From nobody Mon Jun 22 23:41:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C060DC433F5 for ; Tue, 15 Mar 2022 10:46:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347526AbiCOKrU (ORCPT ); Tue, 15 Mar 2022 06:47:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33794 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347348AbiCOKpi (ORCPT ); Tue, 15 Mar 2022 06:45:38 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 374C03818E; Tue, 15 Mar 2022 03:44:04 -0700 (PDT) Date: Tue, 15 Mar 2022 10:44:01 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1647341042; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZLq02G9lGSoFei6eJJRxJPjfGRNv5HVQcuIgy4v11FU=; b=h7Fl+lKOdjD3vrAln+EpUZB5P/UvMzxC9ePYMnVNiTnCsEXddd9nmtYhhA5YCwG1eVAn3T uq5OnfJSGCxIstcW/AQg9dNSS35Li5KggXXfshwv6fuX5aKqCYamdWEQ4VsQcgkYqaf0h6 fMElE7/S/4sZlJQW+RiLK3ZBNiclvglqtcNdn5VItnnK9BgxghBqc60HVgiNMZx6BLev5W +CDuJGZwIyyQG7UUaY78tV8UfCfjMonh+DsK+LF485Idaew6L3hJqZy8ZESzpjTYpKDMVo L3cijIkZ1iACamsAMtx8b7d+dK5ykDYqoGIKzFd4HyWsLciLRzZfWN3egCDTbQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1647341042; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZLq02G9lGSoFei6eJJRxJPjfGRNv5HVQcuIgy4v11FU=; b=ygBqzxSM65fImj+XqPHQKCmMeQHbZkEkDLcGG4p88s8AqUQ1+0MrdLb7581zERzZjAz9Lu V+V8LIjmD74gfrBA== From: "tip-bot2 for Peter Zijlstra" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/core] x86/ibt,ftrace: Make function-graph play nice Cc: "Peter Zijlstra (Intel)" , Josh Poimboeuf , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20220308154318.347296408@infradead.org> References: <20220308154318.347296408@infradead.org> MIME-Version: 1.0 Message-ID: <164734104175.16921.11198842533678838543.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/core branch of tip: Commit-ID: e52fc2cf3f662828cc0d51c4b73bed73ad275fce Gitweb: https://git.kernel.org/tip/e52fc2cf3f662828cc0d51c4b73bed73a= d275fce Author: Peter Zijlstra AuthorDate: Tue, 08 Mar 2022 16:30:31 +01:00 Committer: Peter Zijlstra CommitterDate: Tue, 15 Mar 2022 10:32:37 +01:00 x86/ibt,ftrace: Make function-graph play nice Return trampoline must not use indirect branch to return; while this preserves the RSB, it is fundamentally incompatible with IBT. Instead use a retpoline like ROP gadget that defeats IBT while not unbalancing the RSB. And since ftrace_stub is no longer a plain RET, don't use it to copy from. Since RET is a trivial instruction, poke it directly. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20220308154318.347296408@infradead.org --- arch/x86/kernel/ftrace.c | 9 ++------- arch/x86/kernel/ftrace_64.S | 21 +++++++++++++++++---- 2 files changed, 19 insertions(+), 11 deletions(-) diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c index 7cc540e..1e31c7d 100644 --- a/arch/x86/kernel/ftrace.c +++ b/arch/x86/kernel/ftrace.c @@ -316,12 +316,12 @@ create_trampoline(struct ftrace_ops *ops, unsigned in= t *tramp_size) unsigned long offset; unsigned long npages; unsigned long size; - unsigned long retq; unsigned long *ptr; void *trampoline; void *ip; /* 48 8b 15 is movq (%rip), %rdx */ unsigned const char op_ref[] =3D { 0x48, 0x8b, 0x15 }; + unsigned const char retq[] =3D { RET_INSN_OPCODE, INT3_INSN_OPCODE }; union ftrace_op_code_union op_ptr; int ret; =20 @@ -359,12 +359,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int= *tramp_size) goto fail; =20 ip =3D trampoline + size; - - /* The trampoline ends with ret(q) */ - retq =3D (unsigned long)ftrace_stub; - ret =3D copy_from_kernel_nofault(ip, (void *)retq, RET_SIZE); - if (WARN_ON(ret < 0)) - goto fail; + memcpy(ip, retq, RET_SIZE); =20 /* No need to test direct calls on created trampolines */ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) { diff --git a/arch/x86/kernel/ftrace_64.S b/arch/x86/kernel/ftrace_64.S index 11ac028..e32b5cd 100644 --- a/arch/x86/kernel/ftrace_64.S +++ b/arch/x86/kernel/ftrace_64.S @@ -176,10 +176,10 @@ SYM_FUNC_END(ftrace_caller); SYM_FUNC_START(ftrace_epilogue) /* * This is weak to keep gas from relaxing the jumps. - * It is also used to copy the RET for trampolines. */ SYM_INNER_LABEL_ALIGN(ftrace_stub, SYM_L_WEAK) UNWIND_HINT_FUNC + ENDBR RET SYM_FUNC_END(ftrace_epilogue) =20 @@ -284,6 +284,7 @@ SYM_FUNC_START(__fentry__) jnz trace =20 SYM_INNER_LABEL(ftrace_stub, SYM_L_GLOBAL) + ENDBR RET =20 trace: @@ -307,7 +308,7 @@ EXPORT_SYMBOL(__fentry__) =20 #ifdef CONFIG_FUNCTION_GRAPH_TRACER SYM_FUNC_START(return_to_handler) - subq $24, %rsp + subq $16, %rsp =20 /* Save the return values */ movq %rax, (%rsp) @@ -319,7 +320,19 @@ SYM_FUNC_START(return_to_handler) movq %rax, %rdi movq 8(%rsp), %rdx movq (%rsp), %rax - addq $24, %rsp - JMP_NOSPEC rdi + + addq $16, %rsp + /* + * Jump back to the old return address. This cannot be JMP_NOSPEC rdi + * since IBT would demand that contain ENDBR, which simply isn't so for + * return addresses. Use a retpoline here to keep the RSB balanced. + */ + ANNOTATE_INTRA_FUNCTION_CALL + call .Ldo_rop + int3 +.Ldo_rop: + mov %rdi, (%rsp) + UNWIND_HINT_FUNC + RET SYM_FUNC_END(return_to_handler) #endif