[PATCH v6 11/41] arm64: kernel: Manage absolute relocations in code built under pi/

[Ard Biesheuvel]

On Wed, 29 Nov 2023 at 13:27, Marc Zyngier <maz at kernel.org> wrote:
>
> On Wed, 29 Nov 2023 11:16:07 +0000,
> Ard Biesheuvel <ardb at google.com> wrote:
> >
> > From: Ard Biesheuvel <ardb at kernel.org>
> >
> > The mini C runtime runs before relocations are processed, and so it
> > cannot rely on statically initialized pointer variables.
> >
> > Add a check to ensure that such code does not get introduced by
> > accident, by going over the relocations in each object, identifying the
> > ones that operate on data sections that are part of the executable
> > image, and raising an error if any relocations of type R_AARCH64_ABS64
> > exist. Note that such relocations are permitted in other places (e.g.,
> > debug sections) and will never occur in compiler generated code sections
> > when using the small code model, so only check sections that have
> > SHF_ALLOC set and SHF_EXECINSTR cleared.
> >
> > To accommodate cases where statically initialized symbol references are
> > unavoidable, introduce a special case for ELF input data sections that
> > have ".rodata.prel64" in their names, and in these cases, instead of
> > rejecting any encountered ABS64 relocations, convert them into PREL64
> > relocations, which don't require any runtime fixups. Note that the code
> > in question must still be modified to deal with this, as it needs to
> > convert the 64-bit signed offsets into absolute addresses before use.
> >
> > Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
> > ---
> >  arch/arm64/kernel/pi/Makefile    |   9 +-
> >  arch/arm64/kernel/pi/pi.h        |  18 +++
> >  arch/arm64/kernel/pi/relacheck.c | 130 ++++++++++++++++++++
> >  3 files changed, 155 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/arm64/kernel/pi/Makefile b/arch/arm64/kernel/pi/Makefile
> > index c844a0546d7f..bc32a431fe35 100644
> > --- a/arch/arm64/kernel/pi/Makefile
> > +++ b/arch/arm64/kernel/pi/Makefile
> > @@ -22,11 +22,16 @@ KCSAN_SANITIZE    := n
> >  UBSAN_SANITIZE       := n
> >  KCOV_INSTRUMENT      := n
> >
> > +hostprogs    := relacheck
> > +
> > +quiet_cmd_piobjcopy = $(quiet_cmd_objcopy)
> > +      cmd_piobjcopy = $(cmd_objcopy) && $(obj)/relacheck $(@) $(<)
> > +
> >  $(obj)/%.pi.o: OBJCOPYFLAGS := --prefix-symbols=__pi_ \
> >                              --remove-section=.note.gnu.property \
> >                              --prefix-alloc-sections=.init
> > -$(obj)/%.pi.o: $(obj)/%.o FORCE
> > -     $(call if_changed,objcopy)
> > +$(obj)/%.pi.o: $(obj)/%.o $(obj)/relacheck FORCE
> > +     $(call if_changed,piobjcopy)
> >
> >  $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
> >       $(call if_changed_rule,cc_o_c)
> > diff --git a/arch/arm64/kernel/pi/pi.h b/arch/arm64/kernel/pi/pi.h
> > new file mode 100644
> > index 000000000000..7c2d9bbf0ff9
> > --- /dev/null
> > +++ b/arch/arm64/kernel/pi/pi.h
> > @@ -0,0 +1,18 @@
> > +// SPDX-License-Identifier: GPL-2.0-only
> > +// Copyright 2023 Google LLC
> > +// Author: Ard Biesheuvel <ardb at google.com>
> > +
> > +#define __prel64_initconst   __section(".init.rodata.prel64")
> > +
> > +#define PREL64(type, name)   union { type *name; prel64_t name ## _prel; }
> > +
> > +#define prel64_pointer(__d)  (typeof(__d))prel64_to_pointer(&__d##_prel)
> > +
> > +typedef volatile signed long prel64_t;
> > +
> > +static inline void *prel64_to_pointer(const prel64_t *offset)
> > +{
> > +     if (!*offset)
> > +             return NULL;
> > +     return (void *)offset + *offset;
> > +}
>
> Is there any use for these definitions before the override code gets
> moved to pi/ in patch 21? It is otherwise a bit odd to see two sets of
> definitions between patches 15 and 20.
>

No they are unused at this point, but they are tied closely to the
host tool that this patch introduces.