Centos-kernel-stream-9/include/linux/objtool.h

175 lines
4.9 KiB
C
Raw Permalink Normal View History

License cleanup: add SPDX GPL-2.0 license identifier to files with no license Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-01 14:07:57 +00:00
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _LINUX_OBJTOOL_H
#define _LINUX_OBJTOOL_H
#include <linux/objtool_types.h>
objtool: Add CONFIG_OBJTOOL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2121207 Conflicts: arch/x86/Kconfig - (diff context) rhel9 doesn't have upstream f6a2c2b2de81 ("x86/Kconfig: Only allow CONFIG_X86_KERNEL_IBT with ld.lld >= 14.0.0") - (diff context) rhel9 doesn't have upstream 4ed308c445a1 ("ftrace: Have architectures opt-in for mcount build time sorting") - rhel9 already has upstream f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs"), which moved config RETPOLINE lower in the file, adds config RETHUNK, etc. - (diff context) rhel9 already has upstream 1e9fdf21a433 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"), which added MMU_GATHER_MERGE_VMAS arch/x86/kernel/alternative.c - rhel9 already has upstream f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs") which introduced CONFIG_RETHUNK lib/Kconfig.debug - rhel9 doesn't have upstream bece04b5b41d ("kcov: fix generic Kconfig dependencies if ARCH_WANTS_NO_INSTR") lib/Kconfig.kcsan - rhel9 doesn't have upstream 69562e4983d9 ("kcsan: Add core support for a subset of weak memory modeling"), so can't update KCSAN_WEAK_MEMORY dependencies commit 03f16cd020eb8bb2eb837e2090086f296a9fa91d Author: Josh Poimboeuf <jpoimboe@redhat.com> Date: Mon Apr 18 09:50:36 2022 -0700 objtool: Add CONFIG_OBJTOOL Now that stack validation is an optional feature of objtool, add CONFIG_OBJTOOL and replace most usages of CONFIG_STACK_VALIDATION with it. CONFIG_STACK_VALIDATION can now be considered to be frame-pointer specific. CONFIG_UNWINDER_ORC is already inherently valid for live patching, so no need to "validate" it. Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Miroslav Benes <mbenes@suse.cz> Link: https://lkml.kernel.org/r/939bf3d85604b2a126412bf11af6e3bd3b872bcb.1650300597.git.jpoimboe@redhat.com Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
2022-10-27 18:28:01 +00:00
#ifdef CONFIG_OBJTOOL
#include <asm/asm.h>
#ifndef __ASSEMBLY__
x86,objtool: Split UNWIND_HINT_EMPTY in two JIRA: https://issues.redhat.com/browse/RHEL-52683 commit fb799447ae2974a07907906dff5bd4b9e47b7123 Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Wed Mar 1 07:13:12 2023 -0800 x86,objtool: Split UNWIND_HINT_EMPTY in two Mark reported that the ORC unwinder incorrectly marks an unwind as reliable when the unwind terminates prematurely in the dark corners of return_to_handler() due to lack of information about the next frame. The problem is UNWIND_HINT_EMPTY is used in two different situations: 1) The end of the kernel stack unwind before hitting user entry, boot code, or fork entry 2) A blind spot in ORC coverage where the unwinder has to bail due to lack of information about the next frame The ORC unwinder has no way to tell the difference between the two. When it encounters an undefined stack state with 'end=1', it blindly marks the stack reliable, which can break the livepatch consistency model. Fix it by splitting UNWIND_HINT_EMPTY into UNWIND_HINT_UNDEFINED and UNWIND_HINT_END_OF_STACK. Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/fd6212c8b450d3564b855e1cb48404d6277b4d9f.1677683419.git.jpoimboe@kernel.org Conflicts: arch/x86/entry/entry_64.S (context, skipping f71e1d2ff8e6a) arch/x86/kernel/head_64.S (context, skipping 666e1156b2c51) RHEL-only: arch/x86/entry/entry.S: UNWIND_HINT_EMPTY->UNWIND_HINT_UNDEFINED to match upstream. Omitted-fix: b9f174c811e3 ("x86/unwind/orc: Add ELF section with ORC version identifier") see https://issues.redhat.com/browse/RHEL-27234 for discussion Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
2024-09-04 12:06:01 +00:00
#define UNWIND_HINT(type, sp_reg, sp_offset, signal) \
"987: \n\t" \
".pushsection .discard.unwind_hints\n\t" \
/* struct unwind_hint */ \
".long 987b - .\n\t" \
".short " __stringify(sp_offset) "\n\t" \
".byte " __stringify(sp_reg) "\n\t" \
".byte " __stringify(type) "\n\t" \
".byte " __stringify(signal) "\n\t" \
".balign 4 \n\t" \
".popsection\n\t"
/*
* This macro marks the given function's stack frame as "non-standard", which
* tells objtool to ignore the function when doing stack metadata validation.
