From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2B2DC433FE for ; Wed, 25 May 2022 13:44:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230498AbiEYNoQ (ORCPT ); Wed, 25 May 2022 09:44:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232005AbiEYNoM (ORCPT ); Wed, 25 May 2022 09:44:12 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id AB8A160D86; Wed, 25 May 2022 06:44:11 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 51AD723A; Wed, 25 May 2022 06:44:11 -0700 (PDT) Received: from FVFF77S0Q05N (unknown [10.57.0.228]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 77FAD3F66F; Wed, 25 May 2022 06:44:03 -0700 (PDT) Date: Wed, 25 May 2022 14:43:55 +0100 From: Mark Rutland To: Xu Kuohai Cc: bpf@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, Catalin Marinas , Will Deacon , Steven Rostedt , Ingo Molnar , Daniel Borkmann , Alexei Starovoitov , Zi Shen Lim , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , "David S . Miller" , Hideaki YOSHIFUJI , David Ahern , Thomas Gleixner , Borislav Petkov , Dave Hansen , x86@kernel.org, hpa@zytor.com, Shuah Khan , Jakub Kicinski , Jesper Dangaard Brouer , Pasha Tatashin , Ard Biesheuvel , Daniel Kiss , Steven Price , Sudeep Holla , Marc Zyngier , Peter Collingbourne , Mark Brown , Delyan Kratunov , Kumar Kartikeya Dwivedi Subject: Re: [PATCH bpf-next v5 2/6] ftrace: Fix deadloop caused by direct call in ftrace selftest Message-ID: References: <20220518131638.3401509-1-xukuohai@huawei.com> <20220518131638.3401509-3-xukuohai@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220518131638.3401509-3-xukuohai@huawei.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 18, 2022 at 09:16:34AM -0400, Xu Kuohai wrote: > After direct call is enabled for arm64, ftrace selftest enters a > dead loop: IIUC this means that patch 1 alone is broken, and presumably this patch should have been part of it? > : > 00 bti c > 01 mov x9, x30 : > 02 bl ----------> ret > | > lr/x30 is 03, return to 03 > | > 03 mov w0, #0x0 <-----------------------------| > | | > | dead loop! | > | | > 04 ret ---- lr/x30 is still 03, go back to 03 ----| > > The reason is that when the direct caller trace_direct_tramp() returns > to the patched function trace_selftest_dynamic_test_func(), lr is still > the address after the instrumented instruction in the patched function, > so when the patched function exits, it returns to itself! > > To fix this issue, we need to restore lr before trace_direct_tramp() > exits, so rewrite a dedicated trace_direct_tramp() for arm64. As mentioned on patch 1 I'd prefer we solved this through indirection, which would avoid the need for this and would make things more robust generally by keeping the unusual calling convention private to the patch-site and regular trampoline. Thanks, Mark. > Reported-by: Li Huafei > Signed-off-by: Xu Kuohai > --- > arch/arm64/include/asm/ftrace.h | 10 ++++++++++ > arch/arm64/kernel/entry-ftrace.S | 10 ++++++++++ > kernel/trace/trace_selftest.c | 2 ++ > 3 files changed, 22 insertions(+) > > diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h > index 14a35a5df0a1..6f6b184e72fb 100644 > --- a/arch/arm64/include/asm/ftrace.h > +++ b/arch/arm64/include/asm/ftrace.h > @@ -126,6 +126,16 @@ static inline bool arch_syscall_match_sym_name(const char *sym, > */ > return !strcmp(sym + 8, name); > } > + > +#ifdef CONFIG_FTRACE_SELFTEST > +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS > + > +#define trace_direct_tramp trace_direct_tramp > +extern void trace_direct_tramp(void); > + > +#endif /* CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS */ > +#endif /* CONFIG_FTRACE_SELFTEST */ > + > #endif /* ifndef __ASSEMBLY__ */ > > #endif /* __ASM_FTRACE_H */ > diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S > index dfe62c55e3a2..a47e87d4d3dd 100644 > --- a/arch/arm64/kernel/entry-ftrace.S > +++ b/arch/arm64/kernel/entry-ftrace.S > @@ -357,3 +357,13 @@ SYM_CODE_START(return_to_handler) > ret > SYM_CODE_END(return_to_handler) > #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ > + > +#ifdef CONFIG_FTRACE_SELFTEST > +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS > +SYM_FUNC_START(trace_direct_tramp) > + mov x10, x30 > + mov x30, x9 > + ret x10 > +SYM_FUNC_END(trace_direct_tramp) > +#endif /* CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS */ > +#endif /* CONFIG_FTRACE_SELFTEST */ > diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c > index abcadbe933bb..e7ccd0d10c39 100644 > --- a/kernel/trace/trace_selftest.c > +++ b/kernel/trace/trace_selftest.c > @@ -785,8 +785,10 @@ static struct fgraph_ops fgraph_ops __initdata = { > }; > > #ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS > +#ifndef trace_direct_tramp > noinline __noclone static void trace_direct_tramp(void) { } > #endif > +#endif > > /* > * Pretty much the same than for the function tracer from which the selftest > -- > 2.30.2 > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 321A9C4332F for ; Wed, 25 May 2022 13:45:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=aHorVrZ/MXsvm/mRivvVvQEa931VWjy29sCdV8BFO/M=; b=uiFaGhFx0pBRWz GRLJ2l1LOFDm6FDk3/lDtfQlE+6w2pCJY/MUHGtoCt1W+/zZNtIqpz6LhVXb9NBo7aAXeFjA1QltB