[PATCH v6 11/41] arm64: kernel: Manage absolute relocations in code built under pi/

[Marc Zyngier]

On Wed, 29 Nov 2023 11:16:07 +0000,
Ard Biesheuvel <ardb at google.com> wrote:
> 
> From: Ard Biesheuvel <ardb at kernel.org>
> 
> The mini C runtime runs before relocations are processed, and so it
> cannot rely on statically initialized pointer variables.
> 
> Add a check to ensure that such code does not get introduced by
> accident, by going over the relocations in each object, identifying the
> ones that operate on data sections that are part of the executable
> image, and raising an error if any relocations of type R_AARCH64_ABS64
> exist. Note that such relocations are permitted in other places (e.g.,
> debug sections) and will never occur in compiler generated code sections
> when using the small code model, so only check sections that have
> SHF_ALLOC set and SHF_EXECINSTR cleared.
> 
> To accommodate cases where statically initialized symbol references are
> unavoidable, introduce a special case for ELF input data sections that
> have ".rodata.prel64" in their names, and in these cases, instead of
> rejecting any encountered ABS64 relocations, convert them into PREL64
> relocations, which don't require any runtime fixups. Note that the code
> in question must still be modified to deal with this, as it needs to
> convert the 64-bit signed offsets into absolute addresses before use.
> 
> Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
> ---
>  arch/arm64/kernel/pi/Makefile    |   9 +-
>  arch/arm64/kernel/pi/pi.h        |  18 +++
>  arch/arm64/kernel/pi/relacheck.c | 130 ++++++++++++++++++++
>  3 files changed, 155 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kernel/pi/Makefile b/arch/arm64/kernel/pi/Makefile
> index c844a0546d7f..bc32a431fe35 100644
> --- a/arch/arm64/kernel/pi/Makefile
> +++ b/arch/arm64/kernel/pi/Makefile
> @@ -22,11 +22,16 @@ KCSAN_SANITIZE	:= n
>  UBSAN_SANITIZE	:= n
>  KCOV_INSTRUMENT	:= n
>  
> +hostprogs	:= relacheck
> +
> +quiet_cmd_piobjcopy = $(quiet_cmd_objcopy)
> +      cmd_piobjcopy = $(cmd_objcopy) && $(obj)/relacheck $(@) $(<)
> +
>  $(obj)/%.pi.o: OBJCOPYFLAGS := --prefix-symbols=__pi_ \
>  			       --remove-section=.note.gnu.property \
>  			       --prefix-alloc-sections=.init
> -$(obj)/%.pi.o: $(obj)/%.o FORCE
> -	$(call if_changed,objcopy)
> +$(obj)/%.pi.o: $(obj)/%.o $(obj)/relacheck FORCE
> +	$(call if_changed,piobjcopy)
>  
>  $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
>  	$(call if_changed_rule,cc_o_c)
> diff --git a/arch/arm64/kernel/pi/pi.h b/arch/arm64/kernel/pi/pi.h
> new file mode 100644
> index 000000000000..7c2d9bbf0ff9
> --- /dev/null
> +++ b/arch/arm64/kernel/pi/pi.h
> @@ -0,0 +1,18 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +// Copyright 2023 Google LLC
> +// Author: Ard Biesheuvel <ardb at google.com>
> +
> +#define __prel64_initconst	__section(".init.rodata.prel64")
> +
> +#define PREL64(type, name)	union { type *name; prel64_t name ## _prel; }
> +
> +#define prel64_pointer(__d)	(typeof(__d))prel64_to_pointer(&__d##_prel)
> +
> +typedef volatile signed long prel64_t;
> +
> +static inline void *prel64_to_pointer(const prel64_t *offset)
> +{
> +	if (!*offset)
> +		return NULL;
> +	return (void *)offset + *offset;
> +}

Is there any use for these definitions before the override code gets
moved to pi/ in patch 21? It is otherwise a bit odd to see two sets of
definitions between patches 15 and 20.

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.