LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Kees Cook <keescook@chromium.org>
To: Nick Desaulniers <ndesaulniers@google.com>
Cc: Arvind Sankar <nivedita@alum.mit.edu>,
	Fangrui Song <maskray@google.com>, Borislav Petkov <bp@alien8.de>,
	Nathan Chancellor <natechancellor@gmail.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)"
	<x86@kernel.org>, LKML <linux-kernel@vger.kernel.org>,
	clang-built-linux <clang-built-linux@googlegroups.com>,
	Michael Matz <matz@suse.de>
Subject: Re: --orphan-handling=warn (was Re: [PATCH 2/2] x86/boot/compressed: Remove unnecessary sections) from bzImage
Date: Mon, 24 Feb 2020 21:35:04 -0800
Message-ID: <202002242122.AA4D1B8@keescook> (raw)
In-Reply-To: <CAKwvOdnvMS21s9gLp5nUpDAOu=c7-iWYuKTeFUq+PMhsJOKUgw@mail.gmail.com>

On Sat, Feb 22, 2020 at 03:20:39PM -0800, Nick Desaulniers wrote:
> Kees is working on a series to just be explicit about what sections
> are ordered where, and what's discarded, which should better handle
> incompatibilities between linkers in regards to orphan section
> placement and "what does `*` mean."  Kees, that series can't come soon

So, with my series[1] applied, ld.bfd builds clean. With ld.lld, I get a
TON of warnings, such as:

(.bss.rel.ro) is being placed in '.bss.rel.ro'
(.iplt) is being placed in '.iplt'
(.plt) is being placed in '.plt'
(.rela.altinstr_aux) is being placed in '.rela.altinstr_aux'
(.rela.altinstr_replacement) is being placed in
'.rela.altinstr_replacement'
(.rela.altinstructions) is being placed in '.rela.altinstructions'
(.rela.apicdrivers) is being placed in '.rela.apicdrivers'
(.rela__bug_table) is being placed in '.rela__bug_table'
(.rela.con_initcall.init) is being placed in '.rela.init.data'
(.rela.cpuidle.text) is being placed in '.rela.text'
(.rela.data..cacheline_aligned) is being placed in '.rela.data'
(.rela.data) is being placed in '.rela.data'
(.rela.data..percpu) is being placed in '.rela.data..percpu'
(.rela.data..percpu..page_aligned) is being placed in '.rela.data..percpu'
...

But as you can see in the /DISCARD/, these (and all the others), should
be getting caught:

        /DISCARD/ : {
                *(.eh_frame)
+               *(.rela.*) *(.rela_*)
+               *(.rel.*) *(.rel_*)
+               *(.got) *(.got.*)
+               *(.igot.*) *(.iplt)
        }

I don't understand what's happening here. I haven't minimized this case
nor opened an lld bug yet.

> enough. ;) (I think it's intended to help "fine grain" (per function)
> KASLR).  More comments in the other thread.

Actually, it's rather opposed to the FGKASLR series, as for that, I need
some kind of linker script directive like this:

	/PASSTHRU/ : {
		*(.text.*)
	}

Where "PASSTHRU" would create a 1-to-1 input-section to output-section
with the same name, flags, etc.

ld.bfd's handling of orphan sections named .text.* is to put them each
as a separate output section, after the existing .text output section.

ld.lld's handling of orphan sections named .text.* is to put them into
the .text output section.

For FGKASLR (as it is currently implemented[2]), the sections need to be
individually named output sections (as bfd does it). *However*, with the
"warn on orphans" patch, FGKASLR's intentional orphaning will backfire
(I guess the warning could be turned off, but I'd like lld to handle
FGKASLR at some point.)

Note that cheating and doing the 1-to-1 mapping by handy with a 40,000
entry linker script ... made ld.lld take about 15 minutes to do the
final link. :(

> Taken from the Zen of Python, but in regards to sections in linker
> scripts, "explicit is better than implicit."

Totally agreed. I just hope there's a good solution for this PASSTHRU
idea...

-Kees

[1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/x86-arm
[2]
https://github.com/kaccardi/linux/commit/127111e8c6170a130d8d12d73728e74acbe05e13

-- 
Kees Cook

  parent reply index

Thread overview: 115+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-09 15:02 [PATCH 1/2] x86/boot/compressed/64: Remove .bss/.pgtable " Arvind Sankar
2020-01-09 15:02 ` [PATCH 2/2] x86/boot/compressed: Remove unnecessary sections " Arvind Sankar
2020-02-06 11:44   ` Kees Cook
2020-02-19 16:55   ` [tip: x86/boot] " tip-bot2 for Arvind Sankar
2020-02-22  5:08   ` [PATCH 2/2] " Nathan Chancellor
2020-02-22  6:55     ` Borislav Petkov
2020-02-22  7:02       ` Nathan Chancellor
2020-02-22  7:21         ` Fangrui Song
2020-02-22  7:42           ` Nathan Chancellor
2020-02-22 15:37             ` Arvind Sankar
2020-02-22 16:44               ` Arvind Sankar
2020-02-22 17:18                 ` [PATCH] x86/boot/compressed: Fix compressed kernel linking with lld Arvind Sankar
2020-02-22 18:14                   ` Nathan Chancellor
2020-02-22 18:58                     ` Fangrui Song
2020-02-22 20:17                       ` Arvind Sankar
2020-02-22 21:01                         ` Fangrui Song
2020-02-22 23:33                           ` Nick Desaulniers
2020-02-22 23:57                             ` Arvind Sankar
2020-02-23 19:37                               ` [PATCH 0/2] Stop generating .eh_frame sections Arvind Sankar
2020-02-24  4:15                                 ` Nathan Chancellor
2020-02-24 20:49                                 ` Nick Desaulniers
2020-02-24 21:53                                   ` Arvind Sankar
2020-02-24 22:01                                     ` Nick Desaulniers
2020-02-23 19:37                               ` [PATCH 1/2] arch/x86: Use -fno-asynchronous-unwind-tables to suppress " Arvind Sankar
2020-02-24 20:33                                 ` Nick Desaulniers
2020-02-24 21:05                                   ` Arvind Sankar
2020-02-24 21:12                                     ` Fangrui Song
2020-02-24 21:17                                       ` Nick Desaulniers
2020-02-24 21:22                                         ` Nick Desaulniers
2020-02-23 19:37                               ` [PATCH 2/2] arch/x86: Drop unneeded linker script discard of .eh_frame Arvind Sankar
2020-02-24 20:45                                 ` Nick Desaulniers
2020-02-24 21:33                                   ` Arvind Sankar
2020-02-24 21:58                                     ` Nick Desaulniers
2020-02-24 23:21                                       ` [PATCH v2 0/2] Stop generating .eh_frame sections Arvind Sankar
2020-02-24 23:21                                       ` [PATCH v2 1/2] arch/x86: Use -fno-asynchronous-unwind-tables to suppress " Arvind Sankar
2020-02-24 23:28                                         ` Nathan Chancellor
2020-02-24 23:30                                         ` Nick Desaulniers
2020-02-25  4:10                                         ` Kees Cook
2020-02-25 16:53                                         ` [tip: x86/boot] x86/*/Makefile: " tip-bot2 for Arvind Sankar
2020-02-24 23:21                                       ` [PATCH v2 2/2] arch/x86: Drop unneeded linker script discard of .eh_frame Arvind Sankar
2020-02-24 23:28                                         ` Nathan Chancellor
2020-02-24 23:33                                         ` Nick Desaulniers
2020-02-25  4:11                                         ` Kees Cook
2020-02-25 16:53                                         ` [tip: x86/boot] x86/vmlinux: " tip-bot2 for Arvind Sankar
2020-02-23 22:00                           ` [PATCH] x86/boot/compressed: Fix compressed kernel linking with lld Kees Cook
2020-02-24  6:06                             ` Fangrui Song
2020-02-22 17:29                 ` [PATCH 2/2] x86/boot/compressed: Remove unnecessary sections from bzImage Borislav Petkov
2020-02-22 17:53                   ` Arvind Sankar
2020-02-22  7:42           ` Borislav Petkov
2020-02-22 16:22             ` Arvind Sankar
2020-02-22 23:20               ` Nick Desaulniers
2020-02-24 13:28                 ` Michael Matz
2020-02-24 20:51                   ` Nick Desaulniers
2020-02-24 21:28                     ` Fangrui Song
2020-02-24 21:48                       ` Arvind Sankar
