Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

objtool warnings in KernelCI report #945

Closed
nathanchance opened this issue Dec 15, 2022 · 4 comments
Closed

objtool warnings in KernelCI report #945

nathanchance opened this issue Dec 15, 2022 · 4 comments
Labels
• kbuild Related to building the kernel, `make`, `Kbuild`, `Kconfig` options...

Comments

@nathanchance
Copy link
Member

Apologies if this has been reported already! KernelCI recently started testing with Rust and it seems that there are quite a few objtool warnings for Rust code: https://lore.kernel.org/llvm/[email protected]/
@nathanchance nathanchance added the • kbuild Related to building the kernel, `make`, `Kbuild`, `Kconfig` options... label Dec 15, 2022
@ojeda ojeda mentioned this issue Dec 17, 2022
Merged
@ojeda
Copy link
Member

ojeda commented Dec 17, 2022 •
edited
Loading

Thanks for the report as usual! We briefly discussed it on a meeting on Wednesday.

IBT/Retpoline/Rethunk require a few things to be in place:

  • Passing -Zcf-protection=branch together with a new flag -Zno-jump-tables to mimic GCC/Clang's which rustc currently does not have. I have submitted a PR: Add -Zno-jump-tables rust-lang/rust#105812.

  • New flags -Zfunction-return=thunk-extern to be implemented and so on.

In a patched rustc 1.66.0 with -Zno-jump-tables and a hacky -Zfunction-return=thunk-extern + an upgraded-to-Rust-1.66.0 kernel, the only warning remaining in defconfig I have is:

vmlinux.o: warning: objtool: rust_begin_unwind+0x70: unreachable instruction

The resulting kernel boots in QEMU, but will need to be tested properly in real hardware.

We will have to wait at least a couple months to get all the pieces in place, so I have submitted a PR to our KernelCI config to disable these: kernelci/kernelci-core#1580

staging-kernelci-org pushed a commit to kernelci/kernelci-core that referenced this issue Dec 19, 2022
@ojeda
build-configs: rust: disable IBT/Retpoline/Rethunk for the moment
296d90d 
Until we have the needed pieces in place in `rustc` and the kernel
to support IBT/Retpoline/Rethunk; disable the relevant configs
for the moment.

This avoids the 2000+ warnings from `objtool` that we currently
generate in the logs.

Link: https://storage.kernelci.org/mainline/master/v6.1-11554-g785d21ba2f44/x86_64/x86_64_defconfig+rust/rustc-1.62/logs/build-warnings.log
Link: Rust-for-Linux/linux#945
Signed-off-by: Miguel Ojeda <[email protected]>
@ojeda ojeda mentioned this issue Jan 6, 2023
Open
11 tasks
aliceinwire pushed a commit to kernelci/kernelci-core that referenced this issue Jan 11, 2023
@ojeda @aliceinwire
build-configs: rust: disable IBT/Retpoline/Rethunk for the moment
80851e4 
Until we have the needed pieces in place in `rustc` and the kernel
to support IBT/Retpoline/Rethunk; disable the relevant configs
for the moment.

This avoids the 2000+ warnings from `objtool` that we currently
generate in the logs.

Link: https://storage.kernelci.org/mainline/master/v6.1-11554-g785d21ba2f44/x86_64/x86_64_defconfig+rust/rustc-1.62/logs/build-warnings.log
Link: Rust-for-Linux/linux#945
Signed-off-by: Miguel Ojeda <[email protected]>
@ojeda
Copy link
Member

ojeda commented Oct 26, 2023

For reference, a couple updates:

@ojeda
Copy link
Member

ojeda commented Aug 4, 2024

The series https://lore.kernel.org/rust-for-linux/[email protected]/ should fix all of those warnings.

ojeda added a commit to ojeda/linux that referenced this issue Aug 17, 2024
@ojeda
x86/rust: support MITIGATION_RETPOLINE
eceb230 
Support `MITIGATION_RETPOLINE` by enabling the target features that
Clang does.

The existing target feature being enabled was a leftover from
our old `rust` branch, and it is not enough: the target feature
`retpoline-external-thunk` only implies `retpoline-indirect-calls`, but
not `retpoline-indirect-branches` (see LLVM's `X86.td`), unlike Clang's
flag of the same name `-mretpoline-external-thunk` which does imply both
(see Clang's `lib/Driver/ToolChains/Arch/X86.cpp`).

Without this, `objtool` would complain if enabled for Rust, e.g.:

    rust/core.o: warning: objtool:
    _R...escape_default+0x13: indirect jump found in RETPOLINE build

In addition, change the comment to note that LLVM is the one disabling
jump tables when retpoline is enabled, thus we do not need to use
`-Zno-jump-tables` for Rust here -- see commit c58f2166ab39 ("Introduce
the "retpoline" x86 mitigation technique ...") [1]:

    The goal is simple: avoid generating code which contains an indirect
    branch that could have its prediction poisoned by an attacker. In
    many cases, the compiler can simply use directed conditional
    branches and a small search tree. LLVM already has support for
    lowering switches in this way and the first step of this patch is
    to disable jump-table lowering of switches and introduce a pass to
    rewrite explicit indirectbr sequences into a switch over integers.

