From nobody Sat Apr 11 13:36:23 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93C51C38A2D for ; Thu, 27 Oct 2022 09:30:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235014AbiJ0JaJ (ORCPT ); Thu, 27 Oct 2022 05:30:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235033AbiJ0J3o (ORCPT ); Thu, 27 Oct 2022 05:29:44 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE4D4BCAE for ; Thu, 27 Oct 2022 02:29:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Content-Type:MIME-Version:References: Subject:Cc:To:From:Date:Message-ID:Sender:Reply-To:Content-Transfer-Encoding: Content-ID:Content-Description:In-Reply-To; bh=DMAH9kfM4tEFqzW7U3XOFl7UPt7+R8Cga6pBO8g46JQ=; b=l4jn8iSIh7prip20Uz5pPewEvV gAa7AXNkok0jcvCOfRqC2iNwDfWiUIY7shqcgfyhSxBRXGqeuKTwaj75p4xhMsBYlOw5xW/74qv8+ fLeV3bUWua5x+jY7YDCaEG2fbLoTVFltJBlrLwREJCLDKP+K/MrWWu2k9O35zWUBTAoL07S9oCysA RirVDRX8+oY9nAzFYsEVZrIh1vQRj3LC5jkDDOdPGrXtxpBMR5VSK8Okrv4OJSRw7TFJtnrLjz3yy EBdx8JeyY2xWLRRA3YwAstCh3chPREbeufnOJDcL8QiwNwFi0M/4Qem/5pOTb9405V5M0lyTjZP76 zfyzZ4Eg==; Received: from j130084.upc-j.chello.nl ([24.132.130.84] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1onzCi-0005S9-EN; Thu, 27 Oct 2022 09:29:36 +0000 Received: from hirez.programming.kicks-ass.net (hirez.programming.kicks-ass.net [192.168.1.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by noisy.programming.kicks-ass.net (Postfix) with ESMTPS id 8DB39300411; Thu, 27 Oct 2022 11:29:30 +0200 (CEST) Received: by hirez.programming.kicks-ass.net (Postfix, from userid 0) id 6C0DD2C450475; Thu, 27 Oct 2022 11:29:30 +0200 (CEST) Message-ID: <20221027092842.568039454@infradead.org> User-Agent: quilt/0.66 Date: Thu, 27 Oct 2022 11:28:13 +0200 From: Peter Zijlstra To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, peterz@infradead.org, Kees Cook , Sami Tolvanen , Joao Moreira , Josh Poimboeuf , Mark Rutland Subject: [PATCH 1/4] objtool: Add --cfi to generate the .cfi_sites section References: <20221027092812.185993858@infradead.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add the location of all __cfi_##name symbols (as generated by kCFI) to a section such that we might re-write things at kernel boot. Notably; boot time re-hashing and FineIBT are the intended use of this. Signed-off-by: Peter Zijlstra (Intel) --- tools/objtool/builtin-check.c | 1=20 tools/objtool/check.c | 69 +++++++++++++++++++++++++++= +++++ tools/objtool/include/objtool/builtin.h | 1=20 3 files changed, 71 insertions(+) --- a/tools/objtool/builtin-check.c +++ b/tools/objtool/builtin-check.c @@ -79,6 +79,7 @@ const struct option check_options[] =3D { OPT_BOOLEAN('s', "stackval", &opts.stackval, "validate frame pointer rule= s"), OPT_BOOLEAN('t', "static-call", &opts.static_call, "annotate static calls= "), OPT_BOOLEAN('u', "uaccess", &opts.uaccess, "validate uaccess rules for SM= AP"), + OPT_BOOLEAN(0 , "cfi", &opts.cfi, "annotate kernel control flow integrit= y (kCFI) function preambles"), OPT_CALLBACK_OPTARG(0, "dump", NULL, NULL, "orc", "dump metadata", parse_= dump), =20 OPT_GROUP("Options:"), --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -861,6 +861,68 @@ static int create_ibt_endbr_seal_section return 0; } =20 +static int create_cfi_sections(struct objtool_file *file) +{ + struct section *sec, *s; + struct symbol *sym; + unsigned int *loc; + int idx; + + sec =3D find_section_by_name(file->elf, ".cfi_sites"); + if (sec) { + INIT_LIST_HEAD(&file->call_list); + WARN("file already has .cfi_sites section, skipping"); + return 0; + } + + idx =3D 0; + for_each_sec(file, s) { + if (!s->text) + continue; + + list_for_each_entry(sym, &s->symbol_list, list) { + if (sym->type !=3D STT_FUNC) + continue; + + if (strncmp(sym->name, "__cfi_", 6)) + continue; + + idx++; + } + } + + sec =3D elf_create_section(file->elf, ".cfi_sites", 0, sizeof(unsigned in= t), idx); + if (!sec) + return -1; + + idx =3D 0; + for_each_sec(file, s) { + if (!s->text) + continue; + + list_for_each_entry(sym, &s->symbol_list, list) { + if (sym->type !=3D STT_FUNC) + continue; + + if (strncmp(sym->name, "__cfi_", 6)) + continue; + + loc =3D (unsigned int *)sec->data->d_buf + idx; + memset(loc, 0, sizeof(unsigned int)); + + if (elf_add_reloc_to_insn(file->elf, sec, + idx * sizeof(unsigned int), + R_X86_64_PC32, + s, sym->offset)) + return -1; + + idx++; + } + } + + return 0; +} + static int create_mcount_loc_sections(struct objtool_file *file) { struct section *sec; @@ -4397,6 +4459,13 @@ int check(struct objtool_file *file) if (ret < 0) goto out; warnings +=3D ret; + } + + if (opts.cfi) { + ret =3D create_cfi_sections(file); + if (ret < 0) + goto out; + warnings +=3D ret; } =20 if (opts.rethunk) { --- a/tools/objtool/include/objtool/builtin.h +++ b/tools/objtool/include/objtool/builtin.h @@ -26,6 +26,7 @@ struct opts { bool stackval; bool static_call; bool uaccess; + bool cfi; =20 /* options: */ bool backtrace;