* [PATCH 0/9] Enable orphan section warning
@ 2020-02-28 0:23 Kees Cook
0 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-02-28 0:23 UTC (permalink / raw)
To: signatures
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
554dad51-95bb2002-ac050765:
i: 554dad51dd4f3e0f168a6407448cdd0556d189342b8216ddaade3e63598066f9
m: 95bb20022a7cc585d296eefe1959b057eb9119819d8c764f7c092d7254c261f6
p: ac05076571f7a36f6fed1f5676befb1a3d5eeeec544506490e85c2742f322040
3572f257-1bd5b566-45934ff1:
i: 3572f257a45a490c64a0be749b6389c730e648764717cca94e928ddbdbfa89d8
m: 1bd5b566b86ce544737df8c00dedd8f5431bbca406a6da8d24b6929d0b49d0a0
p: 45934ff1c2255ba8367a84c56354ebfc4d256505daa5853d4da48623e7b89657
4e3eb7f3-3a4cd04f-f918e17c:
i: 4e3eb7f3523ee206ae1e4aee59600ddecd8ee219247f3da9444e86b8a36d2686
m: 3a4cd04fe15cee5510fdb94cc5ae15820799bf46acb88f2e164f147c7a75fbf8
p: f918e17c4d00fe04a69670a8d337f2a80796587b0c834656e15a241a4ac51f6f
9edf8ba6-f62ba3f2-6ec436ee:
i: 9edf8ba678f47da7b87d6f039076c1103a3019b1772d498def81155a1b91b29f
m: f62ba3f27fce45efff2a0f2f5c82d90e54051f6d8e41e6c0a78e07257bfb8839
p: 6ec436ee6edfcb16c79be0d7b2ee3d94f0b73367f63f80b4c945a612549505ba
1970967b-8354f3b8-5c80751b:
i: 1970967b6f657de55a38990ddea121c56f58592948305897e1efc62bb911d6db
m: 8354f3b839d92a6d1b7d2c0d3783b07a1084063a096d473839bc6c52423eb76e
p: 5c80751b9a7b338a324393fa856f35c7e7bd19fce717e0fd238e3d661a6182de
e0ad4afc-c8659b7e-b6a1e3cb:
i: e0ad4afc40268544a22c6ca908f642da104aad1faa454b1a24c2fbdd03e00516
m: c8659b7e96797009829872d941aa0be91ec5fdf37f0ddd92f48405e106a77b64
p: b6a1e3cbf92b7cf88cf302ab93b7a31c988d5bb396676db7180b07a3c6228adc
8fd6eda2-b09be5aa-8a8759f0:
i: 8fd6eda27826c7324ffd37893733154696fcfccc6737a5f5b01535d84dc54764
m: b09be5aa76a06079850910e10eddc04873a31b18baf9a24ededd8acd1a2d67b2
p: 8a8759f0e1f1c42dafe39e5a915c9f11588d1f9d184a6b529139b1024832a6a8
afb3a7f2-2f39840f-25cdd604:
i: afb3a7f29fa38e855e6dcb8d7b785e44e247f1cc2323a3018d794ddf5fb69204
m: 2f39840f7a5f302b92f54289d19340fb9994b37af1a900a8d25c995c8f626d11
p: 25cdd604fa1e51b81bcfb9a4bc22f820499c84c4028ba04888817aa3a451f98f
847da857-0db0e4ce-07d77e42:
i: 847da8579f8c9a2feae5784b43625d30411a40152b935437380a78268c9d275d
m: 0db0e4ce95ed161b58158456e18235544066b9431c12d3a9a15c0d88a275cee1
p: 07d77e4215159354cb96a55435643a0a3e7579e45c2fba4033536639f72887af
-----BEGIN PGP SIGNATURE-----
Comment: Kees Cook <kees@outflux.net>
Comment: att-fmt-ver: 0.1
Comment: att-hash: sha256
iQIzBAEBCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAl5YXX8ACgkQiXL039xt
wCY9FA/+LSRGEd/bx0+Dy0npE44Od6ja8LLjgetKzdhBcmXSmAtD5XZyEqgkYPCH
Pgq+W0u/yJ86wB9esig2LNINcSfDkFmiBNAY3oHJcs/07yDWJvmkdeLiuiakHK5A
kbjghtNwgPG7wpjllwAhSZaewWkqHRYa9XExXiVFnpuvq0E/4YaPE8+jocFYQOwd
VrgMcPazfVhFf4i6i0AzcQqClQIWTiv/v5CvjL0LqZKyTsPXMujoXcNBr0OHKJNV
+LEOQB0jehtXjW0WnP+pwOgqtL7evnz9FyyT0ROR6GNb8B2D6gaSWA4uW4dvXFoh
xFx4LIvn5GMVn2TD+MGMMLgmvhfN9J5sr6/wPjrkYtbs9gDuk6mn6FO2/UI1Q0q2
glVX0f6zA+v2/MSYRiDN9v5t8LcEy5LYueRA4ks+LTjZCmaY7iXnGPzUaKLtReh1
BA4iuB/52TnPvyxzDamaO+S0RHOLVg1oEy0oPNDMrgHARjMmvGFXbYjy7CGc31bb
r75w9bM4Q+qh5ww44wpUgBSbgqy5fVUgSKWDWyivtQGnz1tkJKCE6pE4PKHm2io/
XuQv/571dVEABQMpsDDMrUfxZ3R2GXcdQQcJ5/4sjTnu4TDo5eaRLpwYi+NhjkfB
Rt2UHzNDZVfGX/ofEZLw1Q9II5PRD2jUJjc2WueINV9KlXQk8tU=
=gwAQ
-----END PGP SIGNATURE-----
--
Kees Cook
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
2020-04-02 17:26 ` Kees Cook
@ 2020-04-05 11:15 ` Sedat Dilek
-1 siblings, 0 replies; 13+ messages in thread
From: Sedat Dilek @ 2020-04-05 11:15 UTC (permalink / raw)
To: Kees Cook
Cc: Borislav Petkov, H.J. Lu, Russell King, Catalin Marinas,
Will Deacon, Mark Rutland, Peter Collingbourne, James Morse,
Arnd Bergmann, Masahiro Yamada, x86, linux-arm-kernel,
linux-arch, linux-kbuild, Clang-Built-Linux ML, linux-kernel
On Thu, Apr 2, 2020 at 7:26 PM Kees Cook <keescook@chromium.org> wrote:
>
> On Thu, Apr 02, 2020 at 06:20:57PM +0200, Sedat Dilek wrote:
> > On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
> > >
> > > Hi!
