| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <YCMBmNujLsMg0Q0q@krava>
Date: Tue, 9 Feb 2021 22:41:44 +0100
From: Jiri Olsa <jolsa@...hat.com>
To: Nick Desaulniers <ndesaulniers@...gle.com>,
Nathan Chancellor <nathan@...nel.org>
Cc: Andrii Nakryiko <andrii.nakryiko@...il.com>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>,
Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
clang-built-linux <clang-built-linux@...glegroups.com>,
Veronika Kabatova <vkabatov@...hat.com>,
Jiri Olsa <jolsa@...nel.org>,
Arnaldo Carvalho de Melo <acme@...hat.com>,
Daniel Kiss <daniel.kiss@....com>
Subject: Re: FAILED unresolved symbol vfs_truncate on arm64 with LLVM
On Tue, Feb 09, 2021 at 09:50:48PM +0100, Jiri Olsa wrote:
> On Tue, Feb 09, 2021 at 12:09:31PM -0800, Nick Desaulniers wrote:
> > On Tue, Feb 9, 2021 at 11:06 AM Jiri Olsa <jolsa@...hat.com> wrote:
> > >
> > > On Tue, Feb 09, 2021 at 05:13:42PM +0100, Jiri Olsa wrote:
> > > > On Tue, Feb 09, 2021 at 04:09:36PM +0100, Jiri Olsa wrote:
> > > >
> > > > SNIP
> > > >
> > > > > > > > > DW_AT_prototyped (true)
> > > > > > > > > DW_AT_type (0x01cfdfe4 "long int")
> > > > > > > > > DW_AT_external (true)
> > > > > > > > >
> > > > > > > >
> > > > > > > > Ok, the problem appears to be not in DWARF, but in mcount_loc data.
> > > > > > > > vfs_truncate's address is not recorded as ftrace-attachable, and thus
> > > > > > > > pahole ignores it. I don't know why this happens and it's quite
> > > > > > > > strange, given vfs_truncate is just a normal global function.
> > > > > >
> > > > > > right, I can't see it in mcount adresses.. but it begins with instructions
> > > > > > that appears to be nops, which would suggest it's traceable
> > > > > >
> > > > > > ffff80001031f430 <vfs_truncate>:
> > > > > > ffff80001031f430: 5f 24 03 d5 hint #34
> > > > > > ffff80001031f434: 1f 20 03 d5 nop
> > > > > > ffff80001031f438: 1f 20 03 d5 nop
> > > > > > ffff80001031f43c: 3f 23 03 d5 hint #25
> > > > > >
> > > > > > > >
> > > > > > > > I'd like to understand this issue before we try to fix it, but there
> > > > > > > > is at least one improvement we can make: pahole should check ftrace
> > > > > > > > addresses only for static functions, not the global ones (global ones
> > > > > > > > should be always attachable, unless they are special, e.g., notrace
> > > > > > > > and stuff). We can easily check that by looking at the corresponding
> > > > > > > > symbol. But I'd like to verify that vfs_truncate is ftrace-attachable
> > > > >
> > > > > I'm still trying to build the kernel.. however ;-)
> > > >
> > > > I finally reproduced.. however arm's not using mcount_loc
> > > > but some other special section.. so it's new mess for me
> > >
> > > so ftrace data actualy has vfs_truncate address but with extra 4 bytes:
> > >
> > > ffff80001031f434
> > >
> > > real vfs_truncate address:
> > >
> > > ffff80001031f430 g F .text 0000000000000168 vfs_truncate
> > >
> > > vfs_truncate disasm:
> > >
> > > ffff80001031f430 <vfs_truncate>:
> > > ffff80001031f430: 5f 24 03 d5 hint #34
> > > ffff80001031f434: 1f 20 03 d5 nop
> > > ffff80001031f438: 1f 20 03 d5 nop
> > > ffff80001031f43c: 3f 23 03 d5 hint #25
> > >
> > > thats why we don't match it in pahole.. I checked few other functions
> > > and some have the same problem and some match the function boundary
> > >
> > > those that match don't have that first hint instrucion, like:
> > >
> > > ffff800010321e40 <do_faccessat>:
> > > ffff800010321e40: 1f 20 03 d5 nop
> > > ffff800010321e44: 1f 20 03 d5 nop
> > > ffff800010321e48: 3f 23 03 d5 hint #25
> > >
> > > any hints about hint instructions? ;-)
> >
> > aarch64 makes *some* newer instructions reuse the "hint" ie "nop"
> > encoding space to make software backwards compatible on older hardware
> > that doesn't support such instructions. Is this BTI, perhaps? (The
> > function is perhaps the destination of an indirect call?)
>
> I see, I think we can't take ftrace addresses as start of the function
> because there could be extra instruction(s) related to the call before
> it like here
>
> we need to check ftrace address be within the function/symbol,
> not exact start
the build with gcc passed only because mcount data are all zeros
and pahole falls back to 'not-ftrace' mode
$ llvm-objdump -t build/aarch64-gcc/vmlinux | grep mcount
ffff800011eb4840 g .init.data 0000000000000000 __stop_mcount_loc
ffff800011e47d58 g .init.data 0000000000000000 __start_mcount_loc
$ llvm-objdump -s build/aarch64-gcc/vmlinux
ffff800011e47d50 00000000 00000000 00000000 00000000 ................
ffff800011e47d60 00000000 00000000 00000000 00000000 ................
ffff800011e47d70 00000000 00000000 00000000 00000000 ................
ffff800011e47d80 00000000 00000000 00000000 00000000 ................
ffff800011e47d90 00000000 00000000 00000000 00000000 ................
...
we should check on why it's zero
Nathan, any chance you could run kernel built with gcc and check on ftrace?
the build with clang fails because the ftrace data are there,
but pahole takes them as 'start' of the function, which is wrong
$ llvm-objdump -t build/aarch64/vmlinux | grep mcount
ffff800011d27d10 g .init.data 0000000000000000 __start_mcount_loc
ffff800011d90038 g .init.data 0000000000000000 __stop_mcount_loc
$ llvm-objdump -s build/aarch64-gcc/vmlinux
ffff800011d27d10 cc330110 0080ffff 1c340110 0080ffff .3.......4......
ffff800011d27d20 6c340110 0080ffff 1004c111 0080ffff l4..............
ffff800011d27d30 3804c111 0080ffff 6004c111 0080ffff 8.......`.......
ffff800011d27d40 8804c111 0080ffff 0405c111 0080ffff ................
ffff800011d27d50 3805c111 0080ffff 7c05c111 0080ffff 8.......|.......
...
I think if we fix pahole to take check the ftrace address is
within the processed function, we should be fine.. I'll try to
send something soon
jirka
Powered by blists - more mailing lists