linux-kernel - Re: [PATCH] tracing/selftests: Ignore __pfx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y+YThNzVa1ECIuYM@hirez.programming.kicks-ass.net>
Date:   Fri, 10 Feb 2023 10:51:00 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>,
        Shuah Khan <shuah@...nel.org>,
        Shuah Khan <skhan@...uxfoundation.org>
Subject: Re: [PATCH] tracing/selftests: Ignore __pfx_ symbols in kprobe test

On Thu, Feb 09, 2023 at 11:23:05PM +0900, Masami Hiramatsu wrote:

> BTW, currently kprobe event rejects this __pfx_ symbols because it is notrace
> symbols, thus we can trace it if CONFIG_KPROBE_EVENTS_ON_NOTRACE=y.
> But I guess it should not probe that place always because it should never
> executed right?

Execution can take place in those ranges when X86_FEATURE_CALL_DEPTH is
enabled or when CONFIG_KCFI && X86_FEATURE_IBT.

In the first of those cases the prefix bytes are filled with call
accounting instructions and every direct call to $sym is patched to
point to __pfx_$sym+6 (aka $sym-10).

  https://lore.kernel.org/all/20220915111039.092790446@infradead.org/

In the second case (FineIBT) it is probably easiest if you look at the
comment in arch/x86/kernel/alternative.c near CONFIG_FINEIBT.

  https://lore.kernel.org/all/20221027092812.185993858@infradead.org/

The __pfx_ and __cfi_ symbols are the same (in fact, when
CONFIG_CFI_CLANG=y the compiler generates them and objtool no longer
emits the __pfx_ symbols).

  https://lore.kernel.org/all/20221028194453.592512209@infradead.org/