Currently, on PowerPC machines, sibling calls in livepatched functions
cause the stack to be corrupted and are thus not supported by tools
such as kpatch. Below is an example stack frame showing one such
currupted stacks:
RHEL-7.6: Linux 3.10.0 ppc64le
Livepatch applied:
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e008aefc3a9d..7c70e369390d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2228,6 +2228,8 @@ static void xs_tcp_shutdown(struct rpc_xprt *xprt)
struct socket *sock = transport->sock;
int skst = transport->inet ? transport->inet->sk_state : TCP_CLOSE;
+ asm("nop");
+
if (sock == NULL)
return;
switch (skst) {
Context:
- The livepatch updates both xs_tcp_shutdown() and xs_reset_transport()
in the sunrpc module. This causes the compiler to generate a tail call
optimization for the patched instance of xs_tcp_shutdown() ->
xs_reset_transport()
Stack Frame:
#4 [c000002fe4be7c00] __rpc_create_common at d000000026e118f4 [sunrpc]
c000002fe4be7c00: c000002fe4be7c40 0000000000000000
c000002fe4be7c10: c00000000000b054 d000000026fda3d8 < corrupted toc
c000002fe4be7c20: c00000000626cf00 c000002fe1a5f100
c000002fe4be7c30: c000003c79cbec48 c000003c79cbec50
#5 [c000002fe4be7c40] process_one_work at c00000000012333c
c000002fe4be7c40: c000002fe4be7ce0 c000000006260a00
c000002fe4be7c50: c00000000012333c c0000000013e4d00 < correct toc
c000002fe4be7c60: 0000000000000000 0000000000000000
c000002fe4be7c70: 0000000000000000 0000000000000000
c000002fe4be7c80: c000002fe4be7ce0 c0000000013510b0
c000002fe4be7c90: 0000000000000001 fffffffffffffef7
c000002fe4be7ca0: 0000000000000000 c000000006260980
c000002fe4be7cb0: c000002fe1a5f130 c000000001422280
c000002fe4be7cc0: c000000006260620 c000003c79cbec48
c000002fe4be7cd0: c000000006260600 c000002fe1a5f100
#6 [c000002fe4be7ce0] worker_thread at c000000000123980
c000002fe4be7ce0: c000002fe4be7d80 0000000000003300
c000002fe4be7cf0: c000000000123980 c000002fe8c8bb40
c000002fe4be7d00: 0000000000000000 0000000000000000
c000002fe4be7d10: 0000000000000000 0000000000000000
c000002fe4be7d20: 0000000000000000 0000000000000000
c000002fe4be7d30: 0000000000000000 0000000000000000
c000002fe4be7d40: 0000000000000000 0000000000000000
c000002fe4be7d50: c0000000001237e0 c000002fe1a5f100
c000002fe4be7d60: c000000000c894a0 c0000000016be410
c000002fe4be7d70: 0000000000000000 c000002fe8c8bb40
This is caused by the toc stub generated on a sibling call:
0xd000000026fd0ad0 <xs_tcp_shutdown+816>: addis r11,r2,-1
0xd000000026fd0ad4 <xs_tcp_shutdown+820>: addi r11,r11,26360
0xd000000026fd0ad8 <xs_tcp_shutdown+824>: std r2,24(r1)
^ corrupts stack frame
0xd000000026fd0adc <xs_tcp_shutdown+828>: ld r12,32(r11)
0xd000000026fd0ae0 <xs_tcp_shutdown+832>: mtctr r12
0xd000000026fd0ae4 <xs_tcp_shutdown+836>: bctr
This ends up saving the livepatch toc to the caller's stack located in
the sunrpc module so that since the stack is not popped, once the
caller attempts to use the toc, a kernel panic results from being
unable to handle the kernel paging request for data at that location
outside the caller's module.
This patch restores r2 value to caller's stack, on a sibling call this
will uncorrupt the caller's stack and otherwise will be redundant.
Signed-off-by: Ryan Sullivan <rysulliv@xxxxxxxxxx>
---
arch/powerpc/kernel/trace/ftrace_entry.S | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/powerpc/kernel/trace/ftrace_entry.S b/arch/powerpc/kernel/trace/ftrace_entry.S
index 76dbe9fd2c0f..4dfbe6076ad1 100644
--- a/arch/powerpc/kernel/trace/ftrace_entry.S
+++ b/arch/powerpc/kernel/trace/ftrace_entry.S
@@ -244,6 +244,9 @@ livepatch_handler:
mtlr r12
ld r2, -24(r11)
+ /* Restore toc to caller's stack in case of sibling call */
+ std r2, 24(r1)
+
/* Pop livepatch stack frame */
ld r12, PACA_THREAD_INFO(r13)
subi r11, r11, 24
--
2.44.0
