This series is a followup to the single patch 'modversions: treat symbol
CRCs as 32 bit quantities on 64 bit archs', of which three versions have
been sent out so far [0][1][2]
Given the recent issues regarding modversions, I have added some more
people to cc this time.
As pointed out by Michael, GNU ld behaves a bit differently between arm64
and PowerPC64, and where the former gets rid of all runtime relocations
related to CRCs, the latter is not as easily convinced.
Patch #1 fixes the issue where CRCs are corrupted by the runtime relocation
routines for 32-bit PowerPC, for which the original fix was effectively
reverted by commit 0e0ed6406e61 ("powerpc/modules: Module CRC relocation fix
causes perf issues")
Patch #2 adds handling of R_PPC64_ADDR32 relocations against the NULL .dynsym
symbol entry to the PPC64 runtime relocation routines, so it is prepared to
deal with CRCs being emitted as 32-bit quantities.
Patch #3 is the original patch from the v1 and v2 submissions.
Changes since v3:
- rebased onto v4.10-rc
- add Suzuki's ack to patch #1
- update patch #2 to work around the binutils-powerpc behavior to only
account for R_PPC64_RELATIVE relocations in the RELACOUNT entry in
.dynamic
Changes since v2:
- added #1 and #2
- updated #3 to deal with CRC entries being emitted from assembler
- added Rusty's ack (#3)
Branch can be found here:
https://git.kernel.org/cgit/linux/kernel/git/ardb/linux.git/log/?h=kcrctab-reloc
[0] http://marc.info/?l=linux-kernel&m=147652300207369&w=2
[1] http://marc.info/?l=linux-kernel&m=147695629614409&w=2
[2] http://marc.info/?l=linux-kernel&m=147758564705776&w=2
Ard Biesheuvel (3):
powerpc/reloc32: fix corrupted modversion CRCs
powerpc/reloc64: add support for 32-bit CRC pseudo-symbols
modversions: treat symbol CRCs as 32 bit quantities on 64 bit archs
arch/powerpc/include/asm/module.h | 4 --
arch/powerpc/kernel/module_64.c | 8 ---
arch/powerpc/kernel/reloc_32.S | 36 ++++++++++--
arch/powerpc/kernel/reloc_64.S | 60 ++++++++++++--------
arch/powerpc/kernel/vmlinux.lds.S | 1 +
arch/powerpc/relocs_check.sh | 5 +-
include/asm-generic/export.h | 7 +--
include/linux/export.h | 8 +++
include/linux/module.h | 14 ++---
kernel/module.c | 47 ++++++---------
10 files changed, 105 insertions(+), 85 deletions(-)
--
2.7.4
Commit 0e0ed6406e61 ("powerpc/modules: Module CRC relocation fix causes
perf issues") fixed an issue with relocatable PIE kernels in a way that
essentially reintroduced the issue again for 32-bit builds.
Since the chosen approach does is not applicable to 32-bit, fix the
issue by updating the runtime relocation routine to ignore the load
offset for the interval [__start___kcrctab, __stop___kcrctab_gpl_future),
which is where the CRCs reside. This ensures that the values of the CRC
pseudo-symbols are no longer made dependent on the runtime load offset.
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Ard Biesheuvel <redacted>
---
arch/powerpc/kernel/reloc_32.S | 36 +++++++++++++++++---
1 file changed, 32 insertions(+), 4 deletions(-)
In preparation of modifying the core modversions code to emit the CRCs
as 32-bit quantities, ensure that 64-bit PowerPC will be able to deal
with this when CONFIG_RELOCATABLE=y, in which case the CRCs will be
emitted into the final ELF binary as R_PPC64_ADDR32 relocations.
Since 32-bit relocations cannot be used to relocate memory addresses on
64-bit architectures, and since the CRC pseudo-symbol references are
emitted as anonymous relocations (i.e., against the NULL symbol in the
.dynsym section) with the final value recorded in the addend (*), we
can disregard any relocations where the symbol index != 0.