> > >
> > > A recent bug was solved for builds linked with ld.lld, and tracking
> > > it down took way longer than it needed to (a year). Ultimately, it
> > > boiled down to differences between ld.bfd and ld.lld's handling of
> > > orphan sections. Similarly, the recent FGKASLR series brough up orphan
> > > section handling too[2]. In both cases, it would have been nice if the
> > > linker was running with --orphan-handling=warn so that surprise sections
> > > wouldn't silently get mapped into the kernel image at locations up to
> > > the whim of the linker's orphan handling logic. Instead, all desired
> > > sections should be explicitly identified in the linker script (to be
> > > either kept or discarded) with any orphans throwing a warning. The
> > > powerpc architecture actually already does this, so this series seeks
> > > to extend this coverage to x86, arm64, and arm.
> > >
> > > This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> > > landed), and has a minor conflict[4] with the ARM tree (related to
> > > the earlier mentioned bug). As it uses refactorings in the asm-generic
> > > linker script, and makes changes to kbuild, I think the cleanest place
> > > for this series to land would also be through -tip. Once again (like
> > > my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> > > this can go all together with the least disruption. Splitting it up by
> > > architecture seems needlessly difficult.
> > >
> > > Thanks!
> > >
> >
> > Hi Kees,
> >
> > what is the status of this patchset?
> > Looks like it is not in tip or linux-next Git.
>
> Based on the feedback, I have 3 TODO items:
>
> - track down and eliminate (or explain) the source of the .got.plt on arm64
> - enable orphan warnings for _all_ architectures
> - refactor final link logic to perform the orphan warning in a clean way
>
> I'm working through these (and other work) still. I'm hoping to have
> another version up some time next week.
>
Please CC when possible with a pointer to a git-link.
Thanks.
- sed@ -
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
@ 2020-04-05 11:15 ` Sedat Dilek
0 siblings, 0 replies; 13+ messages in thread
From: Sedat Dilek @ 2020-04-05 11:15 UTC (permalink / raw)
To: Kees Cook
Cc: Mark Rutland, H.J. Lu, Arnd Bergmann, linux-kbuild,
Peter Collingbourne, Catalin Marinas, Masahiro Yamada, x86,
Russell King, linux-kernel, Clang-Built-Linux ML, James Morse,
linux-arch, Borislav Petkov, Will Deacon, linux-arm-kernel
On Thu, Apr 2, 2020 at 7:26 PM Kees Cook <keescook@chromium.org> wrote:
>
> On Thu, Apr 02, 2020 at 06:20:57PM +0200, Sedat Dilek wrote:
> > On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
> > >
> > > Hi!
> > >
> > > A recent bug was solved for builds linked with ld.lld, and tracking
> > > it down took way longer than it needed to (a year). Ultimately, it
> > > boiled down to differences between ld.bfd and ld.lld's handling of
> > > orphan sections. Similarly, the recent FGKASLR series brough up orphan
> > > section handling too[2]. In both cases, it would have been nice if the
> > > linker was running with --orphan-handling=warn so that surprise sections
> > > wouldn't silently get mapped into the kernel image at locations up to
> > > the whim of the linker's orphan handling logic. Instead, all desired
> > > sections should be explicitly identified in the linker script (to be
> > > either kept or discarded) with any orphans throwing a warning. The
> > > powerpc architecture actually already does this, so this series seeks
> > > to extend this coverage to x86, arm64, and arm.
> > >
> > > This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> > > landed), and has a minor conflict[4] with the ARM tree (related to
> > > the earlier mentioned bug). As it uses refactorings in the asm-generic
> > > linker script, and makes changes to kbuild, I think the cleanest place
> > > for this series to land would also be through -tip. Once again (like
> > > my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> > > this can go all together with the least disruption. Splitting it up by
> > > architecture seems needlessly difficult.
> > >
> > > Thanks!
> > >
> >
> > Hi Kees,
> >
> > what is the status of this patchset?
> > Looks like it is not in tip or linux-next Git.
>
> Based on the feedback, I have 3 TODO items:
>
> - track down and eliminate (or explain) the source of the .got.plt on arm64
> - enable orphan warnings for _all_ architectures
> - refactor final link logic to perform the orphan warning in a clean way
>
> I'm working through these (and other work) still. I'm hoping to have
> another version up some time next week.
>
Please CC when possible with a pointer to a git-link.
Thanks.
