[PATCH] powerpc/ftrace: restore r2 to caller's stack on livepatch sibling call

[Ryan Sullivan]

Currently, on PowerPC machines, sibling calls in livepatched functions
cause the stack to be corrupted and are thus not supported by tools
such as kpatch. Below is an example stack frame showing one such
currupted stacks:

RHEL-7.6: Linux 3.10.0 ppc64le

Livepatch applied:

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e008aefc3a9d..7c70e369390d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2228,6 +2228,8 @@ static void xs_tcp_shutdown(struct rpc_xprt *xprt)
 	struct socket *sock = transport->sock;
 	int skst = transport->inet ? transport->inet->sk_state : TCP_CLOSE;

+	asm("nop");
+
 	if (sock == NULL)
 		return;
 	switch (skst) {

Context:

- The livepatch updates both xs_tcp_shutdown() and xs_reset_transport()
in the sunrpc module. This causes the compiler to generate a tail call
optimization for the patched instance of xs_tcp_shutdown() ->
xs_reset_transport()

Stack Frame:

 #4 [c000002fe4be7c00] __rpc_create_common at d000000026e118f4 [sunrpc]
    c000002fe4be7c00: c000002fe4be7c40 0000000000000000
    c000002fe4be7c10: c00000000000b054 d000000026fda3d8 < corrupted toc
    c000002fe4be7c20: c00000000626cf00 c000002fe1a5f100
    c000002fe4be7c30: c000003c79cbec48 c000003c79cbec50
 #5 [c000002fe4be7c40] process_one_work at c00000000012333c
    c000002fe4be7c40: c000002fe4be7ce0 c000000006260a00
    c000002fe4be7c50: c00000000012333c c0000000013e4d00 < correct toc
    c000002fe4be7c60: 0000000000000000 0000000000000000
    c000002fe4be7c70: 0000000000000000 0000000000000000
    c000002fe4be7c80: c000002fe4be7ce0 c0000000013510b0
    c000002fe4be7c90: 0000000000000001 fffffffffffffef7
    c000002fe4be7ca0: 0000000000000000 c000000006260980
    c000002fe4be7cb0: c000002fe1a5f130 c000000001422280
    c000002fe4be7cc0: c000000006260620 c000003c79cbec48
    c000002fe4be7cd0: c000000006260600 c000002fe1a5f100
 #6 [c000002fe4be7ce0] worker_thread at c000000000123980
    c000002fe4be7ce0: c000002fe4be7d80 0000000000003300
    c000002fe4be7cf0: c000000000123980 c000002fe8c8bb40
    c000002fe4be7d00: 0000000000000000 0000000000000000
    c000002fe4be7d10: 0000000000000000 0000000000000000
    c000002fe4be7d20: 0000000000000000 0000000000000000
    c000002fe4be7d30: 0000000000000000 0000000000000000
    c000002fe4be7d40: 0000000000000000 0000000000000000
    c000002fe4be7d50: c0000000001237e0 c000002fe1a5f100
    c000002fe4be7d60: c000000000c894a0 c0000000016be410
    c000002fe4be7d70: 0000000000000000 c000002fe8c8bb40

This is caused by the toc stub generated on a sibling call:

0xd000000026fd0ad0 <xs_tcp_shutdown+816>:       addis   r11,r2,-1
0xd000000026fd0ad4 <xs_tcp_shutdown+820>:       addi    r11,r11,26360
0xd000000026fd0ad8 <xs_tcp_shutdown+824>:       std     r2,24(r1)
                                                ^ corrupts stack frame
0xd000000026fd0adc <xs_tcp_shutdown+828>:       ld      r12,32(r11)
0xd000000026fd0ae0 <xs_tcp_shutdown+832>:       mtctr   r12
0xd000000026fd0ae4 <xs_tcp_shutdown+836>:       bctr

This ends up saving the livepatch toc to the caller's stack located in
the sunrpc module so that since the stack is not popped, once the
caller attempts to use the toc, a kernel panic results from being
unable to handle the kernel paging request for data at that location
outside the caller's module.

This patch restores r2 value to caller's stack, on a sibling call this
will uncorrupt the caller's stack and otherwise will be redundant.

Signed-off-by: Ryan Sullivan <rysulliv at redhat.com>
---
 arch/powerpc/kernel/trace/ftrace_entry.S | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/kernel/trace/ftrace_entry.S b/arch/powerpc/kernel/trace/ftrace_entry.S
index 76dbe9fd2c0f..4dfbe6076ad1 100644
--- a/arch/powerpc/kernel/trace/ftrace_entry.S
+++ b/arch/powerpc/kernel/trace/ftrace_entry.S
@@ -244,6 +244,9 @@ livepatch_handler:
 	mtlr	r12
 	ld	r2,  -24(r11)
 
+	/* Restore toc to caller's stack in case of sibling call */
+	std	r2, 24(r1)
+
 	/* Pop livepatch stack frame */
 	ld	r12, PACA_THREAD_INFO(r13)
 	subi	r11, r11, 24
-- 
2.44.0