As well as a live example at [2].

These should be eventually enabled via `-Ctarget-feature` when `rustc`
starts recognizing them (or via a new dedicated flag) [3].

Cc: Daniel Borkmann <[email protected]>
Link: llvm/llvm-project@c58f216 [1]
Link: https://godbolt.org/z/G4YPr58qG [2]
Link: rust-lang/rust#116852 [3]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Link: Rust-for-Linux#945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
ojeda added a commit to ojeda/linux that referenced this issue Aug 17, 2024
@ojeda
x86/rust: support MITIGATION_RETHUNK
fbac858 
The Rust compiler added support for `-Zfunction-return=thunk-extern` [1]
in 1.76.0 [2], i.e. the equivalent of `-mfunction-return=thunk-extern`.
Thus add support for `MITIGATION_RETHUNK`.

Without this, `objtool` would warn if enabled for Rust and already warns
under IBT builds, e.g.:

    samples/rust/rust_print.o: warning: objtool:
    _R...init+0xa5c: 'naked' return found in RETHUNK build

Link: rust-lang/rust#116853 [1]
Link: rust-lang/rust#116892 [2]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Reviewed-by: Thomas Gleixner <[email protected]>
Link: Rust-for-Linux#945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
ojeda added a commit that referenced this issue Aug 18, 2024
@ojeda
x86/rust: support MITIGATION_RETPOLINE
b9cfa87 
Support `MITIGATION_RETPOLINE` by enabling the target features that
Clang does.

The existing target feature being enabled was a leftover from
our old `rust` branch, and it is not enough: the target feature
`retpoline-external-thunk` only implies `retpoline-indirect-calls`, but
not `retpoline-indirect-branches` (see LLVM's `X86.td`), unlike Clang's
flag of the same name `-mretpoline-external-thunk` which does imply both
(see Clang's `lib/Driver/ToolChains/Arch/X86.cpp`).

Without this, `objtool` would complain if enabled for Rust, e.g.:

    rust/core.o: warning: objtool:
    _R...escape_default+0x13: indirect jump found in RETPOLINE build

In addition, change the comment to note that LLVM is the one disabling
jump tables when retpoline is enabled, thus we do not need to use
`-Zno-jump-tables` for Rust here -- see commit c58f2166ab39 ("Introduce
the "retpoline" x86 mitigation technique ...") [1]:

    The goal is simple: avoid generating code which contains an indirect
    branch that could have its prediction poisoned by an attacker. In
    many cases, the compiler can simply use directed conditional
    branches and a small search tree. LLVM already has support for
    lowering switches in this way and the first step of this patch is
    to disable jump-table lowering of switches and introduce a pass to
    rewrite explicit indirectbr sequences into a switch over integers.

As well as a live example at [2].

These should be eventually enabled via `-Ctarget-feature` when `rustc`
starts recognizing them (or via a new dedicated flag) [3].

Cc: Daniel Borkmann <[email protected]>
Link: llvm/llvm-project@c58f216 [1]
Link: https://godbolt.org/z/G4YPr58qG [2]
Link: rust-lang/rust#116852 [3]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Link: #945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
ojeda added a commit that referenced this issue Aug 18, 2024
@ojeda
x86/rust: support MITIGATION_RETHUNK
c670ecb 
The Rust compiler added support for `-Zfunction-return=thunk-extern` [1]
in 1.76.0 [2], i.e. the equivalent of `-mfunction-return=thunk-extern`.
Thus add support for `MITIGATION_RETHUNK`.

Without this, `objtool` would warn if enabled for Rust and already warns
under IBT builds, e.g.:

    samples/rust/rust_print.o: warning: objtool:
    _R...init+0xa5c: 'naked' return found in RETHUNK build

Link: rust-lang/rust#116853 [1]
Link: rust-lang/rust#116892 [2]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Reviewed-by: Thomas Gleixner <[email protected]>
Link: #945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
ojeda added a commit that referenced this issue Aug 18, 2024
@ojeda
x86/rust: support MITIGATION_RETPOLINE
284a3ac 
Support `MITIGATION_RETPOLINE` by enabling the target features that
Clang does.

The existing target feature being enabled was a leftover from
our old `rust` branch, and it is not enough: the target feature
`retpoline-external-thunk` only implies `retpoline-indirect-calls`, but
not `retpoline-indirect-branches` (see LLVM's `X86.td`), unlike Clang's
flag of the same name `-mretpoline-external-thunk` which does imply both
(see Clang's `lib/Driver/ToolChains/Arch/X86.cpp`).