* Note that unsatisfied CRC pseudo-symbol references are emitted as
R_PPC64_ADDR32 relocations against named symbols that are typed as
weak undefined in the .dynsym symbol table. These can simply be
ignored (as before), considering that zero CRCs are interpreted as
missing, and the module code deals with that accordingly.
As it turns out, binutils for powerpc does not account for any relocations
beyond R_PPC64_RELATIVE ones in the RELACOUNT field of the .dynamic section,
which is unfortunate, since we need to do extra work to figure out the size
of the relocation array. So with a little help from the linker scripts,
grab an end pointer rather than a count, and iterate over the entire section.
Signed-off-by: Ard Biesheuvel <redacted>
---
arch/powerpc/kernel/reloc_64.S | 60 ++++++++++++--------
arch/powerpc/kernel/vmlinux.lds.S | 1 +
arch/powerpc/relocs_check.sh | 5 +-
3 files changed, 40 insertions(+), 26 deletions(-)
The modversion symbol CRCs are emitted as ELF symbols, which allows us to
easily populate the kcrctab sections by relying on the linker to associate
each kcrctab slot with the correct value.
This has a couple of downsides:
- Given that the CRCs are treated as memory addresses, we waste 4 bytes
for each CRC on 64 bit architectures,
- On architectures that support runtime relocation, a R_<arch>_RELATIVE
relocation entry is emitted for each CRC value, which identifies it as
a quantity that requires fixing up based on the actual runtime load
offset of the kernel. This results in corrupted CRCs unless we
explicitly undo the fixup (and this is currently being handled in the
core module code)
- Such runtime relocation entries take up 24 bytes of __init space each,
resulting in a x8 overhead in [uncompressed] kernel size for CRCs.
Switching to explicit 32 bit values on 64 bit architectures fixes most
of these issues, given that 32 bit values are not treated as quantities
that require fixing up based on the actual runtime load offset. Note that
on some ELF64 architectures [such as PPC64], these 32-bit values are still
emitted as runtime relocatable quantities, even if the value resolves to
a build time constant. However, these can easily be distinguished from
variables that do need fixing up, and the CRCs can be emitted correctly
in the arch specific runtime relocation routines right off the bat.
So redefine all CRC fields and variables as u32, and redefine the
__CRC_SYMBOL() macro for 64 bit builds to emit the CRC reference using
inline assembler (which is necessary since 64-bit C code cannot use
32-bit types to hold memory addresses, even if they are ultimately
resolved using values that do not exceed 0xffffffff.
Note that this mostly reverts commit d4703aefdbc8 ("module: handle ppc64
relocating kcrctabs when CONFIG_RELOCATABLE=y")
Acked-by: Rusty Russell <redacted>
Signed-off-by: Ard Biesheuvel <redacted>
---
arch/powerpc/include/asm/module.h | 4 --
arch/powerpc/kernel/module_64.c | 8 ----
include/asm-generic/export.h | 7 +--
include/linux/export.h | 8 ++++
include/linux/module.h | 14 +++---
kernel/module.c | 47 +++++++-------------
6 files changed, 33 insertions(+), 55 deletions(-)
@@ -286,14 +286,6 @@ static void dedotify_versions(struct modversion_info *vers,for(end=(void*)vers+size;vers<end;vers++)if(vers->name[0]=='.'){memmove(vers->name,vers->name+1,strlen(vers->name));-#ifdef ARCH_RELOCATES_KCRCTAB-/* The TOC symbol has no CRC computed. To avoid CRC-*checkfailing,wemustforceittotheexpected-*value(seeCRCcheckinmodule.c).-*/-if(!strcmp(vers->name,"TOC."))-vers->crc=-(unsignedlong)reloc_start;-#endif}}
@@ -382,7 +382,7 @@ struct module {/* symbols that will be GPL-only in the near future. */conststructkernel_symbol*gpl_future_syms;-constunsignedlong*gpl_future_crcs;+constu32*gpl_future_crcs;unsignedintnum_gpl_future_syms;/* Exception table */