* It should only be used in special cases where you're 100% sure it won't
* affect the reliability of frame pointers and kernel stack traces.
*
* For more information, see tools/objtool/Documentation/objtool.txt.
*/
#define STACK_FRAME_NON_STANDARD(func) \
static void __used __section(".discard.func_stack_frame_non_standard") \
*__func_stack_frame_non_standard_##func = func
/*
* STACK_FRAME_NON_STANDARD_FP() is a frame-pointer-specific function ignore
* for the case where a function is intentionally missing frame pointer setup,
* but otherwise needs objtool/ORC coverage when frame pointers are disabled.
*/
#ifdef CONFIG_FRAME_POINTER
#define STACK_FRAME_NON_STANDARD_FP(func) STACK_FRAME_NON_STANDARD(func)
#else
#define STACK_FRAME_NON_STANDARD_FP(func)
#endif
#define ANNOTATE_NOENDBR \
"986: \n\t" \
".pushsection .discard.noendbr\n\t" \
x86/speculation, objtool: Use absolute relocations for annotations JIRA: https://issues.redhat.com/browse/RHEL-25415 commit b8ec60e1186cdcfce41e7db4c827cb107e459002 Author: Fangrui Song <maskray@google.com> Date: Tue Sep 19 17:17:28 2023 -0700 x86/speculation, objtool: Use absolute relocations for annotations .discard.retpoline_safe sections do not have the SHF_ALLOC flag. These sections referencing text sections' STT_SECTION symbols with PC-relative relocations like R_386_PC32 [0] is conceptually not suitable. Newer LLD will report warnings for REL relocations even for relocatable links [1]: ld.lld: warning: vmlinux.a(drivers/i2c/busses/i2c-i801.o):(.discard.retpoline_safe+0x120): has non-ABS relocation R_386_PC32 against symbol '' Switch to absolute relocations instead, which indicate link-time addresses. In a relocatable link, these addresses are also output section offsets, used by checks in tools/objtool/check.c. When linking vmlinux, these .discard.* sections will be discarded, therefore it is not a problem that R_X86_64_32 cannot represent a kernel address. Alternatively, we could set the SHF_ALLOC flag for .discard.* sections, but I think non-SHF_ALLOC for sections to be discarded makes more sense. Note: if we decide to never support REL architectures (e.g. arm, i386), we can utilize R_*_NONE relocations (.reloc ., BFD_RELOC_NONE, sym), making .discard.* sections zero-sized. That said, the section content waste is 4 bytes per entry, much smaller than sizeof(Elf{32,64}_Rel). [0] commit 1c0c1faf5692 ("objtool: Use relative pointers for annotations") [1] https://github.com/ClangBuiltLinux/linux/issues/1937 Signed-off-by: Fangrui Song <maskray@google.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Link: https://lore.kernel.org/r/20230920001728.1439947-1-maskray@google.com Signed-off-by: Prarit Bhargava <prarit@redhat.com>
2024-02-07 16:40:30 +00:00
".long 986b\n\t" \
".popsection\n\t"
#define ASM_REACHABLE \
"998:\n\t" \
".pushsection .discard.reachable\n\t" \
x86/speculation, objtool: Use absolute relocations for annotations JIRA: https://issues.redhat.com/browse/RHEL-25415 commit b8ec60e1186cdcfce41e7db4c827cb107e459002 Author: Fangrui Song <maskray@google.com> Date: Tue Sep 19 17:17:28 2023 -0700 x86/speculation, objtool: Use absolute relocations for annotations .discard.retpoline_safe sections do not have the SHF_ALLOC flag. These sections referencing text sections' STT_SECTION symbols with PC-relative relocations like R_386_PC32 [0] is conceptually not suitable. Newer LLD will report warnings for REL relocations even for relocatable links [1]: ld.lld: warning: vmlinux.a(drivers/i2c/busses/i2c-i801.o):(.discard.retpoline_safe+0x120): has non-ABS relocation R_386_PC32 against symbol '' Switch to absolute relocations instead, which indicate link-time addresses. In a relocatable link, these addresses are also output section offsets, used by checks in tools/objtool/check.c. When linking vmlinux, these .discard.