = assert_static_jumps(&file);
+ if (ret < 0)
+ return ret;
+
if (list_empty(&file.insn_list))
goto out;
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -45,7 +45,7 @@ struct instruction {
unsigned char type;
unsigned long immediate;
bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
- bool retpoline_safe;
+ bool retpoline_safe, static_jump_dest;
struct symbol *call_dest;
struct instruction *jump_dest;
struct list_head alts;
next prev parent reply other threads:[~2018-01-23 15:25 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-23 15:25 [PATCH 00/24] objtool: retpoline and asm-goto validation Peter Zijlstra
2018-01-23 15:25 ` [PATCH 01/24] objtool: Use existing global variables for options Peter Zijlstra
2018-01-23 15:25 ` [PATCH 02/24] objtool: Add retpoline validation Peter Zijlstra
2018-01-23 18:21 ` Borislav Petkov
2018-01-26 9:54 ` David Woodhouse
2018-01-23 15:25 ` [PATCH 03/24] x86/paravirt: Annotate indirect calls Peter Zijlstra
2018-01-25 10:02 ` David Woodhouse
2018-01-25 10:22 ` Peter Zijlstra
2018-01-25 10:26 ` Juergen Gross
2018-01-25 10:52 ` David Woodhouse
2018-01-25 11:35 ` Peter Zijlstra
2018-01-26 9:57 ` David Woodhouse
2018-01-29 17:58 ` Josh Poimboeuf
2018-01-29 18:09 ` David Woodhouse
2018-01-29 18:17 ` Peter Zijlstra
2018-01-29 18:38 ` Josh Poimboeuf
2018-01-29 19:21 ` Peter Zijlstra
2018-01-30 16:02 ` Josh Poimboeuf
2018-01-31 4:13 ` [PATCH] x86/paravirt: Remove 'noreplace-paravirt' cmdline option Josh Poimboeuf
2018-01-31 5:59 ` Juergen Gross
2018-01-31 9:42 ` [tip:x86/pti] " tip-bot for Josh Poimboeuf
2018-01-23 15:25 ` [PATCH 04/24] x86,nospec: Annotate indirect calls/jumps Peter Zijlstra
2018-01-26 10:19 ` David Woodhouse
2018-01-29 17:44 ` Peter Zijlstra
2018-01-23 15:25 ` [PATCH 05/24] x86: Annotate indirect jump in head_64.S Peter Zijlstra
2018-01-26 10:24 ` David Woodhouse
2018-01-23 15:25 ` [PATCH 06/24] x86,kvm: Fix indirect calls in emulator Peter Zijlstra
2018-01-23 20:28 ` Borislav Petkov
2018-01-23 20:48 ` David Woodhouse
2018-01-24 10:35 ` Peter Zijlstra
2018-01-24 10:43 ` Paolo Bonzini
2018-01-25 9:34 ` Peter Zijlstra
2018-01-25 9:49 ` David Woodhouse
2018-01-26 10:57 ` Paolo Bonzini
2018-01-23 15:25 ` [PATCH 07/24] x86,vmx: Fix indirect call Peter Zijlstra
2018-01-25 9:36 ` Peter Zijlstra
2018-01-23 15:25 ` [PATCH 08/24] x86,sme: Annotate " Peter Zijlstra
2018-01-26 10:37 ` David Woodhouse
2018-01-29 17:49 ` Peter Zijlstra
2018-01-29 17:50 ` Peter Zijlstra
2018-01-31 9:29 ` Peter Zijlstra
2018-01-31 15:04 ` Josh Poimboeuf
2018-01-31 16:00 ` Peter Zijlstra
2018-01-23 15:25 ` [PATCH 09/24] jump_label: Add branch hints to static_branch_{un,}likely() Peter Zijlstra
2018-01-24 18:46 ` Borislav Petkov
2018-01-23 15:25 ` [PATCH 10/24] sched: Optimize ttwu_stat() Peter Zijlstra
2018-01-23 15:25 ` [PATCH 11/24] x86: Reindent _static_cpu_has Peter Zijlstra
2018-01-23 15:25 ` [PATCH 12/24] x86: Update _static_cpu_has to use all named variables Peter Zijlstra
2018-01-25 19:31 ` Borislav Petkov
2018-01-23 15:25 ` Peter Zijlstra [this message]
2018-01-26 10:45 ` [PATCH 13/24] objtool: Implement base jump_assert support David Woodhouse
2018-01-23 15:25 ` [PATCH 14/24] x86: Add a type field to alt_instr Peter Zijlstra
2018-01-23 15:25 ` [PATCH 15/24] x86: Annotate static_cpu_has alternative Peter Zijlstra
2018-01-23 15:25 ` [PATCH 16/24] objtool: Implement jump_assert for _static_cpu_has() Peter Zijlstra
2018-01-23 15:25 ` [PATCH 17/24] objtool: Introduce special_type Peter Zijlstra
2018-01-23 15:25 ` [PATCH 18/24] objtool: More complex static jump implementation Peter Zijlstra
2018-01-23 15:25 ` [PATCH 19/24] objtool: Even more complex static block checks Peter Zijlstra
2018-01-23 15:25 ` [PATCH 20/24] objtool: Another static block fail Peter Zijlstra
2018-01-29 22:52 ` Josh Poimboeuf
2018-01-30 9:56 ` Peter Zijlstra
2018-01-31 3:12 ` Josh Poimboeuf
2018-01-31 10:01 ` Peter Zijlstra
2018-01-31 10:07 ` David Woodhouse
2018-01-31 10:27 ` Peter Zijlstra
2018-01-23 15:26 ` [PATCH 21/24] objtool: Skip static assert when KCOV/KASAN Peter Zijlstra
2018-01-23 15:26 ` [PATCH 22/24] x86/jump_label: Implement arch_static_assert() Peter Zijlstra
2018-01-23 15:26 ` [PATCH 23/24] x86: Force asm-goto Peter Zijlstra
2018-01-23 15:26 ` [PATCH 24/24] x86: Remove FAST_FEATURE_TESTS Peter Zijlstra
2018-01-23 15:42 ` [PATCH 00/24] objtool: retpoline and asm-goto validation Peter Zijlstra
2018-01-23 15:57 ` David Woodhouse
2018-01-23 16:03 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180123152638.759469449@infradead.org \
--to=peterz@infradead.org \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=arjan.van.de.ven@intel.com \
--cc=ashok.raj@intel.com \
--cc=asit.k.mallick@intel.com \
--cc=bp@alien8.de \
--cc=dan.j.williams@intel.com \
--cc=dave.hansen@intel.com \
--cc=dwmw2@infradead.org \
--cc=gregkh@linuxfoundation.org \
--cc=jbaron@akamai.com \
--cc=jpoimboe@redhat.com \
--cc=jun.nakajima@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=pbonzini@redhat.com \
--cc=tglx@linutronix.de \
--cc=tim.c.chen@linux.intel.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).