@@ -1249,23 +1249,11 @@ static int try_to_force_load(struct module *mod, const char *reason)}#ifdef CONFIG_MODVERSIONS-/* If the arch applies (non-zero) relocations to kernel kcrctab, unapply it. */-staticunsignedlongmaybe_relocated(unsignedlongcrc,-conststructmodule*crc_owner)-{-#ifdef ARCH_RELOCATES_KCRCTAB-if(crc_owner==NULL)-returncrc-(unsignedlong)reloc_start;-#endif-returncrc;-}-staticintcheck_version(Elf_Shdr*sechdrs,unsignedintversindex,constchar*symname,structmodule*mod,-constunsignedlong*crc,-conststructmodule*crc_owner)+constu32*crc){unsignedinti,num_versions;structmodversion_info*versions;
@@ -1286,10 +1274,10 @@ static int check_version(Elf_Shdr *sechdrs,if(strcmp(versions[i].name,symname)!=0)continue;-if(versions[i].crc==maybe_relocated(*crc,crc_owner))+if(versions[i].crc==*crc)return1;-pr_debug("Found checksum %lX vs module %lX\n",-maybe_relocated(*crc,crc_owner),versions[i].crc);+pr_debug("Found checksum %X vs module %lX\n",+*crc,versions[i].crc);gotobad_version;}
@@ -1307,7 +1295,7 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,unsignedintversindex,structmodule*mod){-constunsignedlong*crc;+constu32*crc;/**Sincethisshouldbefoundinkernel(whichcan'tberemoved),no
@@ -1321,8 +1309,7 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,}preempt_enable();returncheck_version(sechdrs,versindex,-VMLINUX_SYMBOL_STR(module_layout),mod,crc,-NULL);+VMLINUX_SYMBOL_STR(module_layout),mod,crc);}/* First part is kernel version, which we ignore if module has crcs. */
@@ -1340,8 +1327,7 @@ static inline int check_version(Elf_Shdr *sechdrs,unsignedintversindex,constchar*symname,structmodule*mod,-constunsignedlong*crc,-conststructmodule*crc_owner)+constu32*crc){return1;}
On Tue, Jan 17, 2017 at 11:26 AM, Ard Biesheuvel
[off-list ref] wrote:
The modversion symbol CRCs are emitted as ELF symbols, which allows us to
easily populate the kcrctab sections by relying on the linker to associate
each kcrctab slot with the correct value.
This has a couple of downsides:
So the whole relocation of the crc is obviously completely crazy, but
you don't actually seem to *change* that. You just work around it, and
you make the symbols 32-bit. The latter part I agree with
whole-heartedly, btw.
But do we really have to accept this relocation insanity?
So I don't actually disagree with this patch 3/3 (turning the whole
crc array into an array of "u32" is clearly the right thing to do),
but the two other patches look oddly broken.
Why are those CRC's relocatable to begin with? Shouldn't they be
absolute values? Why do they get those idiotic relocation things? They
seem to be absolute on x86-64 (just doing a 'nm vmlinux', so I might
be missing something), why aren't they on ppc?
Is there something wrong with our generation script? Can we possibly
do something like
- printf("%s__crc_%s = 0x%08lx ;\n", mod_prefix, name, crc);
+ printf("%s__crc_%s = ABSOLUTE(0x%08lx) ;\n", mod_prefix, name, crc);
in genksyms.c to get rid of the crazty relocation entries?
Linus
On 17 January 2017 at 23:47, Linus Torvalds
[off-list ref] wrote:
On Tue, Jan 17, 2017 at 11:26 AM, Ard Biesheuvel
[off-list ref] wrote:
quoted
The modversion symbol CRCs are emitted as ELF symbols, which allows us to
easily populate the kcrctab sections by relying on the linker to associate
each kcrctab slot with the correct value.
This has a couple of downsides:
So the whole relocation of the crc is obviously completely crazy, but
you don't actually seem to *change* that. You just work around it, and
you make the symbols 32-bit. The latter part I agree with
whole-heartedly, btw.
