From patchwork Fri Jul 22 02:24:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauricio Faria de Oliveira X-Patchwork-Id: 12925917 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33D4DC433EF for ; Fri, 22 Jul 2022 02:24:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234070AbiGVCY3 (ORCPT ); Thu, 21 Jul 2022 22:24:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36452 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234001AbiGVCY1 (ORCPT ); Thu, 21 Jul 2022 22:24:27 -0400 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BCB2097A14 for ; Thu, 21 Jul 2022 19:24:25 -0700 (PDT) Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 36AD23F12E for ; Fri, 22 Jul 2022 02:24:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1658456663; bh=gE2fBCxSAZxAZ1e5pYBDGgK4+lgINM9j58AumI+dplg=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type; b=YbKCXytefaaqCKNx2yTnpabC2q1+DCbtNlAI3jJL0rLGfN66MhCzrQmn7qBqGKGTP MbxldIoTD99N4T/Xm30NaBA3nhPugNpMqkJLMW/fIBuLp/c2n+0Bjb4LYU6/21Cbvf GIhEkROOX58pqr6REfRk0z4BYv4Ofg3vUDxaldALXaIRu5DgWEJO9WqMI7ogi41bNq 8raj9pO0AOBKZ7YGLbVnuuIv6HJYjgWtaPssf17PBysX7ti0wAsjES6s2zqKYFoPSo JxXydNfiNxbTZBPTnaDz3pisKejPKqqzyNlMKq/8t+wTJNYr39xvr5kORrNeJkiXQn 6ThLWJ3vGqYOA== Received: by mail-ot1-f72.google.com with SMTP id br7-20020a056830390700b00616cc77bc25so1642993otb.11 for ; Thu, 21 Jul 2022 19:24:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gE2fBCxSAZxAZ1e5pYBDGgK4+lgINM9j58AumI+dplg=; b=LHslWCNUxMfW+h38zxDGIKV9+0nAfMDRx3mNt05QIf4uaBo8RUfUPNZVdlTEI42C4G OVVi4CiTeYWMnkk1IkcjWfYRovrNPNHbumcWPu2/6qSbqRxmYEA/RrSV90fQ2/oq/wBV KYQcMigkim90aL09tw5wBDLpKmetE8X+F4YuLVS4eyBrCzcZMM88PE1LpbHbgRNe+cBq WGgULRtPnl6crlUo6vzF6Ut7UsSHs6ZIauwiLwU0NuoGLU1MqzJKarvk5pJwJUCHJmBQ Fiogms87QCc13vhca0tyvuExeWTzwuH5aFWKjNO2ZTPapL+GRwI6x8ZFNjrCDlVv5D/n ljpw== X-Gm-Message-State: AJIora9UPFg1+dH67oXQBMCDGvX2HoGaqRLEbO3/85WVdw/2pfW+ptqe 3I8HAM+fG6a8TTu2WDl1rZGGPOuYWmRcI4oBqpiG2Hpct3RcHkDVX1oezf6I8592EXHTrnUtB5q VJD/mNosAlh8Attt8JR8uBzkfNg9PuB+vbsD+g86FgS8= X-Received: by 2002:aca:5808:0:b0:33a:6ce9:6cef with SMTP id m8-20020aca5808000000b0033a6ce96cefmr485649oib.37.1658456661917; Thu, 21 Jul 2022 19:24:21 -0700 (PDT) X-Google-Smtp-Source: AGRyM1vUAvmwMyR83RiCEZqwtI9Za2Pb9qs6xEjYboEZH5/ptc+/s/m6H+qePEdaPU6dNi8LehfMlA== X-Received: by 2002:aca:5808:0:b0:33a:6ce9:6cef with SMTP id m8-20020aca5808000000b0033a6ce96cefmr485634oib.37.1658456661608; Thu, 21 Jul 2022 19:24:21 -0700 (PDT) Received: from mfo-t470.. ([2804:14c:4e1:8732:c479:1206:16fb:ce1f]) by smtp.gmail.com with ESMTPSA id k23-20020a056870959700b000f5f4ad194bsm1814528oao.25.2022.07.21.19.24.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 Jul 2022 19:24:21 -0700 (PDT) From: Mauricio Faria de Oliveira To: linux-kernel@vger.kernel.org, linux-modules@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-fsdevel@vger.kernel.org Cc: Masahiro Yamada , Michal Marek , Nick Desaulniers , Luis Chamberlain , Kees Cook , Iurii Zaikin Subject: [RFC PATCH 0/6] Introduce "sysctl:" module aliases Date: Thu, 21 Jul 2022 23:24:10 -0300 Message-Id: <20220722022416.137548-1-mfo@canonical.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Precedence: bulk List-ID: This series allows modules to have "sysctl:" module aliases for sysctl entries, registering sysctl tables with modpost/file2alias. (Similarly to "pci:" aliases for PCI ID tables in device drivers.) The issue behind it: if a sysctl value is in /etc/sysctl.{conf,d/*.conf} but does not exist in /proc/sys/ when the userspace tool that applies it runs, it does not get set. It would be nice if the tool could run 'modprobe sysctl:' and get that '/proc/sys/.../something' up (as an administrator configured it) and then set it, as intended. (A bit like PCI ID-based module loading.) ... The series is relatively simple, except for patch 4 (IMHO) due to ELF. - Patches 1-2 simplify ELF code in modpost.c (code moves, not in-depth). - Patches 3-4 implement the feature (patch 4 is more in-depth). - Patches 5-6 consume and expose it. I have tested it on x86_64 with next-20220721, and it looks correct ('modprobe sysctl:nf_conntrack_max' works; other aliases there; see below). I plan to test other archs by cross-building 'allmodconfig' and checking the .mod.c files and modpost output (eg, warnings) for no changes at all, and nf_conntrack.mod.c for expected sysctl aliases. [based on feedback.] (i.e., changes didn't break modpost, and ELF code works on other archs.) Happy to receive suggestions to improve test coverage and functionality. I didn't look much at auto-registration with modpost using the register functions for sysctl, but it seems it would need plumbing, if possible. Let's see review/feedback on the basics first. thanks, Mauricio ... Some context. Even though that issue might be expected and obvious, its consequences sometimes are not. An example is the nf_conntrack_max value, that in busy gateways/routers /cloud deployments can affect performance and functionality more subtly, or even fill the kernel log non-stop with 'table full, dropping packet', if a value greater than the default value is not used. The current solution (workaround, arguably) for this is to include such modules in /etc/modules (or in /etc/modules-load.d/*.conf with systemd), which loads them before an userspace tool (procps's sysctl or systemd's systemd-sysctl{,.service}) runs, so /proc/sys/... exists when it runs. ... That is simple, indeed, but comes w/ technical debt. (ugly stuff warning!) Now there are many _different_ pieces of code that use the _same_ module doing that (eg, deployment tools/scripts for openstack nova and neutron, firewalls, and maybe more). And sometimes when components are split or deployed to different nodes it turns out that in the next reboot we figure (through an issue) that some component did set /etc/sysctl.conf but not /etc/modules.conf, or relied in the ex-colocated component doing that. This has generated several one-off fixes at this point in some projects. (I have submitted one of those, actually, a while ago.) Also, some of those fixes (or original code) put 'nf_conntrack_ipv{4,6}' in /etc/modules, getting 'nf_conntrack' loaded via module dependencies (maybe it was the right module for them at the time, for some reason). So, that component (or a colocated component) got nf_conntrack.ko too. *BUT* after an upgrade from Ubuntu 18.04 (4.15-based kernel) to 20.04 (5.4-based kernel), the nf_conntrack_ipv{4,6}.ko modules do not exist anymore, and now nf_conntrack.ko is no longer loaded, and the sysctl nf_conntrack_max is no longer applied. (Someone had to figure it out.) And now maybe we'd need release/kernel-version checks in scripts that use the workaround of /etc/modules for /etc/sysctl.conf configuration. (Yes, it was ugly stuff.) ... Well, this last point seemed like "ok, that's enough; we can do better." I'm not sure this approach is "better" in all reasons, but hopefully it might help starting something that is.