objtool: Fix some -ffunction-sections edge cases

Fix some more fallout from commit 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros").

For tip/objtool/core.

Josh Poimboeuf (4):
vmlinux.lds: Fix TEXT_MAIN to include .text.start and friends
media: atomisp: Fix startup() section placement with
-ffunction-sections
drivers/xen/xenbus: Fix split() section placement with AutoFDO
objtool: Warn on functions with ambiguous -ffunction-sections section
names

 .../media/atomisp/i2c/atomisp-ov2722.c        |  6 +--
 drivers/xen/xenbus/xenbus_xs.c                |  4 +-
 include/asm-generic/vmlinux.lds.h             | 38 +++++++++++++------
 tools/objtool/Documentation/objtool.txt       |  7 ++++
 tools/objtool/check.c                         | 33 ++++++++++++++++
 5 files changed, 72 insertions(+), 16 deletions(-)

2.51.1

Since commit 6568f14cb5ae ("vmlinux.lds: Exclude .text.startup and .text.exit from TEXT_MAIN"), the TEXT_MAIN macro uses a series of patterns to prevent the .text.startup[.*] and .text.exit[.*] sections from getting linked into vmlinux runtime .text.

That commit is a tad too aggressive: it also inadvertently filters out valid runtime text sections like .text.start and .text.start.constprop.0, which can be generated for a function named start() when -ffunction-sections is enabled.

As a result, those sections become orphans when building with CONFIG_LD_DEAD_CODE_DATA_ELIMINATION for arm:

arm-linux-gnueabi-ld: warning: orphan section .text.start.constprop.0' from drivers/usb/host/sl811-hcd.o' being placed in section `.text.start.constprop.0'
arm-linux-gnueabi-ld: warning: orphan section .text.start.constprop.0' from drivers/media/dvb-frontends/drxk_hard.o' being placed in section `.text.start.constprop.0'
arm-linux-gnueabi-ld: warning: orphan section .text.start' from drivers/media/dvb-frontends/stv0910.o' being placed in section `.text.start'
arm-linux-gnueabi-ld: warning: orphan section .text.start.constprop.0' from drivers/media/pci/ddbridge/ddbridge-sx8.o' being placed in section `.text.start.constprop.0'

Fix that by explicitly adding the partial "substring" sections (.text.s, .text.st, .text.sta, etc) and their cloned derivatives.

While this unfortunately means that TEXT_MAIN continues to grow, these changes are ultimately necessary for proper support of -ffunction-sections.

---
 include/asm-generic/vmlinux.lds.h | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

index 9de1d900fa15..20695bc8f174 100644
@@ -90,8 +90,9 @@
  * Support -ffunction-sections by matching .text and .text.*,
  * but exclude '.text..*', .text.startup[.*], and .text.exit[.*].
  *
- * .text.startup and .text.startup.* are matched later by INIT_TEXT.
- * .text.exit and .text.exit.* are matched later by EXIT_TEXT.
+ * .text.startup and .text.startup.* are matched later by INIT_TEXT, and
+ * .text.exit and .text.exit.* are matched later by EXIT_TEXT, so they must be
+ * explicitly excluded here.
  *
  * Other .text.* sections that are typically grouped separately, such as
  * .text.unlikely or .text.hot, must be matched explicitly before using

@@ -100,16 +101,16 @@
 #define TEXT_MAIN							\
 	.text								\
 	.text.[_0-9A-Za-df-rt-z]*					\
-	.text.s[_0-9A-Za-su-z]*						\
-	.text.st[_0-9A-Zb-z]*						\
-	.text.sta[_0-9A-Za-qs-z]*					\
-	.text.star[_0-9A-Za-su-z]*					\
-	.text.start[_0-9A-Za-tv-z]*					\
-	.text.startu[_0-9A-Za-oq-z]*					\
+	.text.s[_0-9A-Za-su-z]*		.text.s		.text.s.*	\
+	.text.st[_0-9A-Zb-z]*		.text.st	.text.st.*	\
+	.text.sta[_0-9A-Za-qs-z]*	.text.sta	.text.sta.*	\
+	.text.star[_0-9A-Za-su-z]*	.text.star	.text.star.*	\
+	.text.start[_0-9A-Za-tv-z]*	.text.start	.text.start.*	\
+	.text.startu[_0-9A-Za-oq-z]*	.text.startu	.text.startu.*	\
 	.text.startup[_0-9A-Za-z]*					\
-	.text.e[_0-9A-Za-wy-z]*						\
-	.text.ex[_0-9A-Za-hj-z]*					\
-	.text.exi[_0-9A-Za-su-z]*					\
+	.text.e[_0-9A-Za-wy-z]*		.text.e		.text.e.*	\
+	.text.ex[_0-9A-Za-hj-z]*	.text.ex	.text.ex.*	\
+	.text.exi[_0-9A-Za-su-z]*	.text.exi	.text.exi.*	\
 	.text.exit[_0-9A-Za-z]*
 
 /*

2.51.1

When compiling the kernel with -ffunction-sections (e.g., for LTO, livepatch, dead code elimination, AutoFDO, or Propeller), the startup() function gets compiled into the .text.startup section. In some cases it can even be cloned into .text.startup.constprop.0 or .text.startup.isra.0.