But do we really have to accept this relocation insanity?
So I don't actually disagree with this patch 3/3 (turning the whole
crc array into an array of "u32" is clearly the right thing to do),
but the two other patches look oddly broken.
Why are those CRC's relocatable to begin with? Shouldn't they be
absolute values? Why do they get those idiotic relocation things? They
seem to be absolute on x86-64 (just doing a 'nm vmlinux', so I might
be missing something), why aren't they on ppc?
On powerpc and arm64, those __crc_xxx symbols are absolute as well,
but oddly enough, that does not mean they are not subject to runtime
relocation under -pie, which is how arm64 and powerpc create their
relocatable kernel images. The difference with x86 is that they
invented their own tooling to do runtime relocation, based on
--emit-relocs and filtering based on symbol names, so they don't rely
on ELF relocations at all for runtime relocation of the core kernel.
On ppc64:
$ nm vmlinux |grep __crc_ |head
000000009d37922d a __crc___ablkcipher_walk_complete
00000000c4309a46 a __crc_ablkcipher_walk_done
0000000038e1d7e1 a __crc_ablkcipher_walk_phys
00000000a55b33a4 a __crc_abort_creds
000000005776482e a __crc_access_process_vm
000000001215a9fb a __crc_account_page_dirtied
00000000b25ee3c8 a __crc_account_page_redirty
00000000ccab9422 a __crc_ack_all_badblocks
0000000027013bae a __crc_acomp_request_alloc
0000000013236c1b a __crc_acomp_request_free
[note the lowercase 'a', this is due to my attempt at emitting them as HIDDEN()]
On arm64, patch 3/3 is sufficient, because the linker infers from the
size of the symbol reference that it is not a memory address, and
resolves the relocation at link time.
Is there something wrong with our generation script? Can we possibly
do something like
- printf("%s__crc_%s = 0x%08lx ;\n", mod_prefix, name, crc);
+ printf("%s__crc_%s = ABSOLUTE(0x%08lx) ;\n", mod_prefix, name, crc);
in genksyms.c to get rid of the crazty relocation entries?
Nope, no difference at all, given that the symbols were ABSOLUTE to
begin with. Emitting them as HIDDEN() does not help either, nor does
passing -Bsymbolic on the linker command line.
So on powerpc, the linker insists on emitting the relocation into the
runtime relocation section [*], regardless of whether it is ABSOLUTE()
or HIDDEN(), or whether -Bsymbolic is being passed. My suspicion is
that, due to the fact that PIE handling is closely related to shared
library handling, the linker defers the resolution of relocations
against __crc_xxx symbols to runtime because they are preemptible
under ELF rules for shared libraries, i.e., an application linking to
a shared library is able to override symbols that the shared library
defines, and the shared library *must* update its internal references
to point to the new version of the symbol. Of course, this makes no
sense at all for PIE binaries, and on arm64, the toolchain does the
right thing in this regard when passing the -Bsymbolic parameter. On
powerpc, however, the linker *insists* on exposing these relocations
to the runtime loader, even if they are marked hidden (which is
supposed to inhibit this behavior).
I have also tried using relative references (which always get resolved
at link time), e.g.,
@@ -693,7 +693,8 @@ void export_symbol(const char *name)fputs(">\n",debugfile);/* Used as a linker script. */-printf("%s__crc_%s = 0x%08lx ;\n",mod_prefix,name,crc);+printf("%s__crc_%s = %s__crc_rel_%s + 0x%08lx;\n",mod_prefix,+name,mod_prefix,name,crc);}}
but this doesn't work either: the __crc_xxx symbols that are emitted
during partial linking evaluate the __crc_rel_xxx references at
partial link time, which means the resulting relative relocations
refer to the actual CRC value rather than the modified CRC value. The
only way to make /this/ work, afaik, is to hack the build scripts so
that the __crc_xxx = assignments occur in the scope of the final
linker script, rather than during partial linking (but only for
vmlinux, not for modules). All of this complicates the common path
used by all architectures, so I don't think we should go down this
road.
So I don't see any other way to work around this for powerpc (other
than creating some build time tooling to process the 32-bit
relocations for the CRC symbols in the vmlinux ELF binary) Hopefully,
Michael will be able to confirm that this v4 of 2/3 works correctly,
then we can discuss whether to go ahead with this or not.
--
Ard.
[*] and sadly, it only counts R_PPC64_RELATIVE relocations in its
.dynamic section's RELACOUNT, which requires additional handling in
patch 2/3
On 18 January 2017 at 11:37, Ard Biesheuvel [off-list ref] wrote:
On 17 January 2017 at 23:47, Linus Torvalds
[off-list ref] wrote:
quoted
On Tue, Jan 17, 2017 at 11:26 AM, Ard Biesheuvel
[off-list ref] wrote:
quoted
The modversion symbol CRCs are emitted as ELF symbols, which allows us to
easily populate the kcrctab sections by relying on the linker to associate
each kcrctab slot with the correct value.
This has a couple of downsides:
So the whole relocation of the crc is obviously completely crazy, but
you don't actually seem to *change* that. You just work around it, and
you make the symbols 32-bit. The latter part I agree with
whole-heartedly, btw.
But do we really have to accept this relocation insanity?
So I don't actually disagree with this patch 3/3 (turning the whole
crc array into an array of "u32" is clearly the right thing to do),
but the two other patches look oddly broken.
Why are those CRC's relocatable to begin with? Shouldn't they be
absolute values? Why do they get those idiotic relocation things? They
seem to be absolute on x86-64 (just doing a 'nm vmlinux', so I might
be missing something), why aren't they on ppc?
On powerpc and arm64, those __crc_xxx symbols are absolute as well,
but oddly enough, that does not mean they are not subject to runtime
relocation under -pie, which is how arm64 and powerpc create their
relocatable kernel images.
The difference with x86 is that they
invented their own tooling to do runtime relocation, based on
--emit-relocs and filtering based on symbol names, so they don't rely
on ELF relocations at all for runtime relocation of the core kernel.
On ppc64:
$ nm vmlinux |grep __crc_ |head
000000009d37922d a __crc___ablkcipher_walk_complete
00000000c4309a46 a __crc_ablkcipher_walk_done
0000000038e1d7e1 a __crc_ablkcipher_walk_phys
00000000a55b33a4 a __crc_abort_creds
000000005776482e a __crc_access_process_vm
000000001215a9fb a __crc_account_page_dirtied
00000000b25ee3c8 a __crc_account_page_redirty
00000000ccab9422 a __crc_ack_all_badblocks
0000000027013bae a __crc_acomp_request_alloc
0000000013236c1b a __crc_acomp_request_free
[note the lowercase 'a', this is due to my attempt at emitting them as HIDDEN()]
On arm64, patch 3/3 is sufficient, because the linker infers from the
size of the symbol reference that it is not a memory address, and
resolves the relocation at link time.
quoted
Is there something wrong with our generation script? Can we possibly
do something like
- printf("%s__crc_%s = 0x%08lx ;\n", mod_prefix, name, crc);
+ printf("%s__crc_%s = ABSOLUTE(0x%08lx) ;\n", mod_prefix, name, crc);
in genksyms.c to get rid of the crazty relocation entries?
Nope, no difference at all, given that the symbols were ABSOLUTE to
begin with. Emitting them as HIDDEN() does not help either, nor does
passing -Bsymbolic on the linker command line.
So on powerpc, the linker insists on emitting the relocation into the
runtime relocation section [*], regardless of whether it is ABSOLUTE()
or HIDDEN(), or whether -Bsymbolic is being passed. My suspicion is
that, due to the fact that PIE handling is closely related to shared
library handling, the linker defers the resolution of relocations
against __crc_xxx symbols to runtime because they are preemptible
under ELF rules for shared libraries, i.e., an application linking to
a shared library is able to override symbols that the shared library
defines, and the shared library *must* update its internal references
to point to the new version of the symbol. Of course, this makes no
sense at all for PIE binaries, and on arm64, the toolchain does the
right thing in this regard when passing the -Bsymbolic parameter. On
powerpc, however, the linker *insists* on exposing these relocations
to the runtime loader, even if they are marked hidden (which is
supposed to inhibit this behavior).
