linux-kernel - Re: [PATCH] gcov,x86: Mark GCOV broken for x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210614183135.hfuaowojnq4alo44@google.com>
Date:   Mon, 14 Jun 2021 11:31:35 -0700
From:   Fangrui Song <maskray@...gle.com>
To:     Peter Zijlstra <peterz@...radead.org>, ndesaulniers@...gle.com
Cc:     x86@...nel.org, oberpar@...ux.ibm.com,
        linux-kernel@...r.kernel.org, johannes.berg@...el.com,
        nathan@...nel.org, keescook@...omium.org, elver@...gle.com,
        mark.rutland@....com
Subject: Re: [PATCH] gcov,x86: Mark GCOV broken for x86

> On Mon, Jun 14, 2021 at 9:20 AM Peter Zijlstra <peterz@...radead.org> wrote:
> >
> > On Mon, Jun 14, 2021 at 09:05:04AM -0700, Nick Desaulniers wrote:
> > > On Mon, Jun 14, 2021 at 3:17 AM Peter Zijlstra <peterz@...radead.org> wrote:
> > > >
> > > >
> > > > As recently discovered, there is no function attribute to disable the
> > > > -fprofile-generate instrumentation. As such, GCOV is fundamentally
> > > > incompatible with architectures that rely on 'noinstr' for correctness.
> > >
> > > Is there context for comment, or is this patch meant as a joke?
> >
> > Only if you think recursion in exception entry code is funny.
> >
> > noinstr *MUST* disable any and all compiler generated instrumentation,
> > currently it that isn't the case for -fprofile-gnerate, nor
> > -fprofile-arc.
> >
> > Look for all the fun we had with KCOV back then. Luckily KCOV
> > instrumentation was trivial to patch out using objtool, so that's what
> > x86 is currently doing.
> >
> > Luckily both compilers grew a __no_sanitize_coverage recently and we no
> > longer have to rely on objtool fixing up the compiler output for much
> > longer.
> >
> >   https://lkml.kernel.org/r/20210527194448.3470080-1-elver@google.com
> >
> > Now all we need is one more such attribute to kill -fprofile-* stuff.
> 
> __attribute__((no_instrument_function)) is already wired to not emit
> calls to mcount()/fentry().  I think extending it to also apply to
> coverage (-fprofile-arcs) and instrumentation based profiling
> (-fprofile-generate) is reasonable.

__attribute__((no_instrument_function)) seems specific to
-finstrument-functions.  Somehow -pg uses it as well. The name may not be
generic, so it may be odd to exclude various instrumentations (there are a ton)
under this generic attribute.

I'd like to understand the definition of notrace and noinstr.

With value profiling disabled, clang -fprofile-generate/gcc -fprofile-arcs
don't add function calls. They just increment a counter in a writable section.
Why isn't that allowed for noinstr functions?

I can understand why -fpatchable-function-entry= is excluded: -fpatchable-function-entry=
causes the section __patchable_function_entries and the kernel may change the nops into call
instructions. And a function call may not be suitable for certain functions.
But I don't understand why incrementing a counter should be disallowed.