- sed@ -
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
2020-04-02 16:20 ` Sedat Dilek
@ 2020-04-02 17:26 ` Kees Cook
-1 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-04-02 17:26 UTC (permalink / raw)
To: Sedat Dilek
Cc: Borislav Petkov, H.J. Lu, Russell King, Catalin Marinas,
Will Deacon, Mark Rutland, Peter Collingbourne, James Morse,
Arnd Bergmann, Masahiro Yamada, x86, linux-arm-kernel,
linux-arch, linux-kbuild, Clang-Built-Linux ML, linux-kernel
On Thu, Apr 02, 2020 at 06:20:57PM +0200, Sedat Dilek wrote:
> On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
> >
> > Hi!
> >
> > A recent bug was solved for builds linked with ld.lld, and tracking
> > it down took way longer than it needed to (a year). Ultimately, it
> > boiled down to differences between ld.bfd and ld.lld's handling of
> > orphan sections. Similarly, the recent FGKASLR series brough up orphan
> > section handling too[2]. In both cases, it would have been nice if the
> > linker was running with --orphan-handling=warn so that surprise sections
> > wouldn't silently get mapped into the kernel image at locations up to
> > the whim of the linker's orphan handling logic. Instead, all desired
> > sections should be explicitly identified in the linker script (to be
> > either kept or discarded) with any orphans throwing a warning. The
> > powerpc architecture actually already does this, so this series seeks
> > to extend this coverage to x86, arm64, and arm.
> >
> > This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> > landed), and has a minor conflict[4] with the ARM tree (related to
> > the earlier mentioned bug). As it uses refactorings in the asm-generic
> > linker script, and makes changes to kbuild, I think the cleanest place
> > for this series to land would also be through -tip. Once again (like
> > my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> > this can go all together with the least disruption. Splitting it up by
> > architecture seems needlessly difficult.
> >
> > Thanks!
> >
>
> Hi Kees,
>
> what is the status of this patchset?
> Looks like it is not in tip or linux-next Git.
Based on the feedback, I have 3 TODO items:
- track down and eliminate (or explain) the source of the .got.plt on arm64
- enable orphan warnings for _all_ architectures
- refactor final link logic to perform the orphan warning in a clean way
I'm working through these (and other work) still. I'm hoping to have
another version up some time next week.
--
Kees Cook
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
@ 2020-04-02 17:26 ` Kees Cook
0 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-04-02 17:26 UTC (permalink / raw)
To: Sedat Dilek
Cc: Mark Rutland, H.J. Lu, Arnd Bergmann, linux-kbuild,
Peter Collingbourne, Catalin Marinas, Masahiro Yamada, x86,
Russell King, linux-kernel, Clang-Built-Linux ML, James Morse,
linux-arch, Borislav Petkov, Will Deacon, linux-arm-kernel
On Thu, Apr 02, 2020 at 06:20:57PM +0200, Sedat Dilek wrote:
> On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
> >
> > Hi!
> >
> > A recent bug was solved for builds linked with ld.lld, and tracking
> > it down took way longer than it needed to (a year). Ultimately, it
> > boiled down to differences between ld.bfd and ld.lld's handling of
> > orphan sections. Similarly, the recent FGKASLR series brough up orphan
> > section handling too[2]. In both cases, it would have been nice if the
> > linker was running with --orphan-handling=warn so that surprise sections
> > wouldn't silently get mapped into the kernel image at locations up to
> > the whim of the linker's orphan handling logic. Instead, all desired
> > sections should be explicitly identified in the linker script (to be
> > either kept or discarded) with any orphans throwing a warning. The
> > powerpc architecture actually already does this, so this series seeks
> > to extend this coverage to x86, arm64, and arm.
> >
> > This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> > landed), and has a minor conflict[4] with the ARM tree (related to
> > the earlier mentioned bug). As it uses refactorings in the asm-generic
> > linker script, and makes changes to kbuild, I think the cleanest place
> > for this series to land would also be through -tip. Once again (like
> > my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> > this can go all together with the least disruption. Splitting it up by
> > architecture seems needlessly difficult.
> >
> > Thanks!
> >
>
> Hi Kees,
>
> what is the status of this patchset?
> Looks like it is not in tip or linux-next Git.
Based on the feedback, I have 3 TODO items:
- track down and eliminate (or explain) the source of the .got.plt on arm64
- enable orphan warnings for _all_ architectures
- refactor final link logic to perform the orphan warning in a clean way
I'm working through these (and other work) still. I'm hoping to have
another version up some time next week.
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
2020-02-28 0:22 ` Kees Cook
@ 2020-04-02 16:20 ` Sedat Dilek
-1 siblings, 0 replies; 13+ messages in thread
From: Sedat Dilek @ 2020-04-02 16:20 UTC (permalink / raw)
To: Kees Cook
Cc: Borislav Petkov, H.J. Lu, Russell King, Catalin Marinas,
Will Deacon, Mark Rutland, Peter Collingbourne, James Morse,
Arnd Bergmann, Masahiro Yamada, x86, linux-arm-kernel,
linux-arch, linux-kbuild, Clang-Built-Linux ML, linux-kernel
On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
>
> Hi!
>
> A recent bug was solved for builds linked with ld.lld, and tracking
> it down took way longer than it needed to (a year). Ultimately, it
> boiled down to differences between ld.bfd and ld.lld's handling of
> orphan sections. Similarly, the recent FGKASLR series brough up orphan
> section handling too[2]. In both cases, it would have been nice if the
> linker was running with --orphan-handling=warn so that surprise sections
> wouldn't silently get mapped into the kernel image at locations up to
> the whim of the linker's orphan handling logic. Instead, all desired
> sections should be explicitly identified in the linker script (to be
> either kept or discarded) with any orphans throwing a warning. The
> powerpc architecture actually already does this, so this series seeks
> to extend this coverage to x86, arm64, and arm.
