From: Nick Desaulniers <ndesaulniers@google.com> To: Alan Modra <amodra@gmail.com> Cc: "Catalin Marinas" <catalin.marinas@arm.com>, kernel-team <kernel-team@android.com>, "Will Deacon" <will@kernel.org>, LKML <linux-kernel@vger.kernel.org>, "Peter Smith" <Peter.Smith@arm.com>, clang-built-linux <clang-built-linux@googlegroups.com>, "# 3.4.x" <stable@vger.kernel.org>, "Linux ARM" <linux-arm-kernel@lists.infradead.org>, "Ard Biesheuvel" <ardb@kernel.org>, "Fāng-ruì Sòng" <maskray@google.com>, "Quentin Perret" <qperret@google.com> Subject: Re: [PATCH] arm64: link with -z norelro regardless of CONFIG_RELOCATABLE Date: Mon, 14 Dec 2020 13:44:06 -0800 [thread overview] Message-ID: <CAKwvOdnYcff_bcWZYkUC5qKso6EPRWrDgMAdn1KE1_YMCTy__A@mail.gmail.com> (raw) In-Reply-To: <160319373854.2175971.17968938488121846972.b4-ty@kernel.org> On Tue, Oct 20, 2020 at 10:57 AM Will Deacon <will@kernel.org> wrote: > > On Fri, 16 Oct 2020 10:53:39 -0700, Nick Desaulniers wrote: > > With CONFIG_EXPERT=y, CONFIG_KASAN=y, CONFIG_RANDOMIZE_BASE=n, > > CONFIG_RELOCATABLE=n, we observe the following failure when trying to > > link the kernel image with LD=ld.lld: > > > > error: section: .exit.data is not contiguous with other relro sections > > > > ld.lld defaults to -z relro while ld.bfd defaults to -z norelro. This > > was previously fixed, but only for CONFIG_RELOCATABLE=y. > > Applied to arm64 (for-next/core), thanks! > > [1/1] arm64: link with -z norelro regardless of CONFIG_RELOCATABLE > https://git.kernel.org/arm64/c/3b92fa7485eb It looks like this is now producing warnings when linking with BFD. $ make ... ... LD .tmp_vmlinux.kallsyms1 aarch64-linux-gnu-ld: warning: -z norelro ignored KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 aarch64-linux-gnu-ld: warning: -z norelro ignored KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux aarch64-linux-gnu-ld: warning: -z norelro ignored Alan, looking at binutils-gdb commit 5fd104addfddb ("Emit a warning when -z relro is unsupported") mentions targets lacking relro support will produce this warning. I thought aarch64 supports relro though...? Looks like we're invoking: + aarch64-linux-gnu-ld -EL -maarch64elf --no-undefined -X -z norelro -shared -Bsymbolic -z notext --no-apply-dynamic-relocs --fix-cortex-a53-843419 --build-id=sha1 --orphan-handling=warn --strip-debug -o .tmp_vmlinux.kallsyms1 -T ./arch/arm64/kernel/vmlinux.lds --whole-archive arch/arm64/kernel/head.o init/built-in.a usr/built-in.a arch/arm64/built-in.a kernel/built-in.a certs/built-in.a mm/built-in.a fs/built-in.a ipc/built-in.a security/built-in.a crypto/built-in.a block/built-in.a arch/arm64/lib/built-in.a lib/built-in.a arch/arm64/lib/lib.a lib/lib.a drivers/built-in.a sound/built-in.a net/built-in.a virt/built-in.a --no-whole-archive --start-group ./drivers/firmware/efi/libstub/lib.a --end-group aarch64-linux-gnu-ld: warning: -z norelro ignored So we set the emulation mode via -maarch64elf, and our preprocessed linker script has `OUTPUT_ARCH(aarch64)`. From that commit, there's a linked mailing list discussion: https://sourceware.org/legacy-ml/binutils/2017-01/msg00441.html Is there something more we need to do to our linker script (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/kernel/vmlinux.lds.S) for BFD not to warn when passing `-z norelro`? It looks like common page size might need to be specified? I tried: diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S index 1bda604f4c70..ae8cce140fdf 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S @@ -121,7 +121,7 @@ SECTIONS _text = .; HEAD_TEXT } - .text : { /* Real text segment */ + .text ALIGN (CONSTANT (COMMONPAGESIZE)): { /* Real text segment */ and passing `-z common-page-size=4096` but neither seemed to do the trick. (https://docs.adacore.com/live/wave/binutils-stable/html/ld/ld.html#index-COMMONPAGESIZE-553 Worst case, we add `-z norelro` just for LLD: diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile index 6a87d592bd00..6a6235e1e8a9 100644 --- a/arch/arm64/Makefile +++ b/arch/arm64/Makefile @@ -10,7 +10,7 @@ # # Copyright (C) 1995-2001 by Russell King -LDFLAGS_vmlinux :=--no-undefined -X -z norelro +LDFLAGS_vmlinux :=--no-undefined -X ifeq ($(CONFIG_RELOCATABLE), y) # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour @@ -28,6 +28,10 @@ LDFLAGS_vmlinux += --fix-cortex-a53-843419 endif endif +ifeq ($(CONFIG_LD_IS_LLD), y) +LDFLAGS_vmlinux += -z norelro +endif + ifeq ($(CONFIG_ARM64_USE_LSE_ATOMICS), y) ifneq ($(CONFIG_ARM64_LSE_ATOMICS), y) $(warning LSE atomics not supported by binutils) -- Thanks, ~Nick Desaulniers
WARNING: multiple messages have this Message-ID (diff)
From: Nick Desaulniers <ndesaulniers@google.com> To: Alan Modra <amodra@gmail.com> Cc: "Fāng-ruì Sòng" <maskray@google.com>, "Will Deacon" <will@kernel.org>, "Quentin Perret" <qperret@google.com>, "Catalin Marinas" <catalin.marinas@arm.com>, LKML <linux-kernel@vger.kernel.org>, "# 3.4.x" <stable@vger.kernel.org>, "Peter Smith" <Peter.Smith@arm.com>, clang-built-linux <clang-built-linux@googlegroups.com>, kernel-team <kernel-team@android.com>, "Ard Biesheuvel" <ardb@kernel.org>, "Linux ARM" <linux-arm-kernel@lists.infradead.org> Subject: Re: [PATCH] arm64: link with -z norelro regardless of CONFIG_RELOCATABLE Date: Mon, 14 Dec 2020 13:44:06 -0800 [thread overview] Message-ID: <CAKwvOdnYcff_bcWZYkUC5qKso6EPRWrDgMAdn1KE1_YMCTy__A@mail.gmail.com> (raw) In-Reply-To: <160319373854.2175971.17968938488121846972.b4-ty@kernel.org> On Tue, Oct 20, 2020 at 10:57 AM Will Deacon <will@kernel.org> wrote: > > On Fri, 16 Oct 2020 10:53:39 -0700, Nick Desaulniers wrote: > > With CONFIG_EXPERT=y, CONFIG_KASAN=y, CONFIG_RANDOMIZE_BASE=n, > > CONFIG_RELOCATABLE=n, we observe the following failure when trying to > > link the kernel image with LD=ld.lld: > > > > error: section: .exit.data is not contiguous with other relro sections > > > > ld.lld defaults to -z relro while ld.bfd defaults to -z norelro. This > > was previously fixed, but only for CONFIG_RELOCATABLE=y. > > Applied to arm64 (for-next/core), thanks! > > [1/1] arm64: link with -z norelro regardless of CONFIG_RELOCATABLE > https://git.kernel.org/arm64/c/3b92fa7485eb It looks like this is now producing warnings when linking with BFD. $ make ... ... LD .tmp_vmlinux.kallsyms1 aarch64-linux-gnu-ld: warning: -z norelro ignored KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 aarch64-linux-gnu-ld: warning: -z norelro ignored KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux aarch64-linux-gnu-ld: warning: -z norelro ignored Alan, looking at binutils-gdb commit 5fd104addfddb ("Emit a warning when -z relro is unsupported") mentions targets lacking relro support will produce this warning. I thought aarch64 supports relro though...? Looks like we're invoking: + aarch64-linux-gnu-ld -EL -maarch64elf --no-undefined -X -z norelro -shared -Bsymbolic -z notext --no-apply-dynamic-relocs --fix-cortex-a53-843419 --build-id=sha1 --orphan-handling=warn --strip-debug -o .tmp_vmlinux.kallsyms1 -T ./arch/arm64/kernel/vmlinux.lds --whole-archive arch/arm64/kernel/head.o init/built-in.a usr/built-in.a arch/arm64/built-in.a kernel/built-in.a certs/built-in.a mm/built-in.a fs/built-in.a ipc/built-in.a security/built-in.a crypto/built-in.a block/built-in.a arch/arm64/lib/built-in.a lib/built-in.a arch/arm64/lib/lib.a lib/lib.a drivers/built-in.a sound/built-in.a net/built-in.a virt/built-in.a --no-whole-archive --start-group ./drivers/firmware/efi/libstub/lib.a --end-group aarch64-linux-gnu-ld: warning: -z norelro ignored So we set the emulation mode via -maarch64elf, and our preprocessed linker script has `OUTPUT_ARCH(aarch64)`. From that commit, there's a linked mailing list discussion: https://sourceware.org/legacy-ml/binutils/2017-01/msg00441.html Is there something more we need to do to our linker script (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/kernel/vmlinux.lds.S) for BFD not to warn when passing `-z norelro`? It looks like common page size might need to be specified? I tried: diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S index 1bda604f4c70..ae8cce140fdf 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S @@ -121,7 +121,7 @@ SECTIONS _text = .; HEAD_TEXT } - .text : { /* Real text segment */ + .text ALIGN (CONSTANT (COMMONPAGESIZE)): { /* Real text segment */ and passing `-z common-page-size=4096` but neither seemed to do the trick. (https://docs.adacore.com/live/wave/binutils-stable/html/ld/ld.html#index-COMMONPAGESIZE-553 Worst case, we add `-z norelro` just for LLD: diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile index 6a87d592bd00..6a6235e1e8a9 100644 --- a/arch/arm64/Makefile +++ b/arch/arm64/Makefile @@ -10,7 +10,7 @@ # # Copyright (C) 1995-2001 by Russell King -LDFLAGS_vmlinux :=--no-undefined -X -z norelro +LDFLAGS_vmlinux :=--no-undefined -X ifeq ($(CONFIG_RELOCATABLE), y) # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour @@ -28,6 +28,10 @@ LDFLAGS_vmlinux += --fix-cortex-a53-843419 endif endif +ifeq ($(CONFIG_LD_IS_LLD), y) +LDFLAGS_vmlinux += -z norelro +endif + ifeq ($(CONFIG_ARM64_USE_LSE_ATOMICS), y) ifneq ($(CONFIG_ARM64_LSE_ATOMICS), y) $(warning LSE atomics not supported by binutils) -- Thanks, ~Nick Desaulniers _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-12-14 21:52 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-10-16 17:53 [PATCH] arm64: link with -z norelro regardless of CONFIG_RELOCATABLE Nick Desaulniers 2020-10-16 17:53 ` Nick Desaulniers 2020-10-20 17:57 ` Will Deacon 2020-10-20 17:57 ` Will Deacon 2020-10-20 20:16 ` Nick Desaulniers 2020-10-20 20:16 ` Nick Desaulniers 2020-10-21 6:58 ` Ard Biesheuvel 2020-10-21 6:58 ` Ard Biesheuvel 2020-12-14 21:44 ` Nick Desaulniers [this message] 2020-12-14 21:44 ` Nick Desaulniers 2020-12-14 23:18 ` Alan Modra 2020-12-14 23:18 ` Alan Modra 2020-12-14 23:33 ` Nick Desaulniers 2020-12-14 23:33 ` Nick Desaulniers 2020-12-17 0:40 ` [PATCH] arm64: link with -z norelro for LLD or aarch64-elf Nick Desaulniers 2020-12-17 0:40 ` Nick Desaulniers 2020-12-17 12:01 ` Will Deacon 2020-12-17 12:01 ` Will Deacon 2020-12-17 21:07 ` Nick Desaulniers 2020-12-17 21:07 ` Nick Desaulniers 2020-12-18 0:24 ` [PATCH v2] " Nick Desaulniers 2020-12-18 0:24 ` Nick Desaulniers 2020-12-18 2:36 ` Nathan Chancellor 2020-12-18 2:36 ` Nathan Chancellor 2021-01-05 12:26 ` Catalin Marinas 2021-01-05 12:26 ` Catalin Marinas 2020-12-17 19:29 ` [PATCH] " Ard Biesheuvel 2020-12-17 19:29 ` Ard Biesheuvel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAKwvOdnYcff_bcWZYkUC5qKso6EPRWrDgMAdn1KE1_YMCTy__A@mail.gmail.com \ --to=ndesaulniers@google.com \ --cc=Peter.Smith@arm.com \ --cc=amodra@gmail.com \ --cc=ardb@kernel.org \ --cc=catalin.marinas@arm.com \ --cc=clang-built-linux@googlegroups.com \ --cc=kernel-team@android.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=maskray@google.com \ --cc=qperret@google.com \ --cc=stable@vger.kernel.org \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.