However, the .text.startup and .text.startup.* section names are already reserved for use by the compiler for __attribute__((constructor)) code.

This naming conflict causes the vmlinux linker script to wrongly place startup() function code in .init.text, which gets freed during boot.

Fix that by renaming startup() to ov2722_startup().

---
 drivers/staging/media/atomisp/i2c/atomisp-ov2722.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index c7de7800799a..a4519babf37d 100644
@@ -600,7 +600,7 @@ static int ov2722_s_power(struct v4l2_subdev *sd, int on)
 }
 
 /* TODO: remove it. */
-static int startup(struct v4l2_subdev *sd)
+static int ov2722_startup(struct v4l2_subdev *sd)
 {
 	struct ov2722_device *dev = to_ov2722_sensor(sd);
 	struct i2c_client *client = v4l2_get_subdevdata(sd);

@@ -662,7 +662,7 @@ static int ov2722_set_fmt(struct v4l2_subdev *sd,
 	dev->pixels_per_line = dev->res->pixels_per_line;
 	dev->lines_per_frame = dev->res->lines_per_frame;
 
-	ret = startup(sd);
+	ret = ov2722_startup(sd);
 	if (ret) {
 		int i = 0;
 

@@ -677,7 +677,7 @@ static int ov2722_set_fmt(struct v4l2_subdev *sd,
 				dev_err(&client->dev, "power up failed, continue\n");
 				continue;
 			}
-			ret = startup(sd);
+			ret = ov2722_startup(sd);
 			if (ret) {
 				dev_err(&client->dev, " startup FAILED!\n");
 			} else {

2.51.1

Urgh, that's a 'fun' one. Is this not a -ffunction-sections bug? I mean, the compiler should never put regular non-reserved user symbols in a section it has reserved for itself, right?

Right, so there's no ambiguity *IF* we know in advance whether it was compiled with -ffunction-sections. If so, constructor code goes in .text.startup.*, and startup() goes in .text.startup or .text.startup.constprop.0 or .text.startup.isra.0.

So it's not really a compiler bug because it's possible to disambiguate those.

Problem is, we can have some objects compiled with -ffunction-sections, and some compiled without, in the same kernel. So the disambiguation isn't possible at link time, since for example .text.startup could be startup() with -ffunction-sections, or it could be __attribute__((constructor)) without -ffunction-sections.

I attempted to describe all that in patch 4.

Josh

Egads, what a mess :-(

When compiling the kernel with -ffunction-sections enabled, the split() function gets compiled into the .text.split section. In some cases it can even be cloned into .text.split.constprop.0 or .text.split.isra.0.

However, .text.split.* is already reserved for use by the Clang -fsplit-machine-functions flag, which is used by AutoFDO. That may place part of a function's code in a .text.split.<func> section.

This naming conflict causes the vmlinux linker script to wrongly place split() with other .text.split.* code, rather than where it belongs with regular text.

Fix it by renaming split() to split_strings().

---
 drivers/xen/xenbus/xenbus_xs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 528682bf0c7f..f794014814be 100644
@@ -410,7 +410,7 @@ static char *join(const char *dir, const char *name)
 	return (!buffer) ? ERR_PTR(-ENOMEM) : buffer;
 }
 
-static char **split(char *strings, unsigned int len, unsigned int *num)
+static char **split_strings(char *strings, unsigned int len, unsigned int *num)
 {
 	char *p, **ret;
 

@@ -448,7 +448,7 @@ char **xenbus_directory(struct xenbus_transaction t,
 	if (IS_ERR(strings))
 		return ERR_CAST(strings);
 
-	return split(strings, len, num);
+	return split_strings(strings, len, num);
 }
 EXPORT_SYMBOL_GPL(xenbus_directory);
 

2.51.1

When compiled with -ffunction-sections, a function named startup() will be placed in .text.startup. However, .text.startup is also used by the compiler for functions with __attribute__((constructor)).

That creates an ambiguity for the vmlinux linker script, which needs to differentiate those two cases.