Without this, `objtool` would complain if enabled for Rust, e.g.:

    rust/core.o: warning: objtool:
    _R...escape_default+0x13: indirect jump found in RETPOLINE build

In addition, change the comment to note that LLVM is the one disabling
jump tables when retpoline is enabled, thus we do not need to use
`-Zno-jump-tables` for Rust here -- see commit c58f2166ab39 ("Introduce
the "retpoline" x86 mitigation technique ...") [1]:

    The goal is simple: avoid generating code which contains an indirect
    branch that could have its prediction poisoned by an attacker. In
    many cases, the compiler can simply use directed conditional
    branches and a small search tree. LLVM already has support for
    lowering switches in this way and the first step of this patch is
    to disable jump-table lowering of switches and introduce a pass to
    rewrite explicit indirectbr sequences into a switch over integers.

As well as a live example at [2].

These should be eventually enabled via `-Ctarget-feature` when `rustc`
starts recognizing them (or via a new dedicated flag) [3].

Cc: Daniel Borkmann <[email protected]>
Link: llvm/llvm-project@c58f216 [1]
Link: https://godbolt.org/z/G4YPr58qG [2]
Link: rust-lang/rust#116852 [3]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Link: #945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
ojeda added a commit that referenced this issue Aug 18, 2024
@ojeda
x86/rust: support MITIGATION_RETHUNK
d786855 
The Rust compiler added support for `-Zfunction-return=thunk-extern` [1]
in 1.76.0 [2], i.e. the equivalent of `-mfunction-return=thunk-extern`.
Thus add support for `MITIGATION_RETHUNK`.

Without this, `objtool` would warn if enabled for Rust and already warns
under IBT builds, e.g.:

    samples/rust/rust_print.o: warning: objtool:
    _R...init+0xa5c: 'naked' return found in RETHUNK build

Link: rust-lang/rust#116853 [1]
Link: rust-lang/rust#116892 [2]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Reviewed-by: Thomas Gleixner <[email protected]>
Link: #945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
@ojeda
Copy link
Member

ojeda commented Aug 19, 2024

Applied to rust-next -- if anyone notices new warnings, please let us know. Thanks!

@ojeda ojeda closed this as completed Aug 19, 2024
Darksonn pushed a commit to Darksonn/linux that referenced this issue Aug 22, 2024
@ojeda @Darksonn
x86/rust: support MITIGATION_RETPOLINE
a6dc7cc 
Support `MITIGATION_RETPOLINE` by enabling the target features that
Clang does.

The existing target feature being enabled was a leftover from
our old `rust` branch, and it is not enough: the target feature
`retpoline-external-thunk` only implies `retpoline-indirect-calls`, but
not `retpoline-indirect-branches` (see LLVM's `X86.td`), unlike Clang's
flag of the same name `-mretpoline-external-thunk` which does imply both
(see Clang's `lib/Driver/ToolChains/Arch/X86.cpp`).

Without this, `objtool` would complain if enabled for Rust, e.g.:

    rust/core.o: warning: objtool:
    _R...escape_default+0x13: indirect jump found in RETPOLINE build

In addition, change the comment to note that LLVM is the one disabling
jump tables when retpoline is enabled, thus we do not need to use
`-Zno-jump-tables` for Rust here -- see commit c58f2166ab39 ("Introduce
the "retpoline" x86 mitigation technique ...") [1]:

    The goal is simple: avoid generating code which contains an indirect
    branch that could have its prediction poisoned by an attacker. In
    many cases, the compiler can simply use directed conditional
    branches and a small search tree. LLVM already has support for
    lowering switches in this way and the first step of this patch is
    to disable jump-table lowering of switches and introduce a pass to
    rewrite explicit indirectbr sequences into a switch over integers.

As well as a live example at [2].

These should be eventually enabled via `-Ctarget-feature` when `rustc`
starts recognizing them (or via a new dedicated flag) [3].

Cc: Daniel Borkmann <[email protected]>
Link: llvm/llvm-project@c58f216 [1]
Link: https://godbolt.org/z/G4YPr58qG [2]
Link: rust-lang/rust#116852 [3]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Link: Rust-for-Linux#945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
Darksonn pushed a commit to Darksonn/linux that referenced this issue Aug 22, 2024
@ojeda @Darksonn
x86/rust: support MITIGATION_RETHUNK
189de6d 
The Rust compiler added support for `-Zfunction-return=thunk-extern` [1]
in 1.76.0 [2], i.e. the equivalent of `-mfunction-return=thunk-extern`.
Thus add support for `MITIGATION_RETHUNK`.

Without this, `objtool` would warn if enabled for Rust and already warns
under IBT builds, e.g.:

    samples/rust/rust_print.o: warning: objtool:
    _R...init+0xa5c: 'naked' return found in RETHUNK build

Link: rust-lang/rust#116853 [1]
Link: rust-lang/rust#116892 [2]
Reviewed-by: Gary Guo <[email protected]>
Tested-by: Alice Ryhl <[email protected]>
Tested-by: Benno Lossin <[email protected]>
Reviewed-by: Thomas Gleixner <[email protected]>
Link: Rust-for-Linux#945
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Miguel Ojeda <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
• kbuild Related to building the kernel, `make`, `Kbuild`, `Kconfig` options...
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ojeda @nathanchance