Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 20 Jul 2022 14:31:47 -0400
From:   Steven Rostedt <rostedt@goodmis.org>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     Peter Zijlstra <peterz@infradead.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        LKML <linux-kernel@vger.kernel.org>,
        "the arch/x86 maintainers" <x86@kernel.org>,
        Tim Chen <tim.c.chen@linux.intel.com>,
        Josh Poimboeuf <jpoimboe@kernel.org>,
        Andrew Cooper <Andrew.Cooper3@citrix.com>,
        Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
        Johannes Wikner <kwikner@ethz.ch>,
        Alyssa Milburn <alyssa.milburn@linux.intel.com>,
        Jann Horn <jannh@google.com>, "H.J. Lu" <hjl.tools@gmail.com>,
        Joao Moreira <joao.moreira@intel.com>,
        Joseph Nuzman <joseph.nuzman@intel.com>,
        Juergen Gross <jgross@suse.com>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>
Subject: Re: [patch 00/38] x86/retbleed: Call depth tracking mitigation
Message-ID: <20220720143147.4d8a2f8d@gandalf.local.home>
In-Reply-To: <CAHk-=wjdQbdQGKkQxxEcWoUp4SRmBWm=3bS20SbaVe8cLgKLgg@mail.gmail.com>
References: <20220716230344.239749011@linutronix.de>
        <20220720125736.48164a14@gandalf.local.home>
        <CAHk-=wh=Yjy=DmGzzGj-ivyx_w45AHh35eDkpGtajaiO+TX38A@mail.gmail.com>
        <Ytg6UD+0F6zv981o@worktop.programming.kicks-ass.net>
        <20220720135016.3178ffc6@gandalf.local.home>
        <CAHk-=wjdQbdQGKkQxxEcWoUp4SRmBWm=3bS20SbaVe8cLgKLgg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Wed, 20 Jul 2022 11:07:26 -0700
Linus Torvalds <torvalds@linux-foundation.org> wrote:

> On Wed, Jul 20, 2022 at 10:50 AM Steven Rostedt <rostedt@goodmis.org> wrote:
> >
> > [    2.464117] missing return thunk: lkdtm_rodata_do_nothing+0x0/0x8-lkdtm_rodata_do_nothing+0x5/0x8: e9 00 00 00 00  
> 
> Well, that looks like a "jmp" instruction that has never been relocated.
> 
> The 'e9' is 'jmp', the four zeros after it are either "I'm jumping to
> the next instruction" or "I haven't been filled in".
> 
> I'm assuming it's the second case.
> 
> That lkdtm_rodata_do_nothing thing is odd, and does
> 
>     OBJCOPYFLAGS_rodata_objcopy.o   := \
>                             --rename-section
> .noinstr.text=.rodata,alloc,readonly,load,contents
> 
> to put the code in an odd section. I'm assuming this hackery is
> related to it then not getting relocated.
> 

Right, because this looks to be some magic being done for testing purposes:

static void lkdtm_EXEC_RODATA(void)
{
        execute_location(dereference_function_descriptor(lkdtm_rodata_do_nothing),
                         CODE_AS_IS);
}

static void *setup_function_descriptor(func_desc_t *fdesc, void *dst)
{
        if (!have_function_descriptors())
                return dst;

        memcpy(fdesc, do_nothing, sizeof(*fdesc));
        fdesc->addr = (unsigned long)dst;
        barrier();

        return fdesc;
}

static noinline void execute_location(void *dst, bool write)
{
        void (*func)(void);
        func_desc_t fdesc;
        void *do_nothing_text = dereference_function_descriptor(do_nothing);

        pr_info("attempting ok execution at %px\n", do_nothing_text);
        do_nothing();

        if (write == CODE_WRITE) {
                memcpy(dst, do_nothing_text, EXEC_SIZE);
                flush_icache_range((unsigned long)dst,
                                   (unsigned long)dst + EXEC_SIZE);
        }
        pr_info("attempting bad execution at %px\n", dst);
        func = setup_function_descriptor(&fdesc, dst);
        func();
        pr_err("FAIL: func returned\n");
}

And that appears that it wants to crash, as the code is located in readonly
data.

OBJCOPYFLAGS_rodata_objcopy.o   := \
                        --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents

And because the alternatives fixup tries to write to it, and fails due to
it being readonly, I'm guessing we get this warning.

Thus, is there a way to keep this file from being entered into the
return_sites section?

-- Steve