Similar naming conflicts exist for functions named exit(), split(), unlikely(), hot() and unknown().

One potential solution would be to use '#ifdef CC_USING_FUNCTION_SECTIONS' to create two distinct implementations of the TEXT_MAIN macro. However, -ffunction-sections can be (and is) enabled or disabled on a per-object basis (for example via ccflags-y or AUTOFDO_PROFILE).

So the recently unified TEXT_MAIN macro (commit 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros")) is necessary. This means there's no way for the linker script to disambiguate things.

Instead, use objtool to warn on any function names whose resulting section names might create ambiguity when the kernel is compiled (in whole or in part) with -ffunction-sections.

---
 include/asm-generic/vmlinux.lds.h       | 15 +++++++++++
 tools/objtool/Documentation/objtool.txt |  7 ++++++
 tools/objtool/check.c                   | 33 +++++++++++++++++++++++++
 3 files changed, 55 insertions(+)

index 20695bc8f174..57aa01d24087 100644
@@ -97,6 +97,21 @@
  * Other .text.* sections that are typically grouped separately, such as
  * .text.unlikely or .text.hot, must be matched explicitly before using
  * TEXT_MAIN.
+ *
+ * NOTE: builds *with* and *without* -ffunction-sections are both supported by
+ * this single macro.  Even with -ffunction-sections, there may be some objects
+ * NOT compiled with the flag due to the use of a specific Makefile override
+ * like cflags-y or AUTOFDO_PROFILE_foo.o.  So this single catchall rule is
+ * needed to support mixed object builds.
+ *
+ * One implication is that functions named startup(), exit(), split(),
+ * unlikely(), hot(), and unknown() are not allowed in the kernel due to the
+ * ambiguity of their section names with -ffunction-sections.  For example,
+ * .text.startup could be __attribute__((constructor)) code in a *non*
+ * ffunction-sections object, which should be placed in .init.text; or it could
+ * be an actual function named startup() in an ffunction-sections object, which
+ * should be placed in .text.  Objtool will detect and complain about any such
+ * ambiguously named functions.
  */
 #define TEXT_MAIN							\
 	.text								\

index 9e97fc25b2d8..f88f8d28513a 100644
@@ -456,6 +456,13 @@ the objtool maintainers.
     these special names and does not use module_init() / module_exit()
     macros to create them.
 
+13. file.o: warning: func() function name creates ambiguity with -ffunctions-sections
+
+    Functions named startup(), exit(), split(), unlikely(), hot(), and
+    unknown() are not allowed due to the ambiguity of their section
+    names when compiled with -ffunction-sections.  For more information,
+    see the comment above TEXT_MAIN in include/asm-generic/vmlinux.lds.h.
+
 
 If the error doesn't seem to make sense, it could be a bug in objtool.
 Feel free to ask objtool maintainers for help.

index d071fbf73e4c..ac78f6ec9758 100644
@@ -2662,6 +2662,37 @@ static int decode_sections(struct objtool_file *file)
 	return 0;
 }
 
+/*
+ * Certain function names are disallowed due to section name ambiguities
+ * introduced by -ffunction-sections.
+ *
+ * See the comment above TEXT_MAIN in include/asm-generic/vmlinux.lds.h.
+ */
+static int validate_function_names(struct objtool_file *file)
+{
+	struct symbol *func;
+	int warnings = 0;
+
+	for_each_sym(file->elf, func) {
+		if (!is_func_sym(func))
+			continue;
+
+		if (!strcmp(func->name, "startup")	|| strstarts(func->name, "startup.")	||
+		    !strcmp(func->name, "exit")		|| strstarts(func->name, "exit.")	||
+		    !strcmp(func->name, "split")	|| strstarts(func->name, "split.")	||
+		    !strcmp(func->name, "unlikely")	|| strstarts(func->name, "unlikely.")	||
+		    !strcmp(func->name, "hot")		|| strstarts(func->name, "hot.")	||
+		    !strcmp(func->name, "unknown")	|| strstarts(func->name, "unknown.")) {
+
+			WARN("%s() function name creates ambiguity with -ffunction-sections",
+			     func->name);
+			warnings++;
+		}
+	}
+
+	return warnings;
+}
+
 static bool is_special_call(struct instruction *insn)
 {
 	if (insn->type == INSN_CALL) {

@@ -4928,6 +4959,8 @@ int check(struct objtool_file *file)
 	if (!nr_insns)
 		goto out;
 
+	warnings += validate_function_names(file);
+
 	if (opts.retpoline)
 		warnings += validate_retpoline(file);
 

2.51.1