tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git ras/core
branch HEAD: de768416b203ac84e02a757b782a32efb388476f x86/mce/inject: Avoid out-of-bounds write when setting flags
possible Warning in current branch (please contact us if interested):
vmlinux.o: warning: objtool: do_machine_check()+0x59a: call to test_bit() leaves .noinstr.text section
Warning ids grouped by kconfigs:
gcc_recent_errors
`-- x86_64-buildonly-randconfig-r006-20211228
`-- vmlinux.o:warning:objtool:do_machine_check():call-to-test_bit()-leaves-.noinstr.text-section
elapsed time: 720m
configs tested: 206
configs skipped: 4
The following configs have been built successfully.
More configs may be tested in the coming days.
gcc tested configs:
arm defconfig
arm64 allyesconfig
arm64 defconfig
arm allyesconfig
arm allmodconfig
i386 randconfig-c001-20211228
arm64 alldefconfig
powerpc warp_defconfig
powerpc currituck_defconfig
powerpc chrp32_defconfig
arc haps_hs_smp_defconfig
mips db1xxx_defconfig
arm mxs_defconfig
parisc generic-32bit_defconfig
arm simpad_defconfig
arm socfpga_defconfig
openrisc or1klitex_defconfig
arm at91_dt_defconfig
powerpc pmac32_defconfig
sh se7721_defconfig
powerpc mpc5200_defconfig
arc defconfig
m68k mvme16x_defconfig
riscv nommu_virt_defconfig
mips tb0226_defconfig
powerpc ep8248e_defconfig
sparc64 defconfig
powerpc holly_defconfig
arm pxa168_defconfig
powerpc skiroot_defconfig
mips workpad_defconfig
mips gcw0_defconfig
arm clps711x_defconfig
powerpc mpc834x_itxgp_defconfig
mips ip32_defconfig
mips lemote2f_defconfig
mips decstation_defconfig
h8300 h8300h-sim_defconfig
arm nhk8815_defconfig
arm cm_x300_defconfig
powerpc cm5200_defconfig
arm pcm027_defconfig
mips rbtx49xx_defconfig
sh se7724_defconfig
parisc generic-64bit_defconfig
arm exynos_defconfig
xtensa common_defconfig
powerpc mpc512x_defconfig
ia64 bigsur_defconfig
arm s3c2410_defconfig
powerpc tqm8540_defconfig
sh sh7785lcr_32bit_defconfig
mips maltaaprp_defconfig
sh magicpanelr2_defconfig
sh alldefconfig
nios2 10m50_defconfig
sh titan_defconfig
arm rpc_defconfig
arm vf610m4_defconfig
arm collie_defconfig
arm pxa3xx_defconfig
powerpc bluestone_defconfig
mips bmips_stb_defconfig
arm ezx_defconfig
sh se7343_defconfig
arc axs101_defconfig
arm ep93xx_defconfig
arm integrator_defconfig
arm trizeps4_defconfig
mips cavium_octeon_defconfig
h8300 edosk2674_defconfig
powerpc ge_imp3a_defconfig
ia64 zx1_defconfig
powerpc mpc836x_mds_defconfig
arm zeus_defconfig
powerpc tqm8541_defconfig
arm h3600_defconfig
mips jazz_defconfig
openrisc defconfig
xtensa alldefconfig
m68k m5208evb_defconfig
powerpc obs600_defconfig
powerpc mpc8313_rdb_defconfig
mips decstation_r4k_defconfig
arm magician_defconfig
sh se7619_defconfig
powerpc ksi8560_defconfig
um defconfig
sh ecovec24_defconfig
sh edosk7705_defconfig
powerpc ps3_defconfig
powerpc maple_defconfig
mips loongson2k_defconfig
mips maltaup_defconfig
arm xcep_defconfig
mips ath79_defconfig
i386 alldefconfig
mips rm200_defconfig
arm stm32_defconfig
mips maltaup_xpa_defconfig
powerpc mpc885_ads_defconfig
arm lpc18xx_defconfig
powerpc pq2fads_defconfig
arm sama5_defconfig
arm imx_v6_v7_defconfig
arm pxa910_defconfig
s390 zfcpdump_defconfig
arm lpc32xx_defconfig
arc nsimosci_defconfig
arm alldefconfig
nds32 alldefconfig
m68k stmark2_defconfig
um x86_64_defconfig
powerpc powernv_defconfig
mips fuloong2e_defconfig
arm u8500_defconfig
powerpc icon_defconfig
sh se7780_defconfig
arm shmobile_defconfig
arc vdk_hs38_smp_defconfig
csky alldefconfig
riscv nommu_k210_sdcard_defconfig
powerpc asp8347_defconfig
powerpc canyonlands_defconfig
sh sh7770_generic_defconfig
