From patchwork Wed Nov 2 09:20:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 14161 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp3509561wru; Wed, 2 Nov 2022 02:28:09 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6eM3jv6Kwoi0Mii79toig9NEa+y7S66gT83vX2yF/l3/EVji/Nkk0uDElWlBdv745e52Eb X-Received: by 2002:a17:907:763a:b0:7ad:e517:246 with SMTP id jy26-20020a170907763a00b007ade5170246mr10654144ejc.128.1667381289153; Wed, 02 Nov 2022 02:28:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667381289; cv=none; d=google.com; s=arc-20160816; b=zR9UFgixLZ1pCaYTzIeZwERgqAL3oVlUuF5H3fWm6yzmYGSStaMc/h5Tv0qkJAziI2 Uo6dNbQUs8M1tQWSONH85daqGq6Djs9f4HUt7bV+lOrJUZNuABUguGy9zpwoUscfUjDd Df7gAWvHpLKNZEw+Xz60zMoQrrdK1cGlblPCOKkAUKJBgw/tJF1iiOR3dFhIYhnF5rQS AfJf0HI+f94QNrsDoXGCUh01uJ7mtYWrNq8g6UrYWSZcQMXXwPcl9ZirrWyRrwlLCj3H m/fAqGV0t0c7vVFipU+UwQCiHWjGC3IvlttLy2+vSRspa3kjprK2/eJVSoTOvB9jGrt5 cPPQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=H8Fl2NAJimDNwPAPYpHiXp/GBolEYD5LJ/W0AY2oxqg=; b=vXQe/SZM0A8aCOj+O3UeJvItxS6+HXVteudsZu6fztHaNifl4pDXP34NTdnh2G9C7a dI4z7Ye4IeYZ+12kNvaKpCGq9r/9Mcf8fmAgwFGhlYZkKotsVr4BQukp7S2eeb8x1XpC UDlKVG3pnhNPuJquYbcdR+wvpQ4ciqbobUkSFoarGtEuAsoFquNyn4zgT5e7v+jFUOat 1ynlcbD8CgB7HO1fLAu8RzHuB8WEEOz7096TOS6ISIa8QHh82fAI3ANHWYvs7OyGx1e2 vTTsUQwm2FCxhUnO9tATMhY5qjXBCfFstZ1r0VoR6MpIHeIZDNKYY+xXoVL8TRA8E9pL k/jA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b="Ljx3bD/A"; dkim=neutral (no key) header.i=@linutronix.de header.b=TaaMaQCF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h14-20020a1709066d8e00b007aa35038c6bsi11918007ejt.463.2022.11.02.02.27.44; Wed, 02 Nov 2022 02:28:09 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b="Ljx3bD/A"; dkim=neutral (no key) header.i=@linutronix.de header.b=TaaMaQCF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231569AbiKBJVr (ORCPT + 99 others); Wed, 2 Nov 2022 05:21:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231175AbiKBJVT (ORCPT ); Wed, 2 Nov 2022 05:21:19 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6BDAE6429; Wed, 2 Nov 2022 02:20:04 -0700 (PDT) Date: Wed, 02 Nov 2022 09:20:01 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1667380803; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=H8Fl2NAJimDNwPAPYpHiXp/GBolEYD5LJ/W0AY2oxqg=; b=Ljx3bD/AWdoWKtmLY7HYA8OLXjt0BcufrghbrShi/Gp7bQ//kU2rqOrPHuiPWSBCPzPZNJ iS1ZGqvHpC1jzM9N2APcimvmT8U/h/UgRVSOG1tjbw+Rw4oU72L1CWLq6wbhu8PVwPy/Z4 F6f7+VxbwM8B9oRbCy0JQKnrutcyT2G8DMd3SXoyofxR9Eg5kLHrNXm/+p8RYk1eYh8Anv 97CvgG2cPVl/BIdcf9A0ZSKiM/LUnGt1dbWUO2egndLKbIZTSUTbt2Gtxg5IahgfXc+Stv mcsEd+aaDNeHqdm6D9l0Cue5LJTyzndLrLHZ32Qc3x1oo510HimTfFhAoCcIyw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1667380803; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=H8Fl2NAJimDNwPAPYpHiXp/GBolEYD5LJ/W0AY2oxqg=; b=TaaMaQCF6Xkw7dVsbYmulVXvgFUQNgsXX7SjPJExvEWnT/Q8qYnIQqdKcMot29E9I3U1lw yel/t04oCFeCMTDw== From: "tip-bot2 for Peter Zijlstra" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/core] objtool: Add --cfi to generate the .cfi_sites section Cc: "Peter Zijlstra (Intel)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20221027092842.568039454@infradead.org> References: <20221027092842.568039454@infradead.org> MIME-Version: 1.0 Message-ID: <166738080168.7716.10664024417859485269.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747833238358900213?= X-GMAIL-MSGID: =?utf-8?q?1748376002915597710?