linux-kernel - Re: [Question] About UNWIND_HINT_ENTRY on entry_SYSCALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM7-yPTxgndDR+c1at+y6GngkpKz9h8cFT68cTmdRkcMuGVBQA@mail.gmail.com>
Date:   Mon, 28 Nov 2022 14:31:17 +0900
From:   Yun Levi <ppbuk5246@...il.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        jpoimboe@...nel.org
Subject: Re: [Question] About UNWIND_HINT_ENTRY on entry_SYSCALL_64.

Thanks Peter and Sorry for the late answer.

I got the same result on the vmlinux.o file when I compiled the recent version.

But when I try to test on some of distribution version of linux, (ex)
debian. and When I try to on vmlinux not on vmlinux.o

I got some different results like below.

$ readelf -Ws /usr/lib/debug/boot/vmlinux-5.18.0-0.deb11.4-amd64 |
grep entry_SYSCALL_64
123448:    ffffffff81a00000 404 NOTYPE GLOBAL DEFAULT 1 entry_SYSCALL_64

$ readelf -WS /usr/lib/debug/boot/vmlinux-5.18.0-0.deb11.4-amd64 | grep "\[1\]"
  [ 1] .text             PROGBITS        ffffffff81000000 200000
c01988 00  AX  0   0 4096

123448: ffffffff81a00000   404 NOTYPE  GLOBAL DEFAULT    1 entry_SYSCALL_64


123448: ffffffff81a00000   404 NOTYPE  GLOBAL DEFAULT    1 entry_SYSCALL_64

$ tools/objtool/objtool --dump=orc
/usr/lib/debug/boot/vmlinux-5.18.0-0.deb11.4-amd64 | grep
"text+a00000"
.text+a00000: sp:(und) bp:(und) type:call end:0

Am I wrong?

Thanks!

On Fri, Nov 25, 2022 at 10:06 PM Peter Zijlstra <peterz@...radead.org> wrote:
>
> On Fri, Nov 25, 2022 at 07:41:46PM +0900, Yun Levi wrote:
> > Hello.
> >
> > While I try to see the information related to ORC in vmlinux,
> > I'm trying to find out ORC information related to entry_SYSCALL_64's address.
> >
> > For this, I've tried to take the following step:
> >     1. booting the kernel with the "nokaslr" option.
> >     2. Getting ORC information by "objdump orc dump vmlinux"
> >     3. cat /proc/kallsyms and check the address of "entry_SYSCALL_64"
> >           - In my kernel, It's address .text + a00000
> >     4. Find out related ORC entry gotten in step 2.
> >
> > But, I couldn't find the reason why entry_SYSCALL_64's orc info isn't
> > encoded with end =1.
> > Instead, It was encoded as INVALID ORC entry like:
> >
> >   .text+a00000: sp:(und) bp:(und) type:call end:0
> >
> > IIUC, Some of the code is started with UNWIND_HINT_ENTRY or UNWIND_HINT_EMPTY,
> > it should be encoded with end = 1. But it doesn't.
> >
> > Am I wrong?
>
> $ readelf -Ws defconfig-build/vmlinux.o | grep entry_SYSCALL_64
> 178466: 0000000000000029     0 NOTYPE  GLOBAL DEFAULT   18 entry_SYSCALL_64_safe_stack
> 188596: 0000000000000000   422 NOTYPE  GLOBAL DEFAULT   18 entry_SYSCALL_64
> 210374: 0000000000000038     0 NOTYPE  GLOBAL DEFAULT   18 entry_SYSCALL_64_after_hwframe
>
> $ readelf -WS defconfig-build/vmlinux.o | grep "\[18\]"
> [18] .entry.text       PROGBITS        0000000000000000 e59f00 001838 00  AX  0   0 64
>
> $ tools/objtool/objtool --dump=orc defconfig-build/vmlinux.o | grep ".entry.text+0"
> .entry.text+0: sp:(und) bp:(und) type:call end:1
>
>