linux-kernel - Re: [RFC PATCH -next v2 0/4] arm64/ftrace: support dynamic trampoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 25 May 2022 09:58:45 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Mark Rutland <mark.rutland@....com>
Cc:     "Wangshaobo (bobo)" <bobo.shaobowang@...wei.com>,
        cj.chengjian@...wei.com, huawei.libin@...wei.com,
        xiexiuqi@...wei.com, liwei391@...wei.com,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        catalin.marinas@....com, will@...nel.org, zengshun.wu@...look.com
Subject: Re: [RFC PATCH -next v2 0/4] arm64/ftrace: support dynamic
 trampoline

On Wed, 25 May 2022 13:45:13 +0100
Mark Rutland <mark.rutland@....com> wrote:

> ... the compiler places 3 NOPs *before* any BTI, and 2 NOPs *after* any BTI,
> still recording the location of the first NOP. So in the two cases we get:
> 
> 		NOP		<--- recorded location
> 		NOP
> 		NOP
> 	__func_without_bti:
> 		NOP
> 		NOP
> 
> 		NOP		<--- recorded location
> 		NOP
> 		NOP
> 	__func_with_bti:
> 		BTI
> 		NOP
> 		NOP

Are you saying that the above "recorded location" is what we have in
mcount_loc section? If that's the case, we will need to modify it to point
to something that kallsyms will recognize (ie. sym+0 or greater). Because
that will cause set_ftrace_filter to fail as well.

-- Steve


> 
> ... so where we want to patch one of the later nops to banch to a pre-function
> NOP, we need to know whether or not the compiler generated a BTI. We can
> discover discover that either by:
> 
> * Checking whether the recorded location is at sym+0 (no BTI) or sym+4 (BTI).
> 
> * Reading the instruction before the recorded location, and seeing if this is a
>   BTI.
> 
> ... and depending on how we handle thigns the two cases *might* need different
> trampolines.