= The following commit has been merged into the x86/core branch of tip: Commit-ID: 9a479f766be1dd777e12e3e57b6ee4c3028a40a5 Gitweb: https://git.kernel.org/tip/9a479f766be1dd777e12e3e57b6ee4c3028a40a5 Author: Peter Zijlstra AuthorDate: Thu, 27 Oct 2022 11:28:13 +02:00 Committer: Peter Zijlstra CommitterDate: Tue, 01 Nov 2022 13:44:10 +01:00 objtool: Add --cfi to generate the .cfi_sites section Add the location of all __cfi_##name symbols (as generated by kCFI) to a section such that we might re-write things at kernel boot. Notably; boot time re-hashing and FineIBT are the intended use of this. Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20221027092842.568039454@infradead.org --- tools/objtool/builtin-check.c | 1 +- tools/objtool/check.c | 69 ++++++++++++++++++++++++- tools/objtool/include/objtool/builtin.h | 1 +- 3 files changed, 71 insertions(+) diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c index 95fcece..868e3e3 100644 --- a/tools/objtool/builtin-check.c +++ b/tools/objtool/builtin-check.c @@ -80,6 +80,7 @@ const struct option check_options[] = { OPT_BOOLEAN('s', "stackval", &opts.stackval, "validate frame pointer rules"), OPT_BOOLEAN('t', "static-call", &opts.static_call, "annotate static calls"), OPT_BOOLEAN('u', "uaccess", &opts.uaccess, "validate uaccess rules for SMAP"), + OPT_BOOLEAN(0 , "cfi", &opts.cfi, "annotate kernel control flow integrity (kCFI) function preambles"), OPT_CALLBACK_OPTARG(0, "dump", NULL, NULL, "orc", "dump metadata", parse_dump), OPT_GROUP("Options:"), diff --git a/tools/objtool/check.c b/tools/objtool/check.c index 27f35f5..55066c4 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -861,6 +861,68 @@ static int create_ibt_endbr_seal_sections(struct objtool_file *file) return 0; } +static int create_cfi_sections(struct objtool_file *file) +{ + struct section *sec, *s; + struct symbol *sym; + unsigned int *loc; + int idx; + + sec = find_section_by_name(file->elf, ".cfi_sites"); + if (sec) { + INIT_LIST_HEAD(&file->call_list); + WARN("file already has .cfi_sites section, skipping"); + return 0; + } + + idx = 0; + for_each_sec(file, s) { + if (!s->text) + continue; + + list_for_each_entry(sym, &s->symbol_list, list) { + if (sym->type != STT_FUNC) + continue; + + if (strncmp(sym->name, "__cfi_", 6)) + continue; + + idx++; + } + } + + sec = elf_create_section(file->elf, ".cfi_sites", 0, sizeof(unsigned int), idx); + if (!sec) + return -1; + + idx = 0; + for_each_sec(file, s) { + if (!s->text) + continue; + + list_for_each_entry(sym, &s->symbol_list, list) { + if (sym->type != STT_FUNC) + continue; + + if (strncmp(sym->name, "__cfi_", 6)) + continue; + + loc = (unsigned int *)sec->data->d_buf + idx; + memset(loc, 0, sizeof(unsigned int)); + + if (elf_add_reloc_to_insn(file->elf, sec, + idx * sizeof(unsigned int), + R_X86_64_PC32, + s, sym->offset)) + return -1; + + idx++; + } + } + + return 0; +} + static int create_mcount_loc_sections(struct objtool_file *file) { struct section *sec; @@ -4430,6 +4492,13 @@ int check(struct objtool_file *file) warnings += ret; } + if (opts.cfi) { + ret = create_cfi_sections(file); + if (ret < 0) + goto out; + warnings += ret; + } + if (opts.rethunk) { ret = create_return_sites_sections(file); if (ret < 0) diff --git a/tools/objtool/include/objtool/builtin.h b/tools/objtool/include/objtool/builtin.h index f341b62..c44ff39 100644 --- a/tools/objtool/include/objtool/builtin.h +++ b/tools/objtool/include/objtool/builtin.h @@ -27,6 +27,7 @@ struct opts { bool static_call; bool uaccess; int prefix; + bool cfi; /* options: */ bool backtrace;