* sections will be discarded, therefore it is not a problem that R_X86_64_32 cannot represent a kernel address. Alternatively, we could set the SHF_ALLOC flag for .discard.* sections, but I think non-SHF_ALLOC for sections to be discarded makes more sense. Note: if we decide to never support REL architectures (e.g. arm, i386), we can utilize R_*_NONE relocations (.reloc ., BFD_RELOC_NONE, sym), making .discard.* sections zero-sized. That said, the section content waste is 4 bytes per entry, much smaller than sizeof(Elf{32,64}_Rel). [0] commit 1c0c1faf5692 ("objtool: Use relative pointers for annotations") [1] https://github.com/ClangBuiltLinux/linux/issues/1937 Signed-off-by: Fangrui Song <maskray@google.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Link: https://lore.kernel.org/r/20230920001728.1439947-1-maskray@google.com Signed-off-by: Prarit Bhargava <prarit@redhat.com>
2024-02-07 16:40:30 +00:00
".long 998b\n\t" \
".popsection\n\t"
#else /* __ASSEMBLY__ */
/*
* This macro indicates that the following intra-function call is valid.
* Any non-annotated intra-function call will cause objtool to issue a warning.
*/
#define ANNOTATE_INTRA_FUNCTION_CALL \
999: \
.pushsection .discard.intra_function_calls; \
x86/speculation, objtool: Use absolute relocations for annotations JIRA: https://issues.redhat.com/browse/RHEL-25415 commit b8ec60e1186cdcfce41e7db4c827cb107e459002 Author: Fangrui Song <maskray@google.com> Date: Tue Sep 19 17:17:28 2023 -0700 x86/speculation, objtool: Use absolute relocations for annotations .discard.retpoline_safe sections do not have the SHF_ALLOC flag. These sections referencing text sections' STT_SECTION symbols with PC-relative relocations like R_386_PC32 [0] is conceptually not suitable. Newer LLD will report warnings for REL relocations even for relocatable links [1]: ld.lld: warning: vmlinux.a(drivers/i2c/busses/i2c-i801.o):(.discard.retpoline_safe+0x120): has non-ABS relocation R_386_PC32 against symbol '' Switch to absolute relocations instead, which indicate link-time addresses. In a relocatable link, these addresses are also output section offsets, used by checks in tools/objtool/check.c. When linking vmlinux, these .discard.* sections will be discarded, therefore it is not a problem that R_X86_64_32 cannot represent a kernel address. Alternatively, we could set the SHF_ALLOC flag for .discard.* sections, but I think non-SHF_ALLOC for sections to be discarded makes more sense. Note: if we decide to never support REL architectures (e.g. arm, i386), we can utilize R_*_NONE relocations (.reloc ., BFD_RELOC_NONE, sym), making .discard.* sections zero-sized. That said, the section content waste is 4 bytes per entry, much smaller than sizeof(Elf{32,64}_Rel). [0] commit 1c0c1faf5692 ("objtool: Use relative pointers for annotations") [1] https://github.com/ClangBuiltLinux/linux/issues/1937 Signed-off-by: Fangrui Song <maskray@google.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Link: https://lore.kernel.org/r/20230920001728.1439947-1-maskray@google.com Signed-off-by: Prarit Bhargava <prarit@redhat.com>
2024-02-07 16:40:30 +00:00
.long 999b; \
.popsection;
/*
* In asm, there are two kinds of code: normal C-type callable functions and
* the rest. The normal callable functions can be called by other code, and
* don't do anything unusual with the stack. Such normal callable functions
* are annotated with the ENTRY/ENDPROC macros. Most asm code falls in this
* category. In this case, no special debugging annotations are needed because
* objtool can automatically generate the ORC data for the ORC unwinder to read
* at runtime.