mips rb532_defconfig
powerpc ppc44x_defconfig
arm randconfig-c002-20211228
ia64 allmodconfig
ia64 defconfig
ia64 allyesconfig
m68k allmodconfig
m68k defconfig
m68k allyesconfig
nios2 defconfig
arc allyesconfig
nds32 allnoconfig
nds32 defconfig
nios2 allyesconfig
csky defconfig
alpha defconfig
alpha allyesconfig
sh allmodconfig
h8300 allyesconfig
xtensa allyesconfig
parisc defconfig
s390 allyesconfig
s390 allmodconfig
parisc allyesconfig
s390 defconfig
i386 allyesconfig
sparc allyesconfig
sparc defconfig
i386 defconfig
i386 debian-10.3-kselftests
i386 debian-10.3
mips allyesconfig
mips allmodconfig
powerpc allyesconfig
powerpc allmodconfig
powerpc allnoconfig
x86_64 randconfig-a001-20211228
x86_64 randconfig-a003-20211228
x86_64 randconfig-a002-20211228
x86_64 randconfig-a005-20211228
x86_64 randconfig-a006-20211228
x86_64 randconfig-a004-20211228
i386 randconfig-a006-20211228
i386 randconfig-a004-20211228
i386 randconfig-a002-20211228
i386 randconfig-a003-20211228
i386 randconfig-a001-20211228
i386 randconfig-a005-20211228
riscv nommu_k210_defconfig
riscv allyesconfig
riscv allnoconfig
riscv defconfig
riscv allmodconfig
riscv rv32_defconfig
x86_64 rhel-8.3-kselftests
um i386_defconfig
x86_64 allyesconfig
x86_64 defconfig
x86_64 rhel-8.3
x86_64 rhel-8.3-func
x86_64 kexec
clang tested configs:
riscv randconfig-c006-20211228
mips randconfig-c004-20211228
powerpc randconfig-c003-20211228
arm randconfig-c002-20211228
x86_64 randconfig-c007-20211228
i386 randconfig-c001-20211228
x86_64 randconfig-a015-20211228
x86_64 randconfig-a014-20211228
x86_64 randconfig-a013-20211228
x86_64 randconfig-a012-20211228
x86_64 randconfig-a011-20211228
x86_64 randconfig-a016-20211228
i386 randconfig-a012-20211228
i386 randconfig-a011-20211228
i386 randconfig-a014-20211228
i386 randconfig-a016-20211228
i386 randconfig-a013-20211228
i386 randconfig-a015-20211228
hexagon randconfig-r041-20211228
riscv randconfig-r042-20211228
s390 randconfig-r044-20211228
hexagon randconfig-r045-20211228
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]
On Wed, Dec 29, 2021 at 08:13:09AM +0800, kernel test robot wrote:
> tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git ras/core
> branch HEAD: de768416b203ac84e02a757b782a32efb388476f x86/mce/inject: Avoid out-of-bounds write when setting flags
>
> possible Warning in current branch (please contact us if interested):
>
> vmlinux.o: warning: objtool: do_machine_check()+0x59a: call to test_bit() leaves .noinstr.text section
>
> Warning ids grouped by kconfigs:
>
> gcc_recent_errors
> `-- x86_64-buildonly-randconfig-r006-20211228
> `-- vmlinux.o:warning:objtool:do_machine_check():call-to-test_bit()-leaves-.noinstr.text-section
Yes, I'm interested. Please send me reproduction instructions.
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
On 12/29/2021 5:34 PM, Borislav Petkov wrote:
> On Wed, Dec 29, 2021 at 08:13:09AM +0800, kernel test robot wrote:
>> tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git ras/core
>> branch HEAD: de768416b203ac84e02a757b782a32efb388476f x86/mce/inject: Avoid out-of-bounds write when setting flags
>>
>> possible Warning in current branch (please contact us if interested):
>>
>> vmlinux.o: warning: objtool: do_machine_check()+0x59a: call to test_bit() leaves .noinstr.text section
>>
>> Warning ids grouped by kconfigs:
>>
>> gcc_recent_errors
>> `-- x86_64-buildonly-randconfig-r006-20211228
>> `-- vmlinux.o:warning:objtool:do_machine_check():call-to-test_bit()-leaves-.noinstr.text-section
>
> Yes, I'm interested. Please send me reproduction instructions.