sg+KFtOJrKBkZmA02BEF9U7HxKo9SxXhpxIQmlT97j4m4/dFpA8dQoM0SR65K+1ug0Z8WY/WT0NzZ 5WxFRXFIg2TFR2+BSkje8KD9uemcVKw5C3URvZNOqKExsUmD9XApZFVeJOBQpSK7C/pHg2j3Qvahg Sjrh810jplsp4FG+RIaRTA8hB5oSD4eCOiHdHU9qCXf0udKRZkFu3ncaQsmXXtk3ogdDpLaw6N7c3 WzkGLUwPo3i0pzicnSLg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ntrJB-00BI2a-76; Wed, 25 May 2022 13:44:17 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ntrJ6-00BI1E-P0 for linux-arm-kernel@lists.infradead.org; Wed, 25 May 2022 13:44:14 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 51AD723A; Wed, 25 May 2022 06:44:11 -0700 (PDT) Received: from FVFF77S0Q05N (unknown [10.57.0.228]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 77FAD3F66F; Wed, 25 May 2022 06:44:03 -0700 (PDT) Date: Wed, 25 May 2022 14:43:55 +0100 From: Mark Rutland To: Xu Kuohai Cc: bpf@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, Catalin Marinas , Will Deacon , Steven Rostedt , Ingo Molnar , Daniel Borkmann , Alexei Starovoitov , Zi Shen Lim , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , "David S . Miller" , Hideaki YOSHIFUJI , David Ahern , Thomas Gleixner , Borislav Petkov , Dave Hansen , x86@kernel.org, hpa@zytor.com, Shuah Khan , Jakub Kicinski , Jesper Dangaard Brouer , Pasha Tatashin , Ard Biesheuvel , Daniel Kiss , Steven Price , Sudeep Holla , Marc Zyngier , Peter Collingbourne , Mark Brown , Delyan Kratunov , Kumar Kartikeya Dwivedi Subject: Re: [PATCH bpf-next v5 2/6] ftrace: Fix deadloop caused by direct call in ftrace selftest Message-ID: References: <20220518131638.3401509-1-xukuohai@huawei.com> <20220518131638.3401509-3-xukuohai@huawei.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220518131638.3401509-3-xukuohai@huawei.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220525_064412_945906_13B78D91 X-CRM114-Status: GOOD ( 23.60 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, May 18, 2022 at 09:16:34AM -0400, Xu Kuohai wrote: > After direct call is enabled for arm64, ftrace selftest enters a > dead loop: IIUC this means that patch 1 alone is broken, and presumably this patch should have been part of it? > : > 00 bti c > 01 mov x9, x30 : > 02 bl ----------> ret > | > lr/x30 is 03, return to 03 > | > 03 mov w0, #0x0 <-----------------------------| > | | > | dead loop! | > | | > 04 ret ---- lr/x30 is still 03, go back to 03 ----| > > The reason is that when the direct caller trace_direct_tramp() returns > to the patched function trace_selftest_dynamic_test_func(), lr is still > the address after the instrumented instruction in the patched function, > so when the patched function exits, it returns to itself! > > To fix this issue, we need to restore lr before trace_direct_tramp() > exits, so rewrite a dedicated trace_direct_tramp() for arm64. As mentioned on patch 1 I'd prefer we solved this through indirection, which would avoid the need for this and would make things more robust generally by keeping the unusual calling convention private to the patch-site and regular trampoline. Thanks, Mark. > Reported-by: Li Huafei > Signed-off-by: Xu Kuohai > --- > arch/arm64/include/asm/ftrace.h | 10 ++++++++++ > arch/arm64/kernel/entry-ftrace.S | 10 ++++++++++ > kernel/trace/trace_selftest.c | 2 ++ > 3 files changed, 22 insertions(+) > > diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h > index 14a35a5df0a1..6f6b184e72fb 100644 > --- a/arch/arm64/include/asm/ftrace.h > +++ b/arch/arm64/include/asm/ftrace.h > @@ -126,6 +126,16 @@ static inline bool arch_syscall_match_sym_name(const char *sym, > */ > return !strcmp(sym + 8, name); > } > + > +#ifdef CONFIG_FTRACE_SELFTEST > +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS > + > +#define trace_direct_tramp trace_direct_tramp > +extern void trace_direct_tramp(void); > + > +#endif /* CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS */ > +#endif /* CONFIG_FTRACE_SELFTEST */ > + > #endif /* ifndef __ASSEMBLY__ */ > > #endif /* __ASM_FTRACE_H */ > diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S > index dfe62c55e3a2..a47e87d4d3dd 100644 > --- a/arch/arm64/kernel/entry-ftrace.S > +++ b/arch/arm64/kernel/entry-ftrace.S > @@ -357,3 +357,13 @@ SYM_CODE_START(return_to_handler) > ret > SYM_CODE_END(return_to_handler) > #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ > + > +#ifdef CONFIG_FTRACE_SELFTEST > +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS > +SYM_FUNC_START(trace_direct_tramp) > + mov x10, x30 > + mov x30, x9 > + ret x10 > +SYM_FUNC_END(trace_direct_tramp) > +#endif /* CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS */ > +#endif /* CONFIG_FTRACE_SELFTEST */ > diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c > index abcadbe933bb..e7ccd0d10c39 100644 > --- a/kernel/trace/trace_selftest.c > +++ b/kernel/trace/trace_selftest.c > @@ -785,8 +785,10 @@ static struct fgraph_ops fgraph_ops __initdata = { > }; > > #ifdef CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS > +#ifndef trace_direct_tramp > noinline __noclone static void trace_direct_tramp(void) { } > #endif > +#endif > > /* > * Pretty much the same than for the function tracer from which the selftest > -- > 2.30.2 > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel