Message-ID: <X71r+kHD87CV9tcL@kroah.com>
Date:   Tue, 24 Nov 2020 21:24:26 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     William Mcvicker <willmcvicker@...gle.com>
Cc:     Jessica Yu <jeyu@...nel.org>,
        Christoph Hellwig <hch@...radead.org>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Michal Marek <michal.lkml@...kovi.net>,
        linux-kernel@...r.kernel.org, linux-kbuild@...r.kernel.org,
        kernel-team@...roid.com, Saravana Kannan <saravanak@...gle.com>
Subject: Re: [PATCH v1 0/2] Add support to capture external module's SCM
 version

On Tue, Nov 24, 2020 at 10:31:39AM -0800, William Mcvicker wrote:
> On Tue, Nov 24, 2020 at 07:12:40PM +0100, Greg Kroah-Hartman wrote:
> > On Tue, Nov 24, 2020 at 10:05:16AM -0800, William Mcvicker wrote:
> > > On Tue, Nov 24, 2020 at 10:31:18AM +0100, Jessica Yu wrote:
> > > > +++ William Mcvicker [23/11/20 14:13 -0800]:
> > > > > On Mon, Nov 23, 2020 at 09:02:57AM +0000, Christoph Hellwig wrote:
> > > > > > On Sat, Nov 21, 2020 at 01:16:49AM +0000, Will McVicker wrote:
> > > > > > > These two patches add module support to capture an external module's SCM
> > > > > > > version as a MODULE_INFO() attribute. This allows users to identity the SCM
> > > > > > > version of a given kernel module by using the modinfo tool or on the device
> > > > > > > via sysfs:
> > > > > > 
> > > > > > As this obviously is of no use for in-tree modules it falls under the we
> > > > > > don't add code to support things that are not in tree rule and has no
> > > > > > business in the kernel.
> > > > > 
> > > > > Hi Christoph,
> > > > > 
> > > > > Ah sorry, I didn't intend this to come across as only for external modules.
> > > > > That just seemed like the easiest way to explain how the scmversion attribute
> > > > > can be different from the vermagic. We mainly need this for in-tree kernel
> > > > > modules since that's where most our drivers are. Let me re-phrase this with
> > > > > that in mind. Basically, I like to look at this as an improved version of the
> > > > > existing srcversion module attribute since it allows you to easily identify the
> > > > > module version with a quick SCM version string check instead of doing a full
> > > > > checksum on the module source.
> > > > > 
> > > > > For example, we have a setup to test kernel changes on the hikey and db845c
> > > > > devices without updating the kernel modules. Without this scmversion module
> > > > > attribute, you can't identify the original module version using `uname
> > > > > -r`. And for kernel modules in the initramfs, you can't even use modinfo to get
> > > > > the module vermagic.  With this patch, you are able to get the SCM version for
> > > > > *all* kernel modules (on disk and in the initramfs) via the sysfs node:
> > > > > /sys/module/<mod>/scmversion. This also works the other way around when
> > > > > developers update their kernel modules to fix some bug (like a security
> > > > > vulnerability) but don't need to update the full kernel.
> > > > 
> > > > Hi Will,
> > > > 
> > > > If this were also intended for in-tree kernel modules, then why do
> > > > intree modules only get the UTS_RELEASE string in their scmversion
> > > > field, which basically already exists in the vermagic? Or do you plan
> > > > to change that?
> > > > 
> > > > Jessica
> > > 
> > > Hi Jessica,
> > > 
> > > Thanks for asking! The reason in-tree kernel modules get the UTS_RELEASE string
> > > is for a few reasons:
> > > 
> > > (1) It contains the SCM version (since UTS_RELEASE has that).
> > > (2) It allows you to get the SCM version via the sysfs node (useful for modules
> > > in the initramfs).
> > > (3) It helps identify that that particular kernel module was in-tree when
> > > originally compiled.
> > > (4) Using UTS_RELEASE also allows us to respect the privacy of kernels with
> > > "# CONFIG_LOCALVERSION_AUTO is not set" by not including the SCM version in the
> > > module scmversion attribute.
> > > 
> > > Now, if we don't care about knowing if a module was in-tree or not (since
> > > we only care about in-tree modules here anyway), I can update the patch to have
> > > a consistent format regardless of in-tree or external. Personally, I like the
> > > UTS_RELEASE version better because it gives me more information from the sysfs
> > > node which is useful when debugging issues related to modules loaded in
> > > initramfs.
> > 
> > We already know if a module was built in-or-out of tree, the "O" taint
> > flag is set, so that information is already in the module today, right?
> > Can't that be used somehow here?
> > 
> > thanks,
> > 
> > greg k-h
> Hi Greg,
> 
> Let me prefix this with this, I do see the benefits of having a consistent
> scmversion format for intree and out-of-tree modules. So I'm happy to fix that
> in the next patchset.
> 
> Now, I could be wrong, but I believe the taint flag is only printed when the
> module is loaded:
> 
>   XXX: loading out-of-tree module taints kernel.
> 
> or when there's a kernel WARNING or kernel crash. But that assumes you have the
> full logs when the kernel booted or you have a full crash stack in the kernel.
> 
> Modinfo does have an attribute that indicates if the module is intree or
> not:
> 
> $ modinfo -F intree out_dir/./net/netfilter/nf_log_common.ko
> Y
> 
> But that is not queriable via sysfs.

Look at the file in /sys/modules/MODULENAME/taint

That should show you this value.

> Ideally, we'd like to be able to get all
> this information via sysfs so that it can be captured in our bug reports.

I think you already have it :)

This is independent of your "source code id value" idea though...

thanks,

greg k-h

Powered by blists - more mailing lists