>
> This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> landed), and has a minor conflict[4] with the ARM tree (related to
> the earlier mentioned bug). As it uses refactorings in the asm-generic
> linker script, and makes changes to kbuild, I think the cleanest place
> for this series to land would also be through -tip. Once again (like
> my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> this can go all together with the least disruption. Splitting it up by
> architecture seems needlessly difficult.
>
> Thanks!
>
Hi Kees,
what is the status of this patchset?
Looks like it is not in tip or linux-next Git.
Thanks.
Regards,
- Sedat -
> -Kees
>
> [1] https://github.com/ClangBuiltLinux/linux/issues/282
> [2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/
> [3] https://lore.kernel.org/lkml/158264960194.28353.10560165361470246192.tip-bot2@tip-bot2/
> [4] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=8959/1
>
> H.J. Lu (1):
> Add RUNTIME_DISCARD_EXIT to generic DISCARDS
>
> Kees Cook (8):
> scripts/link-vmlinux.sh: Delay orphan handling warnings until final
> link
> vmlinux.lds.h: Add .gnu.version* to DISCARDS
> x86/build: Warn on orphan section placement
> x86/boot: Warn on orphan section placement
> arm64/build: Use common DISCARDS in linker script
> arm64/build: Warn on orphan section placement
> arm/build: Warn on orphan section placement
> arm/boot: Warn on orphan section placement
>
> arch/arm/Makefile | 4 ++++
> arch/arm/boot/compressed/Makefile | 2 ++
> arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
> .../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
> arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
> arch/arm/kernel/vmlinux.lds.S | 5 ++---
> arch/arm64/Makefile | 4 ++++
> arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
> arch/x86/Makefile | 4 ++++
> arch/x86/boot/compressed/Makefile | 3 ++-
> arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
> arch/x86/kernel/vmlinux.lds.S | 7 ++++++
> include/asm-generic/vmlinux.lds.h | 11 ++++++++--
> scripts/link-vmlinux.sh | 6 +++++
> 14 files changed, 85 insertions(+), 31 deletions(-)
> rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
>
> --
> 2.20.1
>
> --
> You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20200228002244.15240-1-keescook%40chromium.org.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
@ 2020-04-02 16:20 ` Sedat Dilek
0 siblings, 0 replies; 13+ messages in thread
From: Sedat Dilek @ 2020-04-02 16:20 UTC (permalink / raw)
To: Kees Cook
Cc: Mark Rutland, H.J. Lu, Arnd Bergmann, linux-kbuild,
Peter Collingbourne, Catalin Marinas, Masahiro Yamada, x86,
Russell King, linux-kernel, Clang-Built-Linux ML, James Morse,
linux-arch, Borislav Petkov, Will Deacon, linux-arm-kernel
On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
>
> Hi!
>
> A recent bug was solved for builds linked with ld.lld, and tracking
> it down took way longer than it needed to (a year). Ultimately, it
> boiled down to differences between ld.bfd and ld.lld's handling of
> orphan sections. Similarly, the recent FGKASLR series brough up orphan
> section handling too[2]. In both cases, it would have been nice if the
> linker was running with --orphan-handling=warn so that surprise sections
> wouldn't silently get mapped into the kernel image at locations up to
> the whim of the linker's orphan handling logic. Instead, all desired
> sections should be explicitly identified in the linker script (to be
> either kept or discarded) with any orphans throwing a warning. The
> powerpc architecture actually already does this, so this series seeks
> to extend this coverage to x86, arm64, and arm.
>
> This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> landed), and has a minor conflict[4] with the ARM tree (related to
> the earlier mentioned bug). As it uses refactorings in the asm-generic
> linker script, and makes changes to kbuild, I think the cleanest place
> for this series to land would also be through -tip. Once again (like
> my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> this can go all together with the least disruption. Splitting it up by
> architecture seems needlessly difficult.
>
> Thanks!
>
Hi Kees,
what is the status of this patchset?
Looks like it is not in tip or linux-next Git.
Thanks.
Regards,
- Sedat -
> -Kees
>
> [1] https://github.com/ClangBuiltLinux/linux/issues/282
> [2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/
> [3] https://lore.kernel.org/lkml/158264960194.28353.10560165361470246192.tip-bot2@tip-bot2/
> [4] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=8959/1
>
> H.J. Lu (1):
> Add RUNTIME_DISCARD_EXIT to generic DISCARDS
>
> Kees Cook (8):
> scripts/link-vmlinux.sh: Delay orphan handling warnings until final
> link
> vmlinux.lds.h: Add .gnu.version* to DISCARDS
> x86/build: Warn on orphan section placement
> x86/boot: Warn on orphan section placement
> arm64/build: Use common DISCARDS in linker script
> arm64/build: Warn on orphan section placement
> arm/build: Warn on orphan section placement
> arm/boot: Warn on orphan section placement
>
> arch/arm/Makefile | 4 ++++
> arch/arm/boot/compressed/Makefile | 2 ++
> arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
> .../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
> arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
> arch/arm/kernel/vmlinux.lds.S | 5 ++---
> arch/arm64/Makefile | 4 ++++
> arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
> arch/x86/Makefile | 4 ++++
> arch/x86/boot/compressed/Makefile | 3 ++-
> arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
> arch/x86/kernel/vmlinux.lds.S | 7 ++++++
> include/asm-generic/vmlinux.lds.h | 11 ++++++++--
> scripts/link-vmlinux.sh | 6 +++++
> 14 files changed, 85 insertions(+), 31 deletions(-)
> rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
>
> --
> 2.20.1
>
> --
> You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20200228002244.15240-1-keescook%40chromium.org.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
2020-02-28 6:51 ` Sedat Dilek
@ 2020-03-03 4:32 ` Kees Cook
-1 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-03-03 4:32 UTC (permalink / raw)
To: Sedat Dilek
Cc: Borislav Petkov, H.J. Lu, Russell King, Catalin Marinas,
Will Deacon, Mark Rutland, Peter Collingbourne, James Morse,
Arnd Bergmann, Masahiro Yamada, x86, linux-arm-kernel,
linux-arch, linux-kbuild, Clang-Built-Linux ML, linux-kernel
On Fri, Feb 28, 2020 at 07:51:21AM +0100, Sedat Dilek wrote:
> On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
> > This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> > landed), and has a minor conflict[4] with the ARM tree (related to
> > the earlier mentioned bug). As it uses refactorings in the asm-generic
> > linker script, and makes changes to kbuild, I think the cleanest place
> > for this series to land would also be through -tip. Once again (like
> > my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> > this can go all together with the least disruption. Splitting it up by
> > architecture seems needlessly difficult.