>
> Thx.
>
Hi Borislav,
Below is the report:
tree: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git ras/core
head: de768416b203ac84e02a757b782a32efb388476f
commit: b4813539d37fa31fed62cdfab7bd2dd8929c5b2e [15/23] x86/mce: Mark
mce_end() noinstr
config: x86_64-buildonly-randconfig-r006-20211228 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
#
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b4813539d37fa31fed62cdfab7bd2dd8929c5b2e
git remote add tip
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
git fetch --no-tags tip ras/core
git checkout b4813539d37fa31fed62cdfab7bd2dd8929c5b2e
# save the config file to linux build tree
mkdir build_dir
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
All warnings (new ones prefixed by >>):
>> vmlinux.o: warning: objtool: do_machine_check()+0x59a: call to
test_bit() leaves .noinstr.text section
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]
On Fri, Dec 31, 2021 at 08:46:52AM +0800, Chen, Rong A wrote:
> Hi Borislav,
>
> Below is the report:
>
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git ras/core
> head: de768416b203ac84e02a757b782a32efb388476f
> commit: b4813539d37fa31fed62cdfab7bd2dd8929c5b2e [15/23] x86/mce: Mark
> mce_end() noinstr
> config: x86_64-buildonly-randconfig-r006-20211228 (attached as .config)
> compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
> reproduce (this is a W=1 build):
> # https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b4813539d37fa31fed62cdfab7bd2dd8929c5b2e
> git remote add tip
> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
> git fetch --no-tags tip ras/core
> git checkout b4813539d37fa31fed62cdfab7bd2dd8929c5b2e
> # save the config file to linux build tree
> mkdir build_dir
> make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <[email protected]>
>
> All warnings (new ones prefixed by >>):
>
> >> vmlinux.o: warning: objtool: do_machine_check()+0x59a: call to test_bit()
> leaves .noinstr.text section
Thanks!
Hmm, so staring at this, it looks kinda weird. Lemme add Peter.
So with your .config I see
vmlinux.o: warning: objtool: mce_start()+0x6a: call to clear_bit() leaves .noinstr.text section
This one generates a call to clear_bit() even though that function is
inline. And yeah, I know, it doesn't always inline it and looking at the
asm, it does generate a clear_bit function down in that same compilation
unit:
.size set_bit, .-set_bit
.type clear_bit, @function
clear_bit:
pushq %rbp #
movq %rsp, %rbp #,
pushq %r12 #
movq %rdi, %r12 # tmp84, nr
pushq %rbx #
# ./include/asm-generic/bitops/instrumented-atomic.h:40: {
movq %rsi, %rbx # tmp85, addr
# ./arch/x86/include/asm/bitops.h:79: asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0"
call __sanitizer_cov_trace_pc #
#APP
# 79 "./arch/x86/include/asm/bitops.h" 1
btrq %r12,(%rbx) # nr, MEM[(volatile long int *)addr_2(D)]
# 0 "" 2
# ./include/asm-generic/bitops/instrumented-atomic.h:43: }
#NO_APP
popq %rbx #
popq %r12 #
popq %rbp #
ret
.size clear_bit, .-clear_bit
.type test_bit, @function
I guess the compiler decided not to inline the function. The fix for
that is easy, see below.
The next one is:
vmlinux.o: warning: objtool: mce_read_aux()+0x53: call to mca_msr_reg() leaves .noinstr.text section
That one needs instrumentation range widening too, see below.
And the next one is:
vmlinux.o: warning: objtool: do_machine_check()+0xc9: call to mce_no_way_out() leaves .noinstr.text section
mce_no_way_out() is called only once by do_machine_check(), I guess it can be __always_inline.