I have also tried using relative references (which always get resolved
at link time), e.g.,
@@ -693,7 +693,8 @@ void export_symbol(const char *name)fputs(">\n",debugfile);/* Used as a linker script. */-printf("%s__crc_%s = 0x%08lx ;\n",mod_prefix,name,crc);+printf("%s__crc_%s = %s__crc_rel_%s + 0x%08lx;\n",mod_prefix,+name,mod_prefix,name,crc);}}
but this doesn't work either: the __crc_xxx symbols that are emitted
during partial linking evaluate the __crc_rel_xxx references at
partial link time, which means the resulting relative relocations
refer to the actual CRC value rather than the modified CRC value. The
only way to make /this/ work, afaik, is to hack the build scripts so
that the __crc_xxx = assignments occur in the scope of the final
linker script, rather than during partial linking (but only for
vmlinux, not for modules). All of this complicates the common path
used by all architectures, so I don't think we should go down this
road.
So I don't see any other way to work around this for powerpc (other
than creating some build time tooling to process the 32-bit
relocations for the CRC symbols in the vmlinux ELF binary) Hopefully,
Michael will be able to confirm that this v4 of 2/3 works correctly,
then we can discuss whether to go ahead with this or not.
--
Ard.
[*] and sadly, it only counts R_PPC64_RELATIVE relocations in its
.dynamic section's RELACOUNT, which requires additional handling in
patch 2/3
On 17 January 2017 at 19:26, Ard Biesheuvel [off-list ref] wrote:
In preparation of modifying the core modversions code to emit the CRCs
as 32-bit quantities, ensure that 64-bit PowerPC will be able to deal
with this when CONFIG_RELOCATABLE=y, in which case the CRCs will be
emitted into the final ELF binary as R_PPC64_ADDR32 relocations.
Since 32-bit relocations cannot be used to relocate memory addresses on
64-bit architectures, and since the CRC pseudo-symbol references are
emitted as anonymous relocations (i.e., against the NULL symbol in the
.dynsym section) with the final value recorded in the addend (*), we
can disregard any relocations where the symbol index != 0.
* Note that unsatisfied CRC pseudo-symbol references are emitted as
R_PPC64_ADDR32 relocations against named symbols that are typed as
weak undefined in the .dynsym symbol table. These can simply be
ignored (as before), considering that zero CRCs are interpreted as
missing, and the module code deals with that accordingly.
As it turns out, binutils for powerpc does not account for any relocations
beyond R_PPC64_RELATIVE ones in the RELACOUNT field of the .dynamic section,
which is unfortunate, since we need to do extra work to figure out the size
of the relocation array. So with a little help from the linker scripts,
grab an end pointer rather than a count, and iterate over the entire section.
While this is the case of RELACOUNT, RELASZ appears to behave as
expected. For instance, on a random vmlinux file (with patch 3/3
applied), I get
Dynamic Section:
HASH 0xc000000000cf5a40
STRTAB 0xc000000000cf4d80
SYMTAB 0xc000000000cf3e98
STRSZ 0x0000000000000bae
SYMENT 0x0000000000000018
DEBUG 0x0000000000000000
RELA 0xc000000000cf5ee8
RELASZ 0x00000000003308b8
RELAENT 0x0000000000000018
TEXTREL 0x0000000000000000
FLAGS_1 0x0000000008000000
RELACOUNT 0x0000000000020444
where RELACOUNT is the number of just the R_PPC64_RELATIVE
relocations, whereas RELASZ covers all of them (which is why RELASZ /
RELAENT != RELACOUNT)
So if preferred, I can respin this patch to retrieve RELASZ from the
dynamic section rather than the end of the .rela section from the
linker script, which would reduce the delta of this patch somewhat.