*
* Anything which doesn't fall into the above category, such as syscall and
* interrupt handlers, tends to not be called directly by other functions, and
* often does unusual non-C-function-type things with the stack pointer. Such
* code needs to be annotated such that objtool can understand it. The
* following CFI hint macros are for this type of code.
*
* These macros provide hints to objtool about the state of the stack at each
* instruction. Objtool starts from the hints and follows the code flow,
* making automatic CFI adjustments when it sees pushes and pops, filling out
* the debuginfo as necessary. It will also warn if it sees any
* inconsistencies.
*/
x86,objtool: Split UNWIND_HINT_EMPTY in two JIRA: https://issues.redhat.com/browse/RHEL-52683 commit fb799447ae2974a07907906dff5bd4b9e47b7123 Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Wed Mar 1 07:13:12 2023 -0800 x86,objtool: Split UNWIND_HINT_EMPTY in two Mark reported that the ORC unwinder incorrectly marks an unwind as reliable when the unwind terminates prematurely in the dark corners of return_to_handler() due to lack of information about the next frame. The problem is UNWIND_HINT_EMPTY is used in two different situations: 1) The end of the kernel stack unwind before hitting user entry, boot code, or fork entry 2) A blind spot in ORC coverage where the unwinder has to bail due to lack of information about the next frame The ORC unwinder has no way to tell the difference between the two. When it encounters an undefined stack state with 'end=1', it blindly marks the stack reliable, which can break the livepatch consistency model. Fix it by splitting UNWIND_HINT_EMPTY into UNWIND_HINT_UNDEFINED and UNWIND_HINT_END_OF_STACK. Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/fd6212c8b450d3564b855e1cb48404d6277b4d9f.1677683419.git.jpoimboe@kernel.org Conflicts: arch/x86/entry/entry_64.S (context, skipping f71e1d2ff8e6a) arch/x86/kernel/head_64.S (context, skipping 666e1156b2c51) RHEL-only: arch/x86/entry/entry.S: UNWIND_HINT_EMPTY->UNWIND_HINT_UNDEFINED to match upstream. Omitted-fix: b9f174c811e3 ("x86/unwind/orc: Add ELF section with ORC version identifier") see https://issues.redhat.com/browse/RHEL-27234 for discussion Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
2024-09-04 12:06:01 +00:00
.macro UNWIND_HINT type:req sp_reg=0 sp_offset=0 signal=0
.Lhere_\@:
.pushsection .discard.unwind_hints
/* struct unwind_hint */
.long .Lhere_\@ - .
.short \sp_offset
.byte \sp_reg
.byte \type
.byte \signal
.balign 4
.popsection
.endm
.macro STACK_FRAME_NON_STANDARD func:req
.pushsection .discard.func_stack_frame_non_standard, "aw"
.long \func - .
.popsection
.endm
x86/ftrace: Remove OBJECT_FILES_NON_STANDARD usage Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2121207 Conflicts: arch/x86/kernel/ftrace_64.S - rhel9 doesn't have upstream 0c0593b45c9b ("x86/ftrace: Make function graph use ftrace directly"), which removed ftrace_graph_caller, mark it as STACK_FRAME_NON_STANDARD_FP commit 7b6c7a877cc616bc7dc9cd39646fe454acbed48b Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Fri Jun 3 08:04:44 2022 -0700 x86/ftrace: Remove OBJECT_FILES_NON_STANDARD usage The file-wide OBJECT_FILES_NON_STANDARD annotation is used with CONFIG_FRAME_POINTER to tell objtool to skip the entire file when frame pointers are enabled. However that annotation is now deprecated because it doesn't work with IBT, where objtool runs on vmlinux.o instead of individual translation units. Instead, use more fine-grained function-specific annotations: - The 'save_mcount_regs' macro does funny things with the frame pointer. Use STACK_FRAME_NON_STANDARD_FP to tell objtool to ignore the functions using it. - The return_to_handler() "function" isn't actually a callable function. Instead of being called, it's returned to. The real return address isn't on the stack, so unwinding is already doomed no matter which unwinder is used. So just remove the STT_FUNC annotation, telling objtool to ignore it. That also removes the implicit ANNOTATE_NOENDBR, which now needs to be made explicit. Fixes the following warning: vmlinux.o: warning: objtool: __fentry__+0x16: return with modified stack frame Fixes: ed53a0d97192 ("x86/alternative: Use .ibt_endbr_seal to seal indirect calls") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Link: https://lore.kernel.org/r/b7a7a42fe306aca37826043dac89e113a1acdbac.1654268610.git.jpoimboe@kernel.org Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