2020-02-24 22:17                         ` Fangrui Song
2020-02-24 22:43                           ` Arvind Sankar
2020-02-24 22:50                             ` Fangrui Song
2020-02-24 23:08                               ` Arvind Sankar
2020-02-25  5:35                 ` Kees Cook [this message]
2020-02-25 16:42                   ` --orphan-handling=warn Arvind Sankar
2020-02-25 18:29                   ` --orphan-handling=warn Arvind Sankar
2020-02-25 19:42                     ` --orphan-handling=warn Kees Cook
2020-02-25 20:37                       ` --orphan-handling=warn Nick Desaulniers
2020-02-25 22:02                         ` --orphan-handling=warn Kees Cook
2020-02-26  1:56                           ` --orphan-handling=warn Fangrui Song
2020-02-26  5:35                             ` --orphan-handling=warn Kees Cook
2020-02-26 19:11                               ` --orphan-handling=warn Kristen Carlson Accardi
2020-02-26 19:26                                 ` --orphan-handling=warn Nick Desaulniers
2020-02-24 11:37   ` [tip: x86/boot] x86/boot/compressed: Remove .eh_frame section from bzImage tip-bot2 for Arvind Sankar
2020-02-24 16:41     ` Arvind Sankar
2020-02-24 17:16       ` Borislav Petkov
2020-02-24 17:28         ` Arvind Sankar
2020-02-05 16:29 ` [PATCH 1/2] x86/boot/compressed/64: Remove .bss/.pgtable " Arvind Sankar
2020-02-18 18:03   ` Arvind Sankar
2020-02-19 12:09     ` Borislav Petkov
2020-02-19 17:57       ` Arvind Sankar
2020-02-19 18:22         ` Borislav Petkov
2020-02-19 19:06           ` Arvind Sankar
2020-02-06 11:18 ` Kees Cook
2020-02-19 16:55 ` [tip: x86/boot] " tip-bot2 for Arvind Sankar
2020-04-05 15:42 ` [PATCH 1/2] " Sergey Shatunov
2020-04-05 23:18   ` Arvind Sankar
2020-04-06  0:00     ` Sergey Shatunov
2020-04-06  3:51       ` Arvind Sankar
2020-04-06  7:32         ` Ard Biesheuvel
2020-04-06  8:47           ` Borislav Petkov
2020-04-06  9:11             ` Ard Biesheuvel
2020-04-06 11:20               ` Borislav Petkov
2020-04-06 13:22                 ` Arvind Sankar
2020-04-06 13:29                   ` Ard Biesheuvel
2020-04-06 16:01                     ` Arvind Sankar
2020-04-06 16:22                       ` Ard Biesheuvel
2020-04-06 16:52                         ` Arvind Sankar
2020-04-06 16:59                           ` Ard Biesheuvel
2020-04-06 18:06                             ` [PATCH 1/2] efi/x86: Move efi stub globals from .bss to .data Arvind Sankar
2020-04-06 18:06                               ` [PATCH 2/2] efi/x86: Always relocate the kernel for EFI handover entry Arvind Sankar
2020-04-14  8:20                                 ` [tip: efi/urgent] " tip-bot2 for Arvind Sankar
2020-04-06 18:29                               ` [PATCH 1/2] efi/x86: Move efi stub globals from .bss to .data Ard Biesheuvel
2020-04-08  7:43                               ` Dave Young
2020-04-08  7:49                                 ` Ard Biesheuvel
2020-04-09 14:39                                   ` Arvind Sankar
2020-04-09 14:47                                     ` Ard Biesheuvel
2020-04-09 16:35                                       ` Arvind Sankar
2020-04-10 14:47                                         ` Arvind Sankar
2020-04-10 15:26                                           ` Ard Biesheuvel
2020-04-14 14:57                                             ` Daniel Kiper
2020-04-10 11:26                               ` Thomas Meyer
2020-04-10 14:38                                 ` Arvind Sankar
2020-04-11  8:50                                   ` Thomas Meyer
2020-04-14  8:20                               ` [tip: efi/urgent] " tip-bot2 for Arvind Sankar
2020-04-06 17:21                     ` [PATCH 1/2] x86/boot/compressed/64: Remove .bss/.pgtable from bzImage Borislav Petkov
2020-04-06  8:44     ` Ard Biesheuvel
2020-04-06 12:36       ` Sergey Shatunov
2020-04-06 13:20         ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202002242122.AA4D1B8@keescook \
    --to=keescook@chromium.org \
    --cc=bp@alien8.de \
    --cc=clang-built-linux@googlegroups.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maskray@google.com \
    --cc=matz@suse.de \
    --cc=natechancellor@gmail.com \
    --cc=ndesaulniers@google.com \
    --cc=nivedita@alum.mit.edu \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git