linux-kernel - Re: [PATCH v2] objtool,ftrace: Implement UNWIND_HINT_RET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Apr 2020 09:39:16 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     tglx@...utronix.de, linux-kernel@...r.kernel.org, x86@...nel.org,
        mhiramat@...nel.org, mbenes@...e.cz,
        Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [PATCH v2] objtool,ftrace: Implement UNWIND_HINT_RET_OFFSET

On Wed, Apr 01, 2020 at 04:22:26PM +0200, Peter Zijlstra wrote:
> > > --- a/arch/x86/include/asm/orc_types.h
> > > +++ b/arch/x86/include/asm/orc_types.h
> > > @@ -58,8 +58,13 @@
> > >  #define ORC_TYPE_CALL			0
> > >  #define ORC_TYPE_REGS			1
> > >  #define ORC_TYPE_REGS_IRET		2
> > > -#define UNWIND_HINT_TYPE_SAVE		3
> > > -#define UNWIND_HINT_TYPE_RESTORE	4
> > > +
> > > +/*
> > > + * RET_OFFSET: Used on instructions that terminate a function; mostly RETURN
> > > + * and sibling calls. On these, sp_offset denotes the expected offset from
> > > + * initial_func_cfi.
> > > + */
> > > +#define UNWIND_HINT_TYPE_RET_OFFSET	3
> > 
> > I think this comment belongs at the UNWIND_HINT_RET_OFFSET macro
> > definition.
> 
> Humph, ok, but there's two of those :/

Just commenting the asm one should be fine I think.

That way a reader of code using the macro is more likely to understand
its purpose.

> > > --- a/arch/x86/kernel/ftrace.c
> > > +++ b/arch/x86/kernel/ftrace.c
> > > @@ -282,7 +282,8 @@ static inline void tramp_free(void *tram
> > > 
> > >  /* Defined as markers to the end of the ftrace default trampolines */
> > >  extern void ftrace_regs_caller_end(void);
> > > -extern void ftrace_epilogue(void);
> > > +extern void ftrace_regs_caller_ret(void);
> > > +extern void ftrace_caller_end(void);
> > >  extern void ftrace_caller_op_ptr(void);
> > >  extern void ftrace_regs_caller_op_ptr(void);
> > > 
> > > @@ -334,7 +335,7 @@ create_trampoline(struct ftrace_ops *ops
> > >  		call_offset = (unsigned long)ftrace_regs_call;
> > >  	} else {
> > >  		start_offset = (unsigned long)ftrace_caller;
> > > -		end_offset = (unsigned long)ftrace_epilogue;
> > > +		end_offset = (unsigned long)ftrace_caller_end;
> > >  		op_offset = (unsigned long)ftrace_caller_op_ptr;
> > >  		call_offset = (unsigned long)ftrace_call;
> > >  	}
> > > @@ -366,6 +367,13 @@ create_trampoline(struct ftrace_ops *ops
> > >  	if (WARN_ON(ret < 0))
> > >  		goto fail;
> > > 
> > > +	if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) {
> > > +		ip = ftrace_regs_caller_ret;
> > > +		ret = probe_kernel_read(ip, (void *)retq, RET_SIZE);
> > > +		if (WARN_ON(ret < 0))
> > > +			goto fail;
> > > +	}
> > > +
> > 
> > Hm?  This function creates a trampoline but it looks like this change is
> > overwriting the original ftrace_64 code itself?
> 
> Ahh. So if you look at what the trampoline copies, you'll note we'll
> copy until -- but *NOT* including -- the jmp ftrace_epilogue. Instead
> we'll write a RET at the end.
> 
> However, due to splitting the return path, such that each instruction
> has a unique stack offset, we now have a second jmp ftrace_epilogue in
> the middle of the function. That too needs to be overwritten by a RET.

Right, but 'ip' needs to point to the trampoline's version of
'ftrace_regs_caller_ret', not the original ftrace_64 version.

> > > --- a/tools/objtool/Makefile
> > > +++ b/tools/objtool/Makefile
> > > @@ -31,7 +31,7 @@ INCLUDES := -I$(srctree)/tools/include \
> > >  	    -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
> > >  	    -I$(srctree)/tools/arch/$(SRCARCH)/include
> > >  WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
> > > -CFLAGS   := -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
> > > +CFLAGS   := -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -ggdb3 $(INCLUDES) $(LIBELF_FLAGS)
> > >  LDFLAGS  += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
> > 
> > Why?  Smells like a separate patch at least.
> 
> Oh, whoops :-) I keep doing this every time I need to run gdb on it.
> I'll make it go away.

Ha, I do something similar, I just add -O0 to CFLAGS.

-- 
Josh