2022-10-27 18:27:59 +00:00
.macro STACK_FRAME_NON_STANDARD_FP func:req
#ifdef CONFIG_FRAME_POINTER
STACK_FRAME_NON_STANDARD \func
#endif
.endm
.macro ANNOTATE_NOENDBR
.Lhere_\@:
.pushsection .discard.noendbr
x86/speculation, objtool: Use absolute relocations for annotations JIRA: https://issues.redhat.com/browse/RHEL-25415 commit b8ec60e1186cdcfce41e7db4c827cb107e459002 Author: Fangrui Song <maskray@google.com> Date: Tue Sep 19 17:17:28 2023 -0700 x86/speculation, objtool: Use absolute relocations for annotations .discard.retpoline_safe sections do not have the SHF_ALLOC flag. These sections referencing text sections' STT_SECTION symbols with PC-relative relocations like R_386_PC32 [0] is conceptually not suitable. Newer LLD will report warnings for REL relocations even for relocatable links [1]: ld.lld: warning: vmlinux.a(drivers/i2c/busses/i2c-i801.o):(.discard.retpoline_safe+0x120): has non-ABS relocation R_386_PC32 against symbol '' Switch to absolute relocations instead, which indicate link-time addresses. In a relocatable link, these addresses are also output section offsets, used by checks in tools/objtool/check.c. When linking vmlinux, these .discard.* sections will be discarded, therefore it is not a problem that R_X86_64_32 cannot represent a kernel address. Alternatively, we could set the SHF_ALLOC flag for .discard.* sections, but I think non-SHF_ALLOC for sections to be discarded makes more sense. Note: if we decide to never support REL architectures (e.g. arm, i386), we can utilize R_*_NONE relocations (.reloc ., BFD_RELOC_NONE, sym), making .discard.* sections zero-sized. That said, the section content waste is 4 bytes per entry, much smaller than sizeof(Elf{32,64}_Rel). [0] commit 1c0c1faf5692 ("objtool: Use relative pointers for annotations") [1] https://github.com/ClangBuiltLinux/linux/issues/1937 Signed-off-by: Fangrui Song <maskray@google.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Link: https://lore.kernel.org/r/20230920001728.1439947-1-maskray@google.com Signed-off-by: Prarit Bhargava <prarit@redhat.com>
2024-02-07 16:40:30 +00:00
.long .Lhere_\@
.popsection
.endm
x86,objtool: Separate unret validation from unwind hints JIRA: https://issues.redhat.com/browse/RHEL-8594 CVE: CVE-2023-20569 Conflicts: 1) A merge conflict in arch/x86/include/asm/unwind_hints.h due to the presence of a later upstream commit 8faea26e6111 ("objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}"). 2) A merge conflict in tools/objtool/include/objtool/check.h due to missing upstream commit 1c34496e5856 ("objtool: Remove instruction::list"). 3) A merge conflict in arch/x86/entry/entry_64.S due to missing upstream commit 37064583f63e ("x86/entry: Fix unwinding from kprobe on PUSH/POP instruction"). 4) Contextual diffs in arch/x86/include/asm/unwind_hints.h due to missing upstream commit ffb1b4a41016 ("x86/unwind/orc: Add 'signal' field to ORC metadata") and its follow-on fixes. The signal argument of the UNWIND_HINT_IRET_ENTRY macro in arch/x86/include/asm/unwind_hints.h is also removed because of that missing commit. commit 4708ea14bef314fc901857eefd65678236a9f2d9 Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Wed, 1 Mar 2023 07:13:11 -0800 x86,objtool: Separate unret validation from unwind hints The ENTRY unwind hint type is serving double duty as both an empty unwind hint and an unret validation annotation. Unret validation is unrelated to unwinding. Separate it out into its own annotation. Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/ff7448d492ea21b86d8a90264b105fbd0d751077.1677683419.git.jpoimboe@kernel.org Signed-off-by: Waiman Long <longman@redhat.com>
2023-09-25 17:57:14 +00:00
/*
* Use objtool to validate the entry requirement that all code paths do
* VALIDATE_UNRET_END before RET.
*
* NOTE: The macro must be used at the beginning of a global symbol, otherwise
* it will be ignored.
*/
.macro VALIDATE_UNRET_BEGIN
#if defined(CONFIG_NOINSTR_VALIDATION) && \
(defined(CONFIG_MITIGATION_UNRET_ENTRY) || defined(CONFIG_MITIGATION_SRSO))
x86,objtool: Separate unret validation from unwind hints JIRA: https://issues.redhat.com/browse/RHEL-8594 CVE: CVE-2023-20569 Conflicts: 1) A merge conflict in arch/x86/include/asm/unwind_hints.h due to the presence of a later upstream commit 8faea26e6111 ("objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}"). 2) A merge conflict in tools/objtool/include/objtool/check.h due to missing upstream commit 1c34496e5856 ("objtool: Remove instruction::list"). 3) A merge conflict in arch/x86/entry/entry_64.S due to missing upstream commit 37064583f63e ("x86/entry: Fix unwinding from kprobe on PUSH/POP instruction"). 4) Contextual diffs in arch/x86/include/asm/unwind_hints.h due to missing upstream commit ffb1b4a41016 ("x86/unwind/orc: Add 'signal' field to ORC metadata") and its follow-on fixes. The signal argument of the UNWIND_HINT_IRET_ENTRY macro in arch/x86/include/asm/unwind_hints.h is also removed because of that missing commit. commit 4708ea14bef314fc901857eefd65678236a9f2d9 Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Wed, 1 Mar 2023 07:13:11 -0800 x86,objtool: Separate unret validation from unwind hints The ENTRY unwind hint type is serving double duty as both an empty unwind hint and an unret validation annotation. Unret validation is unrelated to unwinding. Separate it out into its own annotation. Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/ff7448d492ea21b86d8a90264b105fbd0d751077.1677683419.git.jpoimboe@kernel.org Signed-off-by: Waiman Long <longman@redhat.com>
2023-09-25 17:57:14 +00:00
.Lhere_\@:
.pushsection .discard.validate_unret
.long .Lhere_\@ - .
.popsection
#endif
.endm
.macro REACHABLE
.Lhere_\@:
.pushsection .discard.reachable
x86/speculation, objtool: Use absolute relocations for annotations JIRA: https://issues.redhat.com/browse/RHEL-25415 commit b8ec60e1186cdcfce41e7db4c827cb107e459002 Author: Fangrui Song <maskray@google.com> Date: Tue Sep 19 17:17:28 2023 -0700 x86/speculation, objtool: Use absolute relocations for annotations .discard.retpoline_safe sections do not have the SHF_ALLOC flag. These sections referencing text sections' STT_SECTION symbols with PC-relative relocations like R_386_PC32 [0] is conceptually not suitable. Newer LLD will report warnings for REL relocations even for relocatable links [1]: ld.lld: warning: vmlinux.a(drivers/i2c/busses/i2c-i801.o):(.discard.retpoline_safe+0x120): has non-ABS relocation R_386_PC32 against symbol '' Switch to absolute relocations instead, which indicate link-time addresses. In a relocatable link, these addresses are also output section offsets, used by checks in tools/objtool/check.c. When linking vmlinux, these .discard.* sections will be discarded, therefore it is not a problem that R_X86_64_32 cannot represent a kernel address. Alternatively, we could set the SHF_ALLOC flag for .discard.* sections, but I think non-SHF_ALLOC for sections to be discarded makes more sense. Note: if we decide to never support REL architectures (e.g. arm, i386), we can utilize R_*_NONE relocations (.reloc ., BFD_RELOC_NONE, sym), making .discard.* sections zero-sized. That said, the section content waste is 4 bytes per entry, much smaller than sizeof(Elf{32,64}_Rel). [0] commit 1c0c1faf5692 ("objtool: Use relative pointers for annotations") [1] https://github.com/ClangBuiltLinux/linux/issues/1937 Signed-off-by: Fangrui Song <maskray@google.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Link: https://lore.kernel.org/r/20230920001728.1439947-1-maskray@google.com Signed-off-by: Prarit Bhargava <prarit@redhat.com>
2024-02-07 16:40:30 +00:00
.long .Lhere_\@
.popsection
.endm
#endif /* __ASSEMBLY__ */
objtool: Add CONFIG_OBJTOOL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2121207 Conflicts: arch/x86/Kconfig - (diff context) rhel9 doesn't have upstream f6a2c2b2de81 ("x86/Kconfig: Only allow CONFIG_X86_KERNEL_IBT with ld.lld >= 14.0.0") - (diff context) rhel9 doesn't have upstream 4ed308c445a1 ("ftrace: Have architectures opt-in for mcount build time sorting") - rhel9 already has upstream f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs"), which moved config RETPOLINE lower in the file, adds config RETHUNK, etc. - (diff context) rhel9 already has upstream 1e9fdf21a433 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"), which added MMU_GATHER_MERGE_VMAS arch/x86/kernel/alternative.c - rhel9 already has upstream f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs") which introduced CONFIG_RETHUNK lib/Kconfig.debug - rhel9 doesn't have upstream bece04b5b41d ("kcov: fix generic Kconfig dependencies if ARCH_WANTS_NO_INSTR") lib/Kconfig.kcsan - rhel9 doesn't have upstream 69562e4983d9 ("kcsan: Add core support for a subset of weak memory modeling"), so can't update KCSAN_WEAK_MEMORY dependencies commit 03f16cd020eb8bb2eb837e2090086f296a9fa91d Author: Josh Poimboeuf <jpoimboe@redhat.com> Date: Mon Apr 18 09:50:36 2022 -0700 objtool: Add CONFIG_OBJTOOL Now that stack validation is an optional feature of objtool, add CONFIG_OBJTOOL and replace most usages of CONFIG_STACK_VALIDATION with it. CONFIG_STACK_VALIDATION can now be considered to be frame-pointer specific. CONFIG_UNWINDER_ORC is already inherently valid for live patching, so no need to "validate" it. Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Miroslav Benes <mbenes@suse.cz> Link: https://lkml.kernel.org/r/939bf3d85604b2a126412bf11af6e3bd3b872bcb.1650300597.git.jpoimboe@redhat.com Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
2022-10-27 18:28:01 +00:00
#else /* !CONFIG_OBJTOOL */
#ifndef __ASSEMBLY__
x86,objtool: Split UNWIND_HINT_EMPTY in two JIRA: https://issues.redhat.com/browse/RHEL-52683 commit fb799447ae2974a07907906dff5bd4b9e47b7123 Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Wed Mar 1 07:13:12 2023 -0800 x86,objtool: Split UNWIND_HINT_EMPTY in two Mark reported that the ORC unwinder incorrectly marks an unwind as reliable when the unwind terminates prematurely in the dark corners of return_to_handler() due to lack of information about the next frame. The problem is UNWIND_HINT_EMPTY is used in two different situations: 1) The end of the kernel stack unwind before hitting user entry, boot code, or fork entry 2) A blind spot in ORC coverage where the unwinder has to bail due to lack of information about the next frame The ORC unwinder has no way to tell the difference between the two. When it encounters an undefined stack state with 'end=1', it blindly marks the stack reliable, which can break the livepatch consistency model. Fix it by splitting UNWIND_HINT_EMPTY into UNWIND_HINT_UNDEFINED and UNWIND_HINT_END_OF_STACK. Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/fd6212c8b450d3564b855e1cb48404d6277b4d9f.1677683419.git.jpoimboe@kernel.org Conflicts: arch/x86/entry/entry_64.S (context, skipping f71e1d2ff8e6a) arch/x86/kernel/head_64.S (context, skipping 666e1156b2c51) RHEL-only: arch/x86/entry/entry.S: UNWIND_HINT_EMPTY->UNWIND_HINT_UNDEFINED to match upstream. Omitted-fix: b9f174c811e3 ("x86/unwind/orc: Add ELF section with ORC version identifier") see https://issues.redhat.com/browse/RHEL-27234 for discussion Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
2024-09-04 12:06:01 +00:00
#define UNWIND_HINT(type, sp_reg, sp_offset, signal) "\n\t"
#define STACK_FRAME_NON_STANDARD(func)
#define STACK_FRAME_NON_STANDARD_FP(func)
#define ANNOTATE_NOENDBR
#define ASM_REACHABLE
#else
#define ANNOTATE_INTRA_FUNCTION_CALL
x86,objtool: Split UNWIND_HINT_EMPTY in two JIRA: https://issues.redhat.com/browse/RHEL-52683 commit fb799447ae2974a07907906dff5bd4b9e47b7123 Author: Josh Poimboeuf <jpoimboe@kernel.org> Date: Wed Mar 1 07:13:12 2023 -0800 x86,objtool: Split UNWIND_HINT_EMPTY in two Mark reported that the ORC unwinder incorrectly marks an unwind as reliable when the unwind terminates prematurely in the dark corners of return_to_handler() due to lack of information about the next frame. The problem is UNWIND_HINT_EMPTY is used in two different situations: 1) The end of the kernel stack unwind before hitting user entry, boot code, or fork entry 2) A blind spot in ORC coverage where the unwinder has to bail due to lack of information about the next frame The ORC unwinder has no way to tell the difference between the two. When it encounters an undefined stack state with 'end=1', it blindly marks the stack reliable, which can break the livepatch consistency model. Fix it by splitting UNWIND_HINT_EMPTY into UNWIND_HINT_UNDEFINED and UNWIND_HINT_END_OF_STACK. Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/fd6212c8b450d3564b855e1cb48404d6277b4d9f.1677683419.git.jpoimboe@kernel.org Conflicts: arch/x86/entry/entry_64.S (context, skipping f71e1d2ff8e6a) arch/x86/kernel/head_64.S (context, skipping 666e1156b2c51) RHEL-only: arch/x86/entry/entry.S: UNWIND_HINT_EMPTY->UNWIND_HINT_UNDEFINED to match upstream. Omitted-fix: b9f174c811e3 ("x86/unwind/orc: Add ELF section with ORC version identifier") see https://issues.redhat.com/browse/RHEL-27234 for discussion Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
2024-09-04 12:06:01 +00:00
.macro UNWIND_HINT type:req sp_reg=0 sp_offset=0 signal=0
.endm
.macro STACK_FRAME_NON_STANDARD func:req
.endm
.macro ANNOTATE_NOENDBR
.endm
.macro REACHABLE
.endm
#endif
objtool: Add CONFIG_OBJTOOL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2121207 Conflicts: arch/x86/Kconfig - (diff context) rhel9 doesn't have upstream f6a2c2b2de81 ("x86/Kconfig: Only allow CONFIG_X86_KERNEL_IBT with ld.lld >= 14.0.0") - (diff context) rhel9 doesn't have upstream 4ed308c445a1 ("ftrace: Have architectures opt-in for mcount build time sorting") - rhel9 already has upstream f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs"), which moved config RETPOLINE lower in the file, adds config RETHUNK, etc. - (diff context) rhel9 already has upstream 1e9fdf21a433 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"), which added MMU_GATHER_MERGE_VMAS arch/x86/kernel/alternative.c - rhel9 already has upstream f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs") which introduced CONFIG_RETHUNK lib/Kconfig.debug - rhel9 doesn't have upstream bece04b5b41d ("kcov: fix generic Kconfig dependencies if ARCH_WANTS_NO_INSTR") lib/Kconfig.kcsan - rhel9 doesn't have upstream 69562e4983d9 ("kcsan: Add core support for a subset of weak memory modeling"), so can't update KCSAN_WEAK_MEMORY dependencies commit 03f16cd020eb8bb2eb837e2090086f296a9fa91d Author: Josh Poimboeuf <jpoimboe@redhat.com> Date: Mon Apr 18 09:50:36 2022 -0700 objtool: Add CONFIG_OBJTOOL Now that stack validation is an optional feature of objtool, add CONFIG_OBJTOOL and replace most usages of CONFIG_STACK_VALIDATION with it. CONFIG_STACK_VALIDATION can now be considered to be frame-pointer specific. CONFIG_UNWINDER_ORC is already inherently valid for live patching, so no need to "validate" it. Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Miroslav Benes <mbenes@suse.cz> Link: https://lkml.kernel.org/r/939bf3d85604b2a126412bf11af6e3bd3b872bcb.1650300597.git.jpoimboe@redhat.com Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
2022-10-27 18:28:01 +00:00
#endif /* CONFIG_OBJTOOL */
#endif /* _LINUX_OBJTOOL_H */