linux-kernel - OPTIMIZE_FOR_SIZE makes PPC modules sick when trampolines are used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201109210021.p8L0LVCn019238@dell2.home>
Date:	Wed, 21 Sep 2011 00:21:30 +0000
From:	"Marty Leisner" <linux@...hester.rr.com>
To:	linux-kernel@...r.kernel.org
cc:	maleisner@...il.com
Subject: OPTIMIZE_FOR_SIZE makes PPC modules sick when trampolines are used

We're using Windriver linux on a PPC  board (2.6.34).

When turning on OPTIMIZE_FOR_SIZE, we saw "strangeness" with the IPv6
module depending on when it was loaded (it either "hung" or paniced the system
with a empty stack dump -- or worked fine!!).

Editing inet6_init so:
   a) a return (after entry) worked
   b) anything (for example printk) hung/paniced returning from the module

The trampoline code uses r11.

gcc OPTIMIZE_FOR_SIZE (4.x) does (when returning from inet6_init):
     418:       39 7f 00 10     addi    r11,r31,16
     41c:       48 00 00 00     b       41c <ac6_proc_init+0x44>
                        41c: R_PPC_REL24        _rest32gpr_31_x
on function exit (_rest32gpr_31_x bases a stackpointer off r11)

If _rest32gpr_31_x has to go across a trampoline, r11 is getting clobbered.
Hence bad things happen:

The trampoline code is (if the comments are right ;-):
(from arch/powerpc/kernel/module_32.c)
	/* Stolen from Paul Mackerras as well... */
        entry->jump[0] = 0x3d600000+((val+0x8000)>>16); /* lis r11,sym@ha */
        entry->jump[1] = 0x396b0000 + (val&0xffff);     /* addi r11,r11,sym@l*/
        entry->jump[2] = 0x7d6903a6;                    /* mtctr r11 */
        entry->jump[3] = 0x4e800420;                    /* bctr */



Has anyone seen this?   An old ABI (maybe current?  Its version 3 from 1995) lists r0, r11, r12
as volatile registers which may be used for function linkage.


marty
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/