>
> Hi Kees,
>
> is this an updated version of what you have in your
> kees/linux.git#linker/orphans/x86-arm Git branch?
Hi; yes indeed.
> Especially, I saw a difference in [2] and "[PATCH 4/9] x86/boot: Warn
> on orphan section placement"
>
> [ arch/x86/boot/compressed/Makefile ]
>
> +KBUILD_LDFLAGS += --no-ld-generated-unwind-info
>
> Can you comment on why this KBUILD_LDFLAGS was added/needed?
It looks like the linker decided to add .eh_frame sections even when all
the .o files lacked it. Adding this flag solved it (which I prefer over
adding it to DISCARD).
> I like when people offer their work in a Git branch.
> Do you plan to do that?
Since it was based on a -tip sub-branch I didn't push a
copy, but since you asked here it is:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=orphans/tip/x86/boot
And this email can serve as a "ping" to the arch maintainers too...
does this all look okay to you? I think it'd be a nice improvement. :)
Thanks!
-Kees
> Thanks.
>
> Regards,
> - Sedat -
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/x86-arm
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=linker/orphans/x86-arm&id=e43aa77956c40b9b6db0b37b3780423aa2e661ad
>
>
>
> > H.J. Lu (1):
> > Add RUNTIME_DISCARD_EXIT to generic DISCARDS
> >
> > Kees Cook (8):
> > scripts/link-vmlinux.sh: Delay orphan handling warnings until final
> > link
> > vmlinux.lds.h: Add .gnu.version* to DISCARDS
> > x86/build: Warn on orphan section placement
> > x86/boot: Warn on orphan section placement
> > arm64/build: Use common DISCARDS in linker script
> > arm64/build: Warn on orphan section placement
> > arm/build: Warn on orphan section placement
> > arm/boot: Warn on orphan section placement
> >
> > arch/arm/Makefile | 4 ++++
> > arch/arm/boot/compressed/Makefile | 2 ++
> > arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
> > .../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
> > arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
> > arch/arm/kernel/vmlinux.lds.S | 5 ++---
> > arch/arm64/Makefile | 4 ++++
> > arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
> > arch/x86/Makefile | 4 ++++
> > arch/x86/boot/compressed/Makefile | 3 ++-
> > arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
> > arch/x86/kernel/vmlinux.lds.S | 7 ++++++
> > include/asm-generic/vmlinux.lds.h | 11 ++++++++--
> > scripts/link-vmlinux.sh | 6 +++++
> > 14 files changed, 85 insertions(+), 31 deletions(-)
> > rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
--
Kees Cook
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
@ 2020-03-03 4:32 ` Kees Cook
0 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-03-03 4:32 UTC (permalink / raw)
To: Sedat Dilek
Cc: Mark Rutland, H.J. Lu, Arnd Bergmann, linux-kbuild,
Peter Collingbourne, Catalin Marinas, Masahiro Yamada, x86,
Russell King, linux-kernel, Clang-Built-Linux ML, James Morse,
linux-arch, Borislav Petkov, Will Deacon, linux-arm-kernel
On Fri, Feb 28, 2020 at 07:51:21AM +0100, Sedat Dilek wrote:
> On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
> > This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> > landed), and has a minor conflict[4] with the ARM tree (related to
> > the earlier mentioned bug). As it uses refactorings in the asm-generic
> > linker script, and makes changes to kbuild, I think the cleanest place
> > for this series to land would also be through -tip. Once again (like
> > my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> > this can go all together with the least disruption. Splitting it up by
> > architecture seems needlessly difficult.
>
> Hi Kees,
>
> is this an updated version of what you have in your
> kees/linux.git#linker/orphans/x86-arm Git branch?
Hi; yes indeed.
> Especially, I saw a difference in [2] and "[PATCH 4/9] x86/boot: Warn
> on orphan section placement"
>
> [ arch/x86/boot/compressed/Makefile ]
>
> +KBUILD_LDFLAGS += --no-ld-generated-unwind-info
>
> Can you comment on why this KBUILD_LDFLAGS was added/needed?
It looks like the linker decided to add .eh_frame sections even when all
the .o files lacked it. Adding this flag solved it (which I prefer over
adding it to DISCARD).
> I like when people offer their work in a Git branch.
> Do you plan to do that?
Since it was based on a -tip sub-branch I didn't push a
copy, but since you asked here it is:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=orphans/tip/x86/boot
And this email can serve as a "ping" to the arch maintainers too...
does this all look okay to you? I think it'd be a nice improvement. :)
Thanks!
-Kees
> Thanks.
>
> Regards,
> - Sedat -
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/x86-arm
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=linker/orphans/x86-arm&id=e43aa77956c40b9b6db0b37b3780423aa2e661ad
>
>
>
> > H.J. Lu (1):
> > Add RUNTIME_DISCARD_EXIT to generic DISCARDS
> >
> > Kees Cook (8):
> > scripts/link-vmlinux.sh: Delay orphan handling warnings until final
> > link
> > vmlinux.lds.h: Add .gnu.version* to DISCARDS
> > x86/build: Warn on orphan section placement
> > x86/boot: Warn on orphan section placement
> > arm64/build: Use common DISCARDS in linker script
> > arm64/build: Warn on orphan section placement
> > arm/build: Warn on orphan section placement
> > arm/boot: Warn on orphan section placement
> >
> > arch/arm/Makefile | 4 ++++
> > arch/arm/boot/compressed/Makefile | 2 ++
> > arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
> > .../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
> > arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
> > arch/arm/kernel/vmlinux.lds.S | 5 ++---
> > arch/arm64/Makefile | 4 ++++
> > arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
> > arch/x86/Makefile | 4 ++++
> > arch/x86/boot/compressed/Makefile | 3 ++-
> > arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
> > arch/x86/kernel/vmlinux.lds.S | 7 ++++++
> > include/asm-generic/vmlinux.lds.h | 11 ++++++++--
> > scripts/link-vmlinux.sh | 6 +++++
> > 14 files changed, 85 insertions(+), 31 deletions(-)
> > rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
2020-02-28 0:22 ` Kees Cook
@ 2020-02-28 6:51 ` Sedat Dilek
-1 siblings, 0 replies; 13+ messages in thread
From: Sedat Dilek @ 2020-02-28 6:51 UTC (permalink / raw)
To: Kees Cook
Cc: Borislav Petkov, H.J. Lu, Russell King, Catalin Marinas,
Will Deacon, Mark Rutland, Peter Collingbourne, James Morse,
Arnd Bergmann, Masahiro Yamada, x86, linux-arm-kernel,
linux-arch, linux-kbuild, Clang-Built-Linux ML, linux-kernel
On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
>
> Hi!
>
> A recent bug was solved for builds linked with ld.lld, and tracking
> it down took way longer than it needed to (a year). Ultimately, it
> boiled down to differences between ld.bfd and ld.lld's handling of
> orphan sections. Similarly, the recent FGKASLR series brough up orphan
> section handling too[2]. In both cases, it would have been nice if the
> linker was running with --orphan-handling=warn so that surprise sections
> wouldn't silently get mapped into the kernel image at locations up to
> the whim of the linker's orphan handling logic. Instead, all desired
> sections should be explicitly identified in the linker script (to be
> either kept or discarded) with any orphans throwing a warning. The
> powerpc architecture actually already does this, so this series seeks
> to extend this coverage to x86, arm64, and arm.
>
> This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> landed), and has a minor conflict[4] with the ARM tree (related to
> the earlier mentioned bug). As it uses refactorings in the asm-generic
> linker script, and makes changes to kbuild, I think the cleanest place
> for this series to land would also be through -tip. Once again (like
> my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> this can go all together with the least disruption. Splitting it up by
> architecture seems needlessly difficult.
>
> Thanks!
>
> -Kees
>
> [1] https://github.com/ClangBuiltLinux/linux/issues/282
> [2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/
> [3] https://lore.kernel.org/lkml/158264960194.28353.10560165361470246192.tip-bot2@tip-bot2/
> [4] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=8959/1
>
Hi Kees,
is this an updated version of what you have in your
kees/linux.git#linker/orphans/x86-arm Git branch?
Especially, I saw a difference in [2] and "[PATCH 4/9] x86/boot: Warn
on orphan section placement"
[ arch/x86/boot/compressed/Makefile ]
+KBUILD_LDFLAGS += --no-ld-generated-unwind-info
Can you comment on why this KBUILD_LDFLAGS was added/needed?
I like when people offer their work in a Git branch.
Do you plan to do that?
Thanks.
Regards,
- Sedat -
[1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/x86-arm
[2] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=linker/orphans/x86-arm&id=e43aa77956c40b9b6db0b37b3780423aa2e661ad
> H.J. Lu (1):
> Add RUNTIME_DISCARD_EXIT to generic DISCARDS
>
> Kees Cook (8):
> scripts/link-vmlinux.sh: Delay orphan handling warnings until final
> link
> vmlinux.lds.h: Add .gnu.version* to DISCARDS
> x86/build: Warn on orphan section placement
> x86/boot: Warn on orphan section placement
> arm64/build: Use common DISCARDS in linker script
> arm64/build: Warn on orphan section placement
> arm/build: Warn on orphan section placement
> arm/boot: Warn on orphan section placement
>
> arch/arm/Makefile | 4 ++++
> arch/arm/boot/compressed/Makefile | 2 ++
> arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
> .../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
> arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
> arch/arm/kernel/vmlinux.lds.S | 5 ++---
> arch/arm64/Makefile | 4 ++++
> arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
> arch/x86/Makefile | 4 ++++
> arch/x86/boot/compressed/Makefile | 3 ++-
> arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
> arch/x86/kernel/vmlinux.lds.S | 7 ++++++
> include/asm-generic/vmlinux.lds.h | 11 ++++++++--
> scripts/link-vmlinux.sh | 6 +++++
> 14 files changed, 85 insertions(+), 31 deletions(-)
> rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
>
> --
> 2.20.1
>
> --
> You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20200228002244.15240-1-keescook%40chromium.org.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/9] Enable orphan section warning
@ 2020-02-28 6:51 ` Sedat Dilek
0 siblings, 0 replies; 13+ messages in thread
From: Sedat Dilek @ 2020-02-28 6:51 UTC (permalink / raw)
To: Kees Cook
Cc: Mark Rutland, H.J. Lu, Arnd Bergmann, linux-kbuild,
Peter Collingbourne, Catalin Marinas, Masahiro Yamada, x86,
Russell King, linux-kernel, Clang-Built-Linux ML, James Morse,
linux-arch, Borislav Petkov, Will Deacon, linux-arm-kernel
On Fri, Feb 28, 2020 at 1:22 AM Kees Cook <keescook@chromium.org> wrote:
>
> Hi!
>
> A recent bug was solved for builds linked with ld.lld, and tracking
> it down took way longer than it needed to (a year). Ultimately, it
> boiled down to differences between ld.bfd and ld.lld's handling of
> orphan sections. Similarly, the recent FGKASLR series brough up orphan
> section handling too[2]. In both cases, it would have been nice if the
> linker was running with --orphan-handling=warn so that surprise sections
> wouldn't silently get mapped into the kernel image at locations up to
> the whim of the linker's orphan handling logic. Instead, all desired
> sections should be explicitly identified in the linker script (to be
> either kept or discarded) with any orphans throwing a warning. The
> powerpc architecture actually already does this, so this series seeks
> to extend this coverage to x86, arm64, and arm.
>
> This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
> landed), and has a minor conflict[4] with the ARM tree (related to
> the earlier mentioned bug). As it uses refactorings in the asm-generic
> linker script, and makes changes to kbuild, I think the cleanest place
> for this series to land would also be through -tip. Once again (like
> my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
> this can go all together with the least disruption. Splitting it up by
> architecture seems needlessly difficult.
>
> Thanks!
>
> -Kees
>
> [1] https://github.com/ClangBuiltLinux/linux/issues/282
> [2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/
> [3] https://lore.kernel.org/lkml/158264960194.28353.10560165361470246192.tip-bot2@tip-bot2/
> [4] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=8959/1
>
Hi Kees,
is this an updated version of what you have in your
kees/linux.git#linker/orphans/x86-arm Git branch?
Especially, I saw a difference in [2] and "[PATCH 4/9] x86/boot: Warn
on orphan section placement"
[ arch/x86/boot/compressed/Makefile ]
+KBUILD_LDFLAGS += --no-ld-generated-unwind-info
Can you comment on why this KBUILD_LDFLAGS was added/needed?
I like when people offer their work in a Git branch.
Do you plan to do that?
Thanks.
Regards,
- Sedat -
[1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/x86-arm
[2] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=linker/orphans/x86-arm&id=e43aa77956c40b9b6db0b37b3780423aa2e661ad
> H.J. Lu (1):
> Add RUNTIME_DISCARD_EXIT to generic DISCARDS
>
> Kees Cook (8):
> scripts/link-vmlinux.sh: Delay orphan handling warnings until final
> link
> vmlinux.lds.h: Add .gnu.version* to DISCARDS
> x86/build: Warn on orphan section placement
> x86/boot: Warn on orphan section placement
> arm64/build: Use common DISCARDS in linker script
> arm64/build: Warn on orphan section placement
> arm/build: Warn on orphan section placement
> arm/boot: Warn on orphan section placement
>
> arch/arm/Makefile | 4 ++++
> arch/arm/boot/compressed/Makefile | 2 ++
> arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
> .../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
> arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
> arch/arm/kernel/vmlinux.lds.S | 5 ++---
> arch/arm64/Makefile | 4 ++++
> arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
> arch/x86/Makefile | 4 ++++
> arch/x86/boot/compressed/Makefile | 3 ++-
> arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
> arch/x86/kernel/vmlinux.lds.S | 7 ++++++
> include/asm-generic/vmlinux.lds.h | 11 ++++++++--
> scripts/link-vmlinux.sh | 6 +++++
> 14 files changed, 85 insertions(+), 31 deletions(-)
> rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
>
> --
> 2.20.1
>
> --
> You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20200228002244.15240-1-keescook%40chromium.org.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH 0/9] Enable orphan section warning
@ 2020-02-28 0:22 ` Kees Cook
0 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-02-28 0:22 UTC (permalink / raw)
To: Borislav Petkov
Cc: Kees Cook, H.J. Lu, Russell King, Catalin Marinas, Will Deacon,
Mark Rutland, Peter Collingbourne, James Morse, Arnd Bergmann,
Masahiro Yamada, x86, linux-arm-kernel, linux-arch, linux-kbuild,
clang-built-linux, linux-kernel
Hi!
A recent bug was solved for builds linked with ld.lld, and tracking
it down took way longer than it needed to (a year). Ultimately, it
boiled down to differences between ld.bfd and ld.lld's handling of
orphan sections. Similarly, the recent FGKASLR series brough up orphan
section handling too[2]. In both cases, it would have been nice if the
linker was running with --orphan-handling=warn so that surprise sections
wouldn't silently get mapped into the kernel image at locations up to
the whim of the linker's orphan handling logic. Instead, all desired
sections should be explicitly identified in the linker script (to be
either kept or discarded) with any orphans throwing a warning. The
powerpc architecture actually already does this, so this series seeks
to extend this coverage to x86, arm64, and arm.
This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
landed), and has a minor conflict[4] with the ARM tree (related to
the earlier mentioned bug). As it uses refactorings in the asm-generic
linker script, and makes changes to kbuild, I think the cleanest place
for this series to land would also be through -tip. Once again (like
my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
this can go all together with the least disruption. Splitting it up by
architecture seems needlessly difficult.
Thanks!
-Kees
[1] https://github.com/ClangBuiltLinux/linux/issues/282
[2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/
[3] https://lore.kernel.org/lkml/158264960194.28353.10560165361470246192.tip-bot2@tip-bot2/
[4] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=8959/1
H.J. Lu (1):
Add RUNTIME_DISCARD_EXIT to generic DISCARDS
Kees Cook (8):
scripts/link-vmlinux.sh: Delay orphan handling warnings until final
link
vmlinux.lds.h: Add .gnu.version* to DISCARDS
x86/build: Warn on orphan section placement
x86/boot: Warn on orphan section placement
arm64/build: Use common DISCARDS in linker script
arm64/build: Warn on orphan section placement
arm/build: Warn on orphan section placement
arm/boot: Warn on orphan section placement
arch/arm/Makefile | 4 ++++
arch/arm/boot/compressed/Makefile | 2 ++
arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
.../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
arch/arm/kernel/vmlinux.lds.S | 5 ++---
arch/arm64/Makefile | 4 ++++
arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
arch/x86/Makefile | 4 ++++
arch/x86/boot/compressed/Makefile | 3 ++-
arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
arch/x86/kernel/vmlinux.lds.S | 7 ++++++
include/asm-generic/vmlinux.lds.h | 11 ++++++++--
scripts/link-vmlinux.sh | 6 +++++
14 files changed, 85 insertions(+), 31 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
--
2.20.1
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH 0/9] Enable orphan section warning
@ 2020-02-28 0:22 ` Kees Cook
0 siblings, 0 replies; 13+ messages in thread
From: Kees Cook @ 2020-02-28 0:22 UTC (permalink / raw)
To: Borislav Petkov
Cc: Mark Rutland, H.J. Lu, Kees Cook, Arnd Bergmann, linux-kbuild,
Peter Collingbourne, Catalin Marinas, Masahiro Yamada, x86,
Russell King, linux-kernel, clang-built-linux, James Morse,
linux-arch, Will Deacon, linux-arm-kernel
Hi!
A recent bug was solved for builds linked with ld.lld, and tracking
it down took way longer than it needed to (a year). Ultimately, it
boiled down to differences between ld.bfd and ld.lld's handling of
orphan sections. Similarly, the recent FGKASLR series brough up orphan
section handling too[2]. In both cases, it would have been nice if the
linker was running with --orphan-handling=warn so that surprise sections
wouldn't silently get mapped into the kernel image at locations up to
the whim of the linker's orphan handling logic. Instead, all desired
sections should be explicitly identified in the linker script (to be
either kept or discarded) with any orphans throwing a warning. The
powerpc architecture actually already does this, so this series seeks
to extend this coverage to x86, arm64, and arm.
This series depends on tip/x86/boot (where recent .eh_frame fixes[3]
landed), and has a minor conflict[4] with the ARM tree (related to
the earlier mentioned bug). As it uses refactorings in the asm-generic
linker script, and makes changes to kbuild, I think the cleanest place
for this series to land would also be through -tip. Once again (like
my READ_IMPLIES_EXEC series), I'm looking to get maintainer Acks so
this can go all together with the least disruption. Splitting it up by
architecture seems needlessly difficult.
Thanks!
-Kees
[1] https://github.com/ClangBuiltLinux/linux/issues/282
[2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/
[3] https://lore.kernel.org/lkml/158264960194.28353.10560165361470246192.tip-bot2@tip-bot2/
[4] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=8959/1
H.J. Lu (1):
Add RUNTIME_DISCARD_EXIT to generic DISCARDS
Kees Cook (8):
scripts/link-vmlinux.sh: Delay orphan handling warnings until final
link
vmlinux.lds.h: Add .gnu.version* to DISCARDS
x86/build: Warn on orphan section placement
x86/boot: Warn on orphan section placement
arm64/build: Use common DISCARDS in linker script
arm64/build: Warn on orphan section placement
arm/build: Warn on orphan section placement
arm/boot: Warn on orphan section placement
arch/arm/Makefile | 4 ++++
arch/arm/boot/compressed/Makefile | 2 ++
arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
.../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
arch/arm/kernel/vmlinux.lds.S | 5 ++---
arch/arm64/Makefile | 4 ++++
arch/arm64/kernel/vmlinux.lds.S | 13 +++++------
arch/x86/Makefile | 4 ++++
arch/x86/boot/compressed/Makefile | 3 ++-
arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++
arch/x86/kernel/vmlinux.lds.S | 7 ++++++
include/asm-generic/vmlinux.lds.h | 11 ++++++++--
scripts/link-vmlinux.sh | 6 +++++
14 files changed, 85 insertions(+), 31 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)
--
2.20.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2020-04-05 11:14 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-28 0:23 [PATCH 0/9] Enable orphan section warning Kees Cook
-- strict thread matches above, loose matches on Subject: below --
2020-02-28 0:22 Kees Cook
2020-02-28 0:22 ` Kees Cook
2020-02-28 6:51 ` Sedat Dilek
2020-02-28 6:51 ` Sedat Dilek
2020-03-03 4:32 ` Kees Cook
2020-03-03 4:32 ` Kees Cook
2020-04-02 16:20 ` Sedat Dilek
2020-04-02 16:20 ` Sedat Dilek
2020-04-02 17:26 ` Kees Cook
2020-04-02 17:26 ` Kees Cook
2020-04-05 11:15 ` Sedat Dilek
2020-04-05 11:15 ` Sedat Dilek
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.