From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x2268G1rq8uTSK5ForIXwll7XYI87SsyIm0pfsISUuV4mGXnTOI/NcvOaMbFZHI2b0+7i2m4Y ARC-Seal: i=1; a=rsa-sha256; t=1517390995; cv=none; d=google.com; s=arc-20160816; b=RCxm99+RianFpZ8B0Z1w+ZFUfzrVD79DIqeT//RTHT7Y2emJj1OQrK3xg+GF0OvJ9k gD5QP1hjRliGF4uLQRvtDVD/UIfRil8CRqVGdTK8LdEbDGMFQsgQRiJOqHMlv/CXd/Ok joLXgCj01md9+qVdvBnkqYo9X2/n4xtUeFlGACFVPimXwPm3xjR6refJwwsgpwZSSVuO jLSLRsSTBBap3o1E5qfyEymezoGZBxe7THWmUnMPfkBFxghUOVv13KokWxl2XO+k9qcz 0CT08k/dGYBLNJTCl81piAH26riwz53k005dJZs/RQG0+iCe/mZBLMUTRC7HtOPeL0ut k4DQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-transfer-encoding :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dkim-signature:arc-authentication-results; bh=Ary1OtppXK6qp4OUJibz+zXozAZhcoAFK59IGY5bnWk=; b=HjoKULLqboyAvAzSGHm+6UMrTcJigmnTR5hOp62itmX7lDKpaLCqaZgIcwwdGhEqY8 UwpxP2svbACxdMn4WCsT+F88v5ZzLUKy3IdN6+oUQuPsP9eblZWYfdvK4fd2DEKD9ou1 hlrT6Sf+Kkq/n5kLK8bQ1qqAbXUz3unfJhGK/zM3xn+xtaqVK4YBV+qMrZNvBbtVV6PQ bFVMyK0+g03IEk5+wKfdHcM/RnUo+QzNfO8tAFx/D/nylEqCsXGYmBy/wGicMWTJUH0r pOKXZFbLz/B9g6sIF1Kmzm6uMGaD5ZjtI4YPKxDbuj0ILOfbLNZSzLDPnLYwz74u3MAf qtPg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=merlin.20170209 header.b=WNavW7wJ; spf=pass (google.com: best guess record for domain of peterz@infradead.org designates 205.233.59.134 as permitted sender) smtp.mailfrom=peterz@infradead.org Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=merlin.20170209 header.b=WNavW7wJ; spf=pass (google.com: best guess record for domain of peterz@infradead.org designates 205.233.59.134 as permitted sender) smtp.mailfrom=peterz@infradead.org Date: Wed, 31 Jan 2018 10:29:21 +0100 From: Peter Zijlstra To: David Woodhouse Cc: Thomas Gleixner , Josh Poimboeuf , linux-kernel@vger.kernel.org, Dave Hansen , Ashok Raj , Tim Chen , Andy Lutomirski , Linus Torvalds , Greg KH , Andrea Arcangeli , Andi Kleen , Arjan Van De Ven , Dan Williams , Paolo Bonzini , Jun Nakajima , Asit Mallick , Jason Baron , Tom Lendacky , Borislav Petkov Subject: Re: [PATCH 08/24] x86,sme: Annotate indirect call Message-ID: <20180131092921.GI2269@hirez.programming.kicks-ass.net> References: <20180123152539.374360046@infradead.org> <20180123152638.453859448@infradead.org> <1516963050.30244.188.camel@infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1516963050.30244.188.camel@infradead.org> User-Agent: Mutt/1.9.2 (2017-12-15) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590397849625954556?= X-GMAIL-MSGID: =?utf-8?q?1591099780839217718?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Fri, Jan 26, 2018 at 10:37:30AM +0000, David Woodhouse wrote: > On Tue, 2018-01-23 at 16:25 +0100, Peter Zijlstra wrote: > > This is boot code, we run this _way_ before userspace comes along to > > poison our branch predictor. > > Hm, objtool knows about sections, doesn't it? Why it is whining about > indirect jumps in inittext anyway? > > In fact, why are we even *doing* retpolines in inittext? Not that we > are; since we flipped the ALTERNATIVE logic around, at that point we > still have the 'oldinstr' which is a bare jmp anyway. We might as well > do this: > > --- a/include/linux/init.h > +++ b/include/linux/init.h > @@ -37,10 +37,15 @@ >   * as gcc otherwise puts the data into the bss section and not into the init >   * section. >   */ > +#if defined(RETPOLINE) && !defined(MODULE) > +#define __noretpoline __attribute__((indirect_branch("keep"))) > +#else > +#define __noretpoline > +#endif >   >  /* These are for everybody (although not all archs will actually >     discard it in modules) */ > -#define __init         __section(.init.text) __cold __inittrace __latent_entropy > +#define __init         __section(.init.text) __cold __inittrace __latent_entropy __noretpoline >  #define __initdata     __section(.init.data) >  #define __initconst    __section(.init.rodata) >  #define __exitdata     __section(.exit.data) Something like so then? --- Subject: objtool: Add module specific retpoline rules From: Peter Zijlstra Date: Wed Jan 31 10:18:28 CET 2018 David wanted to not use retpolines in .init.text but that will trip up objtool retpoline validation, fix that. Requested-by: David Woodhouse Signed-off-by: Peter Zijlstra (Intel) --- scripts/Makefile.build | 2 ++ tools/objtool/builtin-check.c | 3 ++- tools/objtool/builtin.h | 2 +- tools/objtool/check.c | 9 +++++++++ 4 files changed, 14 insertions(+), 2 deletions(-) --- a/scripts/Makefile.build +++ b/scripts/Makefile.build @@ -256,6 +256,8 @@ __objtool_obj := $(objtree)/tools/objtoo objtool_args = $(if $(CONFIG_UNWINDER_ORC),orc generate,check) +objtool_args += $(if $(part-of-module), --module,) + ifndef CONFIG_FRAME_POINTER objtool_args += --no-fp endif --- a/tools/objtool/builtin-check.c +++ b/tools/objtool/builtin-check.c @@ -29,7 +29,7 @@ #include "builtin.h" #include "check.h" -bool no_fp, no_unreachable, retpoline; +bool no_fp, no_unreachable, retpoline, module; static const char * const check_usage[] = { "objtool check [] file.o", @@ -40,6 +40,7 @@ const struct option check_options[] = { OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"), OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"), OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"), + OPT_BOOLEAN('m', "module", &module, "Indicates the object will be part of a kernel module"), OPT_END(), }; --- a/tools/objtool/builtin.h +++ b/tools/objtool/builtin.h @@ -20,7 +20,7 @@ #include extern const struct option check_options[]; -extern bool no_fp, no_unreachable, retpoline; +extern bool no_fp, no_unreachable, retpoline, module; extern int cmd_check(int argc, const char **argv); extern int cmd_orc(int argc, const char **argv); --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -1920,6 +1920,15 @@ static int validate_retpoline(struct obj if (insn->retpoline_safe) continue; + /* + * .init.text code is ran before userspace and thus doesn't + * strictly need retpolines, except for modules which are + * loaded late, they very much do need retpoline in their + * .init.text + */ + if (!strcmp(insn->sec->name, ".init.text") && !module) + continue; + WARN_FUNC("indirect %s found in RETPOLINE build", insn->sec, insn->offset, insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");