linux-kernel - Re: [RFC PATCH v2 00/17] objtool: Function validation tracing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250924074206.GW4068168@noisy.programming.kicks-ass.net>
Date: Wed, 24 Sep 2025 09:42:06 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Alexandre Chartre <alexandre.chartre@...cle.com>
Cc: linux-kernel@...r.kernel.org, mingo@...nel.org, jpoimboe@...nel.org
Subject: Re: [RFC PATCH v2 00/17] objtool: Function validation tracing

On Wed, Sep 24, 2025 at 09:36:49AM +0200, Peter Zijlstra wrote:
> > Example 2 (--disas option): Disassemble perf_get_x86_pmu_capability()
> > ---------------------------------------------------------------------
> > 
> > $ ./tools/objtool/objtool --disas=perf_get_x86_pmu_capability --link vmlinux.o
> > perf_get_x86_pmu_capability:
> >   d000:  perf_get_x86_pmu_capability         endbr64                                                   
> >   d004:  perf_get_x86_pmu_capability+0x4     callq  __fentry__                                         
> >   d009:  perf_get_x86_pmu_capability+0x9     mov    %rdi,%rdx                                          
> >                                              <alternative.d00c> default - begin
> >   d00c:  perf_get_x86_pmu_capability+0xc     | jmpq   .altinstr_aux+0x90                               
> 
> (you probably need to relocate the target -- we never jump into alinstr)
> 
> >                                              <alternative.d00c> default - end
> >                                              <alternative.d00c> 1/2 - begin
> >                                              | <fake nop> (5 bytes)                                    
> >                                              <alternative.d00c> 1/2 end
> >                                              <alternative.d00c> 2/2 - begin
> >    5e5:  .altinstr_replacement+0x5e5         | jmpq   perf_get_x86_pmu_capability+0x3f                 
> >                                              <alternative.d00c> 2/2 end
> 
> Idem; the above is *really* hard to decipher.
> 
>   d00c:  perf_get_x86_pmu_capability+0xc | jmpq   .altinstr_aux+0x90 | nop5 | jmpq   perf_get_x86_pmu_capability+0x3f
> 
> >   d011:  perf_get_x86_pmu_capability+0x11    ud2                                                       
> >   d013:  perf_get_x86_pmu_capability+0x13    movq   $0x0,(%rdx)                                        
> >   d01a:  perf_get_x86_pmu_capability+0x1a    movq   $0x0,0x8(%rdx)                                     
> >   d022:  perf_get_x86_pmu_capability+0x22    movq   $0x0,0x10(%rdx)                                    
> >   d02a:  perf_get_x86_pmu_capability+0x2a    movq   $0x0,0x18(%rdx)                                    
> >   d032:  perf_get_x86_pmu_capability+0x32    xor    %eax,%eax                                          
> >   d034:  perf_get_x86_pmu_capability+0x34    xor    %edx,%edx                                          
> >   d036:  perf_get_x86_pmu_capability+0x36    xor    %ecx,%ecx                                          
> >   d038:  perf_get_x86_pmu_capability+0x38    xor    %edi,%edi                                          
> >   d03a:  perf_get_x86_pmu_capability+0x3a    jmpq   __x86_return_thunk                                 
> >   d03f:  perf_get_x86_pmu_capability+0x3f    cmpq   $0x0,0x0(%rip)        # x86_pmu+0x10               
> >   d047:  perf_get_x86_pmu_capability+0x47    je     d013 <perf_get_x86_pmu_capability+0x13>            
> >   d049:  perf_get_x86_pmu_capability+0x49    mov    0x0(%rip),%eax        # x86_pmu+0x8                
> >   d04f:  perf_get_x86_pmu_capability+0x4f    mov    %eax,(%rdi)                                        
> >                                              <jump alternative.d051> default
> >   d051:  perf_get_x86_pmu_capability+0x51    | xchg   %ax,%ax                                          
> >                                              <jump alternative.d051> else
> >   d051:  perf_get_x86_pmu_capability+0x51    | jmp    d053 <perf_get_x86_pmu_capability+0x53>
> >                                              <jump alternative.d051> end
> 
> this is a jump_label; if we would retain the whole 'key' reloc, and
> not only the key_addend, you could make it something like:
> 
>   d051:  perf_get_x86_pmu_capability+0x51      [ jmp.d8 d053 <perf_get_x86_pmu_capability+0x53> ] * perf_is_hybrid
> 
> (also, this here reads like it is either nop2 or jmp.d8 +0, which is
> 'weird')

Also, particularly in alternatives I think it makes sense to make
explicit distinction between jmp.d8 and jmp.d32 (and similar for Jcc.d8
/ Jcc.d32).