On Wed, Jan 18, 2017 at 10:27 AM, Linus Torvalds
[off-list ref] wrote:
I wonder what happened to gold, and why it didn't take over. I'm
assuming it had _other_ bugs.. Oh well.
Google for gold problems, I note that it has been reported to get
"internal error"s during kernel builds - and at least some of them
have been due to ksyms.
So the core problem seems to mainly be that gcc normally itself never
generates any absolute symbols, so the whole ksyms model depends on
things that get almost zero testing in the toolchain.
Oh well.
Linus
Ugh. I hate the GNU linker. It's slow, it does nasty crazy fixups, and
it's apparently buggy too.
I wonder what happened to gold, and why it didn't take over. I'm
assuming it had _other_ bugs.. Oh well.
Linus
On 18 January 2017 at 18:35, Linus Torvalds
[off-list ref] wrote:
On Wed, Jan 18, 2017 at 10:27 AM, Linus Torvalds
[off-list ref] wrote:
quoted
I wonder what happened to gold, and why it didn't take over. I'm
assuming it had _other_ bugs.. Oh well.
Google for gold problems, I note that it has been reported to get
"internal error"s during kernel builds - and at least some of them
have been due to ksyms.
So the core problem seems to mainly be that gcc normally itself never
generates any absolute symbols, so the whole ksyms model depends on
things that get almost zero testing in the toolchain.
Oh well.
There is one alternative that gets rid of all the hackiness, but it
does increase the CRC footprint on 32-bit platforms:
(and an equivalent change in include/linux/export.h)
So the kcrctab contains the relative (signed) offset to where the CRC
is stored, which gets rid of any absolute relocations. To grab the
CRC, we only have to add the value of the kcrctab entry to its
address, and dereference the resulting pointer.
This would remove the need for patches 1 and 2, and get rid of the
overhead of the runtime relocation entries not only for arm64 but for
powerpc as well. It would also get rid of the abuse of ELF symbols
once and for all, hopefully avoiding bugs in GNU ld and gold in the
future.
For a ballpark number of 10,000 CRCs in the core kernel, this would
increase the size of the image by 40 KB for 32-bit architectures (and
if saving 40 KB is essential, chances are you won't be using
modversions in the first place). For 64-bit architectures, there would
be no change in size, of course, except for saving 24 bytes of __init
space *per CRC* for arm64 and powerpc64 with CONFIG_RELOCATABLE=y
I will send out a separate RFC so we can discuss this alternative
On Wed, Jan 18, 2017 at 2:37 PM, Ard Biesheuvel
[off-list ref] wrote:
For a ballpark number of 10,000 CRCs in the core kernel, this would
increase the size of the image by 40 KB for 32-bit architectures (and
if saving 40 KB is essential, chances are you won't be using
modversions in the first place).
As you say, I don't think the space issue is much of a problem.
I'm more worried about the replacement of one crazy model that has
problems due to linker subtlety with _another_ one.
Your genksyms.c change is not exactly obvious. I looked at it, and my
brain just shut down. Why both the
LONG(0x%08lx);
_and_ the
"%s__crc_%s = 0x%08lx;\n"
in the linker script? I'm sure there's a good reason, but I'd like to
see a more explicit explanation fo what the generated linker script
does and what the rules are.
Linus
On 19 January 2017 at 00:15, Linus Torvalds
[off-list ref] wrote:
On Wed, Jan 18, 2017 at 2:37 PM, Ard Biesheuvel
[off-list ref] wrote:
quoted
For a ballpark number of 10,000 CRCs in the core kernel, this would
increase the size of the image by 40 KB for 32-bit architectures (and
if saving 40 KB is essential, chances are you won't be using
modversions in the first place).
As you say, I don't think the space issue is much of a problem.
I'm more worried about the replacement of one crazy model that has
problems due to linker subtlety with _another_ one.
Your genksyms.c change is not exactly obvious. I looked at it, and my
brain just shut down. Why both the
LONG(0x%08lx);
_and_ the
"%s__crc_%s = 0x%08lx;\n"
in the linker script? I'm sure there's a good reason, but I'd like to
see a more explicit explanation fo what the generated linker script
does and what the rules are.