Which then leads to:
vmlinux.o: warning: objtool: do_machine_check()+0x48e: call to test_bit() leaves .noinstr.text section
and that is again those *_bit() functions which do not get inlined but
actual calls to them get generated:
test_bit:
pushq %rbp #
movq %rsp, %rbp #,
pushq %r12 #
movq %rdi, %r12 # tmp87, nr
pushq %rbx #
# ./include/asm-generic/bitops/instrumented-non-atomic.h:133: {
movq %rsi, %rbx # tmp88, addr
# ./arch/x86/include/asm/bitops.h:214: asm volatile(__ASM_SIZE(bt) " %2,%1"
call __sanitizer_cov_trace_pc #
#APP
# 214 "./arch/x86/include/asm/bitops.h" 1
btq %r12,(%rbx) # nr, MEM[(long unsigned int *)addr_5(D)]
/* output condition code c*/
# 0 "" 2
# ./include/asm-generic/bitops/instrumented-non-atomic.h:136: }
#NO_APP
popq %rbx #
# ./arch/x86/include/asm/bitops.h:214: asm volatile(__ASM_SIZE(bt) " %2,%1"
setc %al #, oldbit
# ./include/asm-generic/bitops/instrumented-non-atomic.h:136: }
popq %r12 #
popq %rbp #
ret
.size test_bit, .-test_bit
---
if I do:
diff --git a/arch/x86/kernel/cpu/mce/Makefile b/arch/x86/kernel/cpu/mce/Makefile
index 015856abdbb1..3afa0585bc75 100644
--- a/arch/x86/kernel/cpu/mce/Makefile
+++ b/arch/x86/kernel/cpu/mce/Makefile
@@ -1,4 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
+#
+
+KCOV_INSTRUMENT_core.o := n
+
then test_bit still remains a call:
---
.type test_bit, @function
test_bit:
# ./arch/x86/include/asm/bitops.h:214: asm volatile(__ASM_SIZE(bt) " %2,%1"
#APP
# 214 "./arch/x86/include/asm/bitops.h" 1
btq %rdi,(%rsi) # tmp87, MEM[(long unsigned int *)addr_5(D)]
/* output condition code c*/
# 0 "" 2
#NO_APP
setc %al #, oldbit
# ./include/asm-generic/bitops/instrumented-non-atomic.h:136: }
ret
.size test_bit, .-test_bit
---
and that *should* *get* inlined, for chrissakes! It is *two* insns!
Disabling CONFIG_KCOV doesn't help either - those *_bit() manipulation
functions are still not inlined.
Anyway, here's what I have so far:
---
diff --git a/arch/x86/kernel/cpu/mce/Makefile b/arch/x86/kernel/cpu/mce/Makefile
index 015856abdbb1..3afa0585bc75 100644
--- a/arch/x86/kernel/cpu/mce/Makefile
+++ b/arch/x86/kernel/cpu/mce/Makefile
@@ -1,4 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
+#
+
+KCOV_INSTRUMENT_core.o := n
+
obj-y = core.o severity.o genpool.o
obj-$(CONFIG_X86_ANCIENT_MCE) += winchip.o p5.o
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 5818b837fd4d..aca1408d2d93 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -648,7 +648,7 @@ static struct notifier_block mce_default_nb = {
/*
* Read ADDR and MISC registers.
*/
-static noinstr void mce_read_aux(struct mce *m, int i)
+static void mce_read_aux(struct mce *m, int i)
{
if (m->status & MCI_STATUS_MISCV)
m->misc = mce_rdmsrl(mca_msr_reg(i, MCA_MISC));
@@ -838,8 +838,8 @@ static void quirk_sandybridge_ifu(int bank, struct mce *m, struct pt_regs *regs)
* Do a quick check if any of the events requires a panic.
* This decides if we keep the events around or clear them.
*/
-static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
- struct pt_regs *regs)
+static __always_inline int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ struct pt_regs *regs)
{
char *tmp = *msg;
int i;
@@ -1021,11 +1021,12 @@ static noinstr int mce_start(int *no_way_out)
* is updated before mce_callin.
*/
order = atomic_inc_return(&mce_callin);
- cpumask_clear_cpu(smp_processor_id(), &mce_missing_cpus);
/* Enable instrumentation around calls to external facilities */
instrumentation_begin();
+ cpumask_clear_cpu(smp_processor_id(), &mce_missing_cpus);
+
/*
* Wait for everyone.
*/
@@ -1250,16 +1251,17 @@ __mc_scan_banks(struct mce *m, struct pt_regs *regs, struct mce *final,
if (severity == MCE_NO_SEVERITY)
continue;
+ /*
+ * Enable instrumentation around the MCE logging which is
+ * done in #MC context, where instrumentation is disabled.
+ */
+ instrumentation_begin();
+
mce_read_aux(m, i);
/* assuming valid severity level != 0 */
m->severity = severity;
- /*
- * Enable instrumentation around the mce_log() call which is
- * done in #MC context, where instrumentation is disabled.
