Re: debugging problem with musl ld and qemu-ppc

[Rich Felker <dalias@libc.org>]

On Thu, Oct 16, 2014 at 08:09:01AM +0200, Felix Janda wrote:
> Hello list,
> 
> can you maybe help me debugging the following problem with qemu-ppc?
> It gives an invalid instruction error after doing:
> 
> tar -xf crossx86-powerpc-linux-musl-0.9.9.tar.xz
> # (I get something similar for other versions of musl or gcc)
> cat > a.s <<EOF
> b	_GLOBAL_OFFSET_TABLE_@local
> EOF
> cat > b.c <<EOF
> int main(void) { return 0; }
> EOF
> ../powerpc-linux-musl/bin/powerpc-linux-musl-gcc -o good b.c
> ../powerpc-linux-musl/bin/powerpc-linux-musl-gcc -o bad a.s b.c
> # set up symlinks to make 'qemu-ppc good' work
> qemu-ppc bad
> 
> After musl ld has done its work it jumps to libgcc's _init and
> very soon tries to execute some data.
> 
> When executing in some chroot the 'qemu-ppc -d in_asm' for
> good and bad is exactly the same up to two instructions in
> libgcc until it diverges (and bad crashes).
> 
> Do you have any ideas what could be the problem?

Using the cross compiler I had lying around, I get a warning while
linking "bad":

/opt/powerpc-linux-musl/bin/../lib/gcc/powerpc-linux-musl/4.7.2/../../../../powerpc-linux-musl/bin/ld: bss-plt forced due to /tmp/ccfPiE1t.o

I suspect this is happening for you too (possibly without a warning
being printed?) and that this is the cause of the problem: something
about your asm file is forcing the linker to use the old "bss-plt"
dynamic linking model, which musl does not support, rather than the
"secure-plt" model.

The "bss-plt" model requires the dynamic linker to generate direct
call instructions inline in a writable (mode rwx!) page rather than
having the PLT thunks load their actual function addresses from
pointers filled into the GOT by the dynamic linker, so it's a major
risk from a security standpoint, and also a lot more work to implement
in the dynamic linker. As such, when powerpc support was added we
opted to omit this model and push for use of the more secure model
that works like every other arch.

What I'm not clear about is the cause for why the linker is forcing
you back to the bss-plt model. It might be a matter of the strange
relocation type you put in a.s:

00000000 <.text>:
   0:   48 00 00 00     b       0x0
                           0: R_PPC_LOCAL24PC      _GLOBAL_OFFSET_TABLE_

Let's see if anyone else has ideas.

Rich