This is simply because modpost still uses the value of the symbol
rather than the value it points to to generate the /other/ side of the
comparison (i.e., Module.symvers etc)
I will look into updating modpost to dereference the symbol as well,
and update the RFC patch accordingly.
On Thu, Jan 19, 2017 at 1:22 AM, Ard Biesheuvel
[off-list ref] wrote:
quoted
Your genksyms.c change is not exactly obvious. I looked at it, and my
brain just shut down. Why both the
LONG(0x%08lx);
_and_ the
"%s__crc_%s = 0x%08lx;\n"
in the linker script? I'm sure there's a good reason, but I'd like to
see a more explicit explanation fo what the generated linker script
does and what the rules are.
This is simply because modpost still uses the value of the symbol
rather than the value it points to to generate the /other/ side of the
comparison (i.e., Module.symvers etc)
Ahh, now that you explained it, it was obvious. Thanks.
But yes, I don't think we want that "both belt and suspenders"
approach, so your updated patch that does things just one way is I
think the right way.
I will look into updating modpost to dereference the symbol as well,
and update the RFC patch accordingly.
Yes, so your updated patch looks good to me.
I think our old "symbol with an absolute value" model was simpler
conceptually, but given the existing absolute (sic) braindamage of
linkers, I think your latest patch is probably the way to go.
If for no other reason than the fact that it doesn't depend on
something that clearly nobody else uses, and even the linker people
were confused about.
So I think the slightly more complex model of relative offsets is the
simpler one in the end if it means that we don't have to have
completely insane workarounds for linker damage.
But maybe somebody else wants to pipe up. Preferably somebody who
doesn't hate the symversions code as much as I do by now, and actually
_uses_ it ;)
Linus
On 19 January 2017 at 17:24, Linus Torvalds
[off-list ref] wrote:
On Thu, Jan 19, 2017 at 1:22 AM, Ard Biesheuvel
[off-list ref] wrote:
quoted
quoted
Your genksyms.c change is not exactly obvious. I looked at it, and my
brain just shut down. Why both the
LONG(0x%08lx);
_and_ the
"%s__crc_%s = 0x%08lx;\n"
in the linker script? I'm sure there's a good reason, but I'd like to
see a more explicit explanation fo what the generated linker script
does and what the rules are.
This is simply because modpost still uses the value of the symbol
rather than the value it points to to generate the /other/ side of the
comparison (i.e., Module.symvers etc)
Ahh, now that you explained it, it was obvious. Thanks.
But yes, I don't think we want that "both belt and suspenders"
approach, so your updated patch that does things just one way is I
think the right way.
quoted
I will look into updating modpost to dereference the symbol as well,
and update the RFC patch accordingly.
Yes, so your updated patch looks good to me.
I think our old "symbol with an absolute value" model was simpler
conceptually, but given the existing absolute (sic) braindamage of
linkers, I think your latest patch is probably the way to go.
OK.
If for no other reason than the fact that it doesn't depend on
something that clearly nobody else uses, and even the linker people
were confused about.
So I think the slightly more complex model of relative offsets is the
simpler one in the end if it means that we don't have to have
completely insane workarounds for linker damage.
But maybe somebody else wants to pipe up. Preferably somebody who
doesn't hate the symversions code as much as I do by now, and actually
_uses_ it ;)
I am not crazy about it either: I am simply trying to get rid of the
~10,000 pointless relocations in the arm64 KASLR kernel rather than
having to rely on the dodgy code that 'repairs' the CRCs at runtime.
I have noticed one slight snag though: the ARM module loader currently
has no support for the R_ARM_REL32 relocations that are emitted by the
relative references in the kcrctabs. I looked at other arches, x86,
ia64, s390, power and arm64, and those all seem to be fully equipped
in this regard, but it would be good if we could get some coverage for
this code on other architectures to find out which ones need to have
this support added as well.
Thanks,
Ard.