- */
- instrumentation_begin();
mce_log(m);
instrumentation_end();
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
IOW, something like this ontop of:
https://lore.kernel.org/r/[email protected]
That did pass overnight build-tests so
---
From: Borislav Petkov <[email protected]>
Date: Sun, 16 Jan 2022 19:23:26 +0100
Subject: [PATCH] x86/mce: Fix two more noinstr issues
Always inline mca_msr_reg():
text data bss dec hex filename
16065240 128031326 36405368 180501934 ac23dae vmlinux.before
16065240 128031294 36405368 180501902 ac23d8e vmlinux.after
and mce_no_way_out() as the latter one is used only once, to fix:
vmlinux.o: warning: objtool: mce_read_aux()+0x53: call to mca_msr_reg() leaves .noinstr.text section
vmlinux.o: warning: objtool: do_machine_check()+0xc9: call to mce_no_way_out() leaves .noinstr.text section
Signed-off-by: Borislav Petkov <[email protected]>
---
arch/x86/kernel/cpu/mce/core.c | 25 ++-----------------------
arch/x86/kernel/cpu/mce/internal.h | 23 +++++++++++++++++++++--
2 files changed, 23 insertions(+), 25 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 5818b837fd4d..0db5a232986a 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -173,27 +173,6 @@ void mce_unregister_decode_chain(struct notifier_block *nb)
}
EXPORT_SYMBOL_GPL(mce_unregister_decode_chain);
-u32 mca_msr_reg(int bank, enum mca_msr reg)
-{
- if (mce_flags.smca) {
- switch (reg) {
- case MCA_CTL: return MSR_AMD64_SMCA_MCx_CTL(bank);
- case MCA_ADDR: return MSR_AMD64_SMCA_MCx_ADDR(bank);
- case MCA_MISC: return MSR_AMD64_SMCA_MCx_MISC(bank);
- case MCA_STATUS: return MSR_AMD64_SMCA_MCx_STATUS(bank);
- }
- }
-
- switch (reg) {
- case MCA_CTL: return MSR_IA32_MCx_CTL(bank);
- case MCA_ADDR: return MSR_IA32_MCx_ADDR(bank);
- case MCA_MISC: return MSR_IA32_MCx_MISC(bank);
- case MCA_STATUS: return MSR_IA32_MCx_STATUS(bank);
- }
-
- return 0;
-}
-
static void __print_mce(struct mce *m)
{
pr_emerg(HW_ERR "CPU %d: Machine Check%s: %Lx Bank %d: %016Lx\n",
@@ -838,8 +817,8 @@ static void quirk_sandybridge_ifu(int bank, struct mce *m, struct pt_regs *regs)
* Do a quick check if any of the events requires a panic.
* This decides if we keep the events around or clear them.
*/
-static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
- struct pt_regs *regs)
+static __always_inline int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ struct pt_regs *regs)
{
char *tmp = *msg;
int i;
diff --git a/arch/x86/kernel/cpu/mce/internal.h b/arch/x86/kernel/cpu/mce/internal.h
index 52c633950b38..a04b61e27827 100644
--- a/arch/x86/kernel/cpu/mce/internal.h
+++ b/arch/x86/kernel/cpu/mce/internal.h
@@ -182,8 +182,6 @@ enum mca_msr {
MCA_MISC,
};
-u32 mca_msr_reg(int bank, enum mca_msr reg);
-
/* Decide whether to add MCE record to MCE event pool or filter it out. */
extern bool filter_mce(struct mce *m);
@@ -209,4 +207,25 @@ static inline void winchip_machine_check(struct pt_regs *regs) {}
noinstr u64 mce_rdmsrl(u32 msr);
+static __always_inline u32 mca_msr_reg(int bank, enum mca_msr reg)
+{
+ if (mce_flags.smca) {
+ switch (reg) {
+ case MCA_CTL: return MSR_AMD64_SMCA_MCx_CTL(bank);
+ case MCA_ADDR: return MSR_AMD64_SMCA_MCx_ADDR(bank);
+ case MCA_MISC: return MSR_AMD64_SMCA_MCx_MISC(bank);
+ case MCA_STATUS: return MSR_AMD64_SMCA_MCx_STATUS(bank);
+ }
+ }
+
+ switch (reg) {
+ case MCA_CTL: return MSR_IA32_MCx_CTL(bank);
+ case MCA_ADDR: return MSR_IA32_MCx_ADDR(bank);
+ case MCA_MISC: return MSR_IA32_MCx_MISC(bank);
+ case MCA_STATUS: return MSR_IA32_MCx_STATUS(bank);
+ }
+
+ return 0;
+}
+
#endif /* __X86_MCE_INTERNAL_H__ */
--
2.29.2
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette