[PATCH v3 0/9] Warn on orphan section placement

Kees Cook

unread,

Jun 23, 2020, 9:49:49 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

v3:
- merge series back together (I tried to make it separable, but no luck)
- remove unwanted sections in libstub
- remove unwanted .eh_frame sections for both .c and .S
- handle sections seen during allnoconfig builds
- handle synthetic and double-quoted sections reported by Clang
- add reviewed-bys
v2: https://lore.kernel.org/lkml/20200622205815.2...@chromium.org/
v1: https://lore.kernel.org/lkml/20200228002244....@chromium.org/

A recent bug[1] was solved for builds linked with ld.lld, and tracking
it down took way longer than it needed to (a year). Ultimately, it
boiled down to differences between ld.bfd and ld.lld's handling of
orphan sections. Similarly, the recent FGKASLR series brough up orphan
section handling too[2]. In both cases, it would have been nice if the
linker was running with --orphan-handling=warn so that surprise sections
wouldn't silently get mapped into the kernel image at locations up to the
whim of the linker's orphan handling logic. Instead, all desired sections
should be explicitly identified in the linker script (to be either kept or
discarded) with any orphans throwing a warning. The powerpc architecture
actually already does this, so this series extends coverage to x86, arm,
and arm64.

All three architectures depend on the first two commits (to
vmlinux.lds.h), and x86 and arm64 depend on the third patch (to
libstub). As such, I'd like to land this series as a whole. Given that
two thirds of it is in the arm universe, perhaps this can land via the
arm64 tree? If x86 -tip is preferred, that works too. Or I could just
carry this myself in -next. In all cases, I would really appreciate
reviews/acks/etc. :)

Thanks!

-Kees

This series is here:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/warn/v3

[1] https://github.com/ClangBuiltLinux/linux/issues/282
[2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/

Kees Cook (9):
vmlinux.lds.h: Add .gnu.version* to DISCARDS
vmlinux.lds.h: Add .symtab, .strtab, and .shstrtab to STABS_DEBUG
efi/libstub: Remove .note.gnu.property
x86/build: Warn on orphan section placement
x86/boot: Warn on orphan section placement
arm/build: Warn on orphan section placement
arm/boot: Warn on orphan section placement
arm64/build: Use common DISCARDS in linker script
arm64/build: Warn on orphan section placement

arch/arm/Makefile | 4 ++++
arch/arm/boot/compressed/Makefile | 2 ++
arch/arm/boot/compressed/vmlinux.lds.S | 17 ++++++--------
.../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
arch/arm/kernel/vmlinux.lds.S | 5 ++---
arch/arm64/Makefile | 9 +++++++-
arch/arm64/kernel/smccc-call.S | 2 --
arch/arm64/kernel/vmlinux.lds.S | 16 ++++++++++----
arch/arm64/mm/mmu.c | 2 +-
arch/x86/Makefile | 4 ++++
arch/x86/boot/compressed/Makefile | 3 ++-
arch/x86/boot/compressed/vmlinux.lds.S | 11 ++++++++++
arch/x86/include/asm/asm.h | 6 ++++-
arch/x86/kernel/vmlinux.lds.S | 6 +++++
drivers/firmware/efi/libstub/Makefile | 3 +++
include/asm-generic/vmlinux.lds.h | 7 +++++-
17 files changed, 92 insertions(+), 32 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)

--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:49 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn to more architectures,
make sure unwanted sections don't end up appearing under the .init
section prefix that libstub adds to itself during objcopy.

Signed-off-by: Kees Cook <kees...@chromium.org>
---
drivers/firmware/efi/libstub/Makefile | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 75daaf20374e..9d2d2e784bca 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -66,6 +66,9 @@ lib-$(CONFIG_X86) += x86-stub.o
CFLAGS_arm32-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
CFLAGS_arm64-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)

+# Remove unwanted sections first.
+STUBCOPY_FLAGS-y += --remove-section=.note.gnu.property
+
#
# For x86, bootloaders like systemd-boot or grub-efi do not zero-initialize the
# .bss section, so the .bss section of the EFI stub needs to be included in the
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:50 PM6/23/20

to Will Deacon, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

For vmlinux linking, no architecture uses the .gnu.version* sections,
so remove it via the common DISCARDS macro in preparation for adding
--orphan-handling=warn more widely. This is a work-around for what
appears to be a bug[1] in ld.bfd which warns for this synthetic section
even when none is found in input objects, and even when no section is
emitted for an output object[2].

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=26153
[2] https://lore.kernel.org/lkml/202006221524.CEB86E036B@keescook/

Reviewed-by: Fangrui Song <mas...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 2 ++
1 file changed, 2 insertions(+)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index db600ef218d7..1248a206be8d 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -934,6 +934,8 @@
*(.discard) \
*(.discard.*) \
*(.modinfo) \
+ /* ld.bfd warns about .gnu.version* even when not emitted */ \
+ *(.gnu.version*) \
}

/**
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:50 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Discards the unused rela, plt, and got sections that are not needed
in the final vmlinux, stop emitting kprobe sections without kprobes,
and enable orphan section warnings.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/Makefile | 4 ++++
arch/x86/include/asm/asm.h | 6 +++++-
arch/x86/kernel/vmlinux.lds.S | 6 ++++++
3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 00e378de8bc0..f8a5b2333729 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -51,6 +51,10 @@ ifdef CONFIG_X86_NEED_RELOCS
LDFLAGS_vmlinux := --emit-relocs --discard-none
endif

+# We never want expected sections to be placed heuristically by the
+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+
#
# Prevent GCC from generating any FP code by mistake.
#
diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index 0f63585edf5f..92feec0f0a12 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -138,11 +138,15 @@
# define _ASM_EXTABLE_FAULT(from, to) \
_ASM_EXTABLE_HANDLE(from, to, ex_handler_fault)

-# define _ASM_NOKPROBE(entry) \
+# ifdef CONFIG_KPROBES
+# define _ASM_NOKPROBE(entry) \
.pushsection "_kprobe_blacklist","aw" ; \
_ASM_ALIGN ; \
_ASM_PTR (entry); \
.popsection
+# else
+# define _ASM_NOKPROBE(entry)
+# endif

#else
# define _EXPAND_EXTABLE_HANDLE(x) #x
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 3bfc8dd8a43d..bb085ceeaaad 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -412,6 +412,12 @@ SECTIONS
DWARF_DEBUG

DISCARDS
+ /DISCARD/ : {
+ *(.rela.*) *(.rela_*)
+ *(.rel.*) *(.rel_*)
+ *(.got) *(.got.*)
+ *(.igot.*) *(.iplt)
+ }
}

--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:51 PM6/23/20

to Will Deacon, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

When linking vmlinux with LLD, the synthetic sections .symtab, .strtab,
and .shstrtab are listed as orphaned. Add them to the STABS_DEBUG section
so there will be no warnings when --orphan-handling=warn is used more
widely. (They are added above comment as it is the more common
order[1].)

ld.lld: warning: <internal>:(.symtab) is being placed in '.symtab'
ld.lld: warning: <internal>:(.shstrtab) is being placed in '.shstrtab'
ld.lld: warning: <internal>:(.strtab) is being placed in '.strtab'

[1] https://lore.kernel.org/lkml/20200622224928....@google.com/

Reported-by: Fangrui Song <mas...@google.com>
Reviewed-by: Fangrui Song <mas...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 1248a206be8d..8e71757f485b 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -792,7 +792,10 @@
.stab.exclstr 0 : { *(.stab.exclstr) } \
.stab.index 0 : { *(.stab.index) } \
.stab.indexstr 0 : { *(.stab.indexstr) } \
- .comment 0 : { *(.comment) }
+ .comment 0 : { *(.comment) } \
+ .symtab 0 : { *(.symtab) } \
+ .strtab 0 : { *(.strtab) } \
+ .shstrtab 0 : { *(.shstrtab) }

#ifdef CONFIG_GENERIC_BUG
#define BUG_TABLE \
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:52 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Specifically, this would have made a recently fixed bug very obvious:

ld: warning: orphan section `.fixup' from `arch/arm/lib/copy_from_user.o' being placed in section `.fixup'

Refactor linker script include file for use in standard and XIP linker
scripts, as well as in the coming boot linker script changes. Add debug
sections explicitly. Create ARM_COMMON_DISCARD macro with unneeded
sections .ARM.attributes, .iplt, .rel.iplt, .igot.plt, and .modinfo.
Create ARM_STUBS_TEXT macro with missed text stub sections .vfp11_veneer,
and .v4_bx. Finally enable orphan section warning.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/Makefile | 4 ++++

.../arm/{kernel => include/asm}/vmlinux.lds.h | 22 ++++++++++++++-----
arch/arm/kernel/vmlinux-xip.lds.S | 5 ++---
arch/arm/kernel/vmlinux.lds.S | 5 ++---

4 files changed, 25 insertions(+), 11 deletions(-)

rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (92%)

diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 59fde2d598d8..e414e3732b3a 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -16,6 +16,10 @@ LDFLAGS_vmlinux += --be8
KBUILD_LDFLAGS_MODULE += --be8

endif

+# We never want expected sections to be placed heuristically by the
+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+

ifeq ($(CONFIG_ARM_MODULE_PLTS),y)
KBUILD_LDS_MODULE += $(srctree)/arch/arm/kernel/module.lds
endif
diff --git a/arch/arm/kernel/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
similarity index 92%
rename from arch/arm/kernel/vmlinux.lds.h
rename to arch/arm/include/asm/vmlinux.lds.h
index 381a8e105fa5..3d88ea74f4cd 100644
--- a/arch/arm/kernel/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -1,4 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0 */
+#include <asm-generic/vmlinux.lds.h>

#ifdef CONFIG_HOTPLUG_CPU
#define ARM_CPU_DISCARD(x)
@@ -37,6 +38,13 @@
*(.idmap.text) \
__idmap_text_end = .; \

+#define ARM_COMMON_DISCARD \
+ *(.ARM.attributes) \
+ *(.iplt) *(.rel.iplt) *(.igot.plt) \
+ *(.modinfo) \
+ *(.discard) \
+ *(.discard.*)
+
#define ARM_DISCARD \
*(.ARM.exidx.exit.text) \
*(.ARM.extab.exit.text) \
@@ -49,8 +57,14 @@
EXIT_CALL \
ARM_MMU_DISCARD(*(.text.fixup)) \
ARM_MMU_DISCARD(*(__ex_table)) \
- *(.discard) \
- *(.discard.*)
+ ARM_COMMON_DISCARD
+
+#define ARM_STUBS_TEXT \
+ *(.gnu.warning) \
+ *(.glue_7t) \
+ *(.glue_7) \
+ *(.vfp11_veneer) \
+ *(.v4_bx)

#define ARM_TEXT \
IDMAP_TEXT \
@@ -64,9 +78,7 @@
CPUIDLE_TEXT \
LOCK_TEXT \
KPROBES_TEXT \
- *(.gnu.warning) \
- *(.glue_7) \
- *(.glue_7t) \
+ ARM_STUBS_TEXT \
. = ALIGN(4); \
*(.got) /* Global offset table */ \
ARM_CPU_KEEP(PROC_INFO)
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 6d2be994ae58..0807f40844a2 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -9,15 +9,13 @@

#include <linux/sizes.h>

-#include <asm-generic/vmlinux.lds.h>
+#include <asm/vmlinux.lds.h>
#include <asm/cache.h>
#include <asm/thread_info.h>
#include <asm/memory.h>
#include <asm/mpu.h>
#include <asm/page.h>

-#include "vmlinux.lds.h"
-
OUTPUT_ARCH(arm)
ENTRY(stext)

@@ -152,6 +150,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ DWARF_DEBUG
}

/*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 7f24bc08403e..969205f125ca 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -9,15 +9,13 @@
#else

#include <linux/pgtable.h>
-#include <asm-generic/vmlinux.lds.h>
+#include <asm/vmlinux.lds.h>
#include <asm/cache.h>
#include <asm/thread_info.h>
#include <asm/memory.h>
#include <asm/mpu.h>
#include <asm/page.h>

-#include "vmlinux.lds.h"
-
OUTPUT_ARCH(arm)
ENTRY(stext)

@@ -151,6 +149,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ DWARF_DEBUG
}

#ifdef CONFIG_STRICT_KERNEL_RWX
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:54 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Add the common debugging sections. Discard the unused note, rel, plt,
dyn, and hash sections that are not needed in the compressed vmlinux.
Disable .eh_frame generation in the linker and enable orphan section
warnings.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/boot/compressed/Makefile | 3 ++-
arch/x86/boot/compressed/vmlinux.lds.S | 11 +++++++++++
2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 7619742f91c9..646720a05f89 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -48,6 +48,7 @@ GCOV_PROFILE := n
UBSAN_SANITIZE :=n

KBUILD_LDFLAGS := -m elf_$(UTS_MACHINE)
+KBUILD_LDFLAGS += $(call ld-option,--no-ld-generated-unwind-info)
# Compressed kernel should be built as PIE since it may be loaded at any
# address by the bootloader.
ifeq ($(CONFIG_X86_32),y)
@@ -59,7 +60,7 @@ else
KBUILD_LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \
&& echo "-z noreloc-overflow -pie --no-dynamic-linker")
endif
-LDFLAGS_vmlinux := -T
+LDFLAGS_vmlinux := --orphan-handling=warn -T

hostprogs := mkpiggy
HOST_EXTRACFLAGS += -I$(srctree)/tools/include
diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S
index 8f1025d1f681..6fe3ecdfd685 100644
--- a/arch/x86/boot/compressed/vmlinux.lds.S
+++ b/arch/x86/boot/compressed/vmlinux.lds.S
@@ -75,5 +75,16 @@ SECTIONS
. = ALIGN(PAGE_SIZE); /* keep ZO size page aligned */
_end = .;

+ STABS_DEBUG
+ DWARF_DEBUG
+
DISCARDS
+ /DISCARD/ : {
+ *(.note.*)

+ *(.rela.*) *(.rela_*)
+ *(.rel.*) *(.rel_*)

+ *(.plt) *(.plt.*)
+ *(.dyn*)
+ *(.hash) *(.gnu.hash)
+ }
}
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:55 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Use the common DISCARDS rule for the linker script in an effort to
regularize the linker script to prepare for warning on orphaned
sections. Additionally clean up left-over no-op macros.

Signed-off-by: Kees Cook <kees...@chromium.org>
Acked-by: Will Deacon <wi...@kernel.org>
---
arch/arm64/kernel/vmlinux.lds.S | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 6827da7f3aa5..5427f502c3a6 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -6,6 +6,7 @@
*/

#define RO_EXCEPTION_TABLE_ALIGN 8
+#define RUNTIME_DISCARD_EXIT

#include <asm-generic/vmlinux.lds.h>
#include <asm/cache.h>
@@ -89,10 +90,8 @@ SECTIONS
* matching the same input section name. There is no documented
* order of matching.
*/
+ DISCARDS
/DISCARD/ : {
- EXIT_CALL
- *(.discard)
- *(.discard.*)
*(.interp .dynamic)
*(.dynsym .dynstr .hash .gnu.hash)
*(.eh_frame)
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:55 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Use common macros for debug sections, discards, and text stubs. Add
discards for unwanted .note, and .rel sections. Finally, enable orphan
section warning.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/boot/compressed/Makefile | 2 ++
arch/arm/boot/compressed/vmlinux.lds.S | 17 +++++++----------
2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 00602a6fba04..b8a97d81662d 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -128,6 +128,8 @@ endif
LDFLAGS_vmlinux += --no-undefined
# Delete all temporary local symbols
LDFLAGS_vmlinux += -X
+# Report orphan sections
+LDFLAGS_vmlinux += --orphan-handling=warn
# Next argument is a linker script
LDFLAGS_vmlinux += -T

diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
index 09ac33f52814..c2a8509f876f 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.S
+++ b/arch/arm/boot/compressed/vmlinux.lds.S
@@ -2,6 +2,7 @@
/*
* Copyright (C) 2000 Russell King
*/
+#include <asm/vmlinux.lds.h>

#ifdef CONFIG_CPU_ENDIAN_BE8
#define ZIMAGE_MAGIC(x) ( (((x) >> 24) & 0x000000ff) | \
@@ -17,8 +18,11 @@ ENTRY(_start)
SECTIONS
{
/DISCARD/ : {
+ ARM_COMMON_DISCARD
*(.ARM.exidx*)
*(.ARM.extab*)
+ *(.note.*)
+ *(.rel.*)
/*
* Discard any r/w data - this produces a link error if we have any,
* which is required for PIC decompression. Local data generates
@@ -36,9 +40,7 @@ SECTIONS
*(.start)
*(.text)
*(.text.*)
- *(.gnu.warning)
- *(.glue_7t)
- *(.glue_7)
+ ARM_STUBS_TEXT
}
.table : ALIGN(4) {
_table_start = .;
@@ -128,12 +130,7 @@ SECTIONS
PROVIDE(__pecoff_data_size = ALIGN(512) - ADDR(.data));
PROVIDE(__pecoff_end = ALIGN(512));

- .stab 0 : { *(.stab) }
- .stabstr 0 : { *(.stabstr) }
- .stab.excl 0 : { *(.stab.excl) }
- .stab.exclstr 0 : { *(.stab.exclstr) }
- .stab.index 0 : { *(.stab.index) }
- .stab.indexstr 0 : { *(.stab.indexstr) }
- .comment 0 : { *(.comment) }
+ STABS_DEBUG
+ DWARF_DEBUG
}
ASSERT(_edata_real == _edata, "error: zImage file size is incorrect");
--
2.25.1

Kees Cook

unread,

Jun 23, 2020, 9:49:55 PM6/23/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Avoid .eh_frame* by making sure both -fno-asychronous-unwind-tables and
-fno-unwind-tables are present in both CFLAGS and AFLAGS. Remove one
last instance of .eh_frame by removing the needless Call Frame Information
annotations from arch/arm64/kernel/smccc-call.S.

Add .plt, .data.rel.ro, .igot.*, and .iplt to discards as they are not
actually used. While .got.plt is also not used, it must be included
otherwise ld.bfd will fail to link with the error:

aarch64-linux-gnu-ld: discarded output section: `.got.plt'

However, as it'd be better to validate that it stays effectively empty,
add an assert.

Explicitly include debug sections when they're present.

Fix a case of needless quotes in __section(), which Clang doesn't like.

Finally, enable orphan section warnings.

Thanks to Ard Biesheuvel for many hints on correct ways to handle
mysterious sections. :)

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/Makefile | 9 ++++++++-
arch/arm64/kernel/smccc-call.S | 2 --
arch/arm64/kernel/vmlinux.lds.S | 11 ++++++++++-
arch/arm64/mm/mmu.c | 2 +-
4 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index a0d94d063fa8..fb3aa2d7de4d 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -29,6 +29,10 @@ LDFLAGS_vmlinux += --fix-cortex-a53-843419
endif

endif

+# We never want expected sections to be placed heuristically by the
+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+

ifeq ($(CONFIG_ARM64_USE_LSE_ATOMICS), y)
ifneq ($(CONFIG_ARM64_LSE_ATOMICS), y)
$(warning LSE atomics not supported by binutils)
@@ -47,13 +51,16 @@ endif

KBUILD_CFLAGS += -mgeneral-regs-only \
$(compat_vdso) $(cc_has_k_constraint)
-KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
KBUILD_CFLAGS += $(call cc-disable-warning, psabi)
KBUILD_AFLAGS += $(compat_vdso)

KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
KBUILD_AFLAGS += $(call cc-option,-mabi=lp64)

+# Avoid generating .eh_frame* sections.
+KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+KBUILD_AFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+
ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y)
prepare: stack_protector_prepare
stack_protector_prepare: prepare0
diff --git a/arch/arm64/kernel/smccc-call.S b/arch/arm64/kernel/smccc-call.S
index 1f93809528a4..d62447964ed9 100644
--- a/arch/arm64/kernel/smccc-call.S
+++ b/arch/arm64/kernel/smccc-call.S
@@ -9,7 +9,6 @@
#include <asm/assembler.h>

.macro SMCCC instr
- .cfi_startproc
\instr #0
ldr x4, [sp]
stp x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS]
@@ -21,7 +20,6 @@
b.ne 1f
str x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS]
1: ret
- .cfi_endproc
.endm

/*
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 5427f502c3a6..f6c781768f83 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -94,7 +94,8 @@ SECTIONS
/DISCARD/ : {

*(.interp .dynamic)
*(.dynsym .dynstr .hash .gnu.hash)

- *(.eh_frame)
+ *(.plt) *(.data.rel.ro)
+ *(.igot.*) *(.iplt)
}

. = KIMAGE_VADDR + TEXT_OFFSET;
@@ -244,8 +245,16 @@ SECTIONS

_end = .;

STABS_DEBUG
+ DWARF_DEBUG

HEAD_SYMBOLS
+
+ /*
+ * Make sure that the .got.plt is either completely empty or it
+ * contains only the lazy dispatch entries.
+ */
+ .got.plt (INFO) : { *(.got.plt) }
+ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, ".got.plt not empty")
}

#include "image-vars.h"
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 1df25f26571d..dce024ea6084 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -42,7 +42,7 @@
u64 idmap_t0sz = TCR_T0SZ(VA_BITS);
u64 idmap_ptrs_per_pgd = PTRS_PER_PGD;

-u64 __section(".mmuoff.data.write") vabits_actual;
+u64 __section(.mmuoff.data.write) vabits_actual;
EXPORT_SYMBOL(vabits_actual);

u64 kimage_voffset __ro_after_init;
--
2.25.1

Fangrui Song

unread,

Jun 23, 2020, 11:31:47 PM6/23/20

to Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

arch/arm64/Kconfig enables ARM64_PTR_AUTH by default. When the config is on

ifeq ($(CONFIG_ARM64_BTI_KERNEL),y)
branch-prot-flags-$(CONFIG_CC_HAS_BRANCH_PROT_PAC_RET_BTI) := -mbranch-protection=pac-ret+leaf+bti
else
branch-prot-flags-$(CONFIG_CC_HAS_BRANCH_PROT_PAC_RET) := -mbranch-protection=pac-ret+leaf
endif

This option creates .note.gnu.property:

% readelf -n drivers/firmware/efi/libstub/efi-stub.o

Displaying notes found in: .note.gnu.property
Owner Data size Description
GNU 0x00000010 NT_GNU_PROPERTY_TYPE_0
Properties: AArch64 feature: PAC

If .note.gnu.property is not desired in drivers/firmware/efi/libstub, specifying
-mbranch-protection=none can override -mbranch-protection=pac-ret+leaf

Kees Cook

unread,

Jun 24, 2020, 12:44:14 AM6/24/20

to Fangrui Song, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We want to keep the branch protection enabled. But since it's not a
"regular" ELF, we don't need to keep the property that identifies the
feature.

--
Kees Cook

Will Deacon

unread,

Jun 24, 2020, 3:57:20 AM6/24/20

to Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

On Tue, Jun 23, 2020 at 06:49:40PM -0700, Kees Cook wrote:
> We don't want to depend on the linker's orphan section placement
> heuristics as these can vary between linkers, and may change between
> versions. All sections need to be explicitly named in the linker
> script.
>
> Avoid .eh_frame* by making sure both -fno-asychronous-unwind-tables and
> -fno-unwind-tables are present in both CFLAGS and AFLAGS. Remove one
> last instance of .eh_frame by removing the needless Call Frame Information
> annotations from arch/arm64/kernel/smccc-call.S.
>
> Add .plt, .data.rel.ro, .igot.*, and .iplt to discards as they are not
> actually used. While .got.plt is also not used, it must be included
> otherwise ld.bfd will fail to link with the error:
>
> aarch64-linux-gnu-ld: discarded output section: `.got.plt'
>
> However, as it'd be better to validate that it stays effectively empty,
> add an assert.
>
> Explicitly include debug sections when they're present.
>
> Fix a case of needless quotes in __section(), which Clang doesn't like.
>
> Finally, enable orphan section warnings.
>
> Thanks to Ard Biesheuvel for many hints on correct ways to handle
> mysterious sections. :)

Sorry to be a pain, but this patch is doing 3 or 4 independent things at
once. Please could you split it up a bit?
e.g.

- Removal of cfi directives from smccc macro
- Removal of quotes around section name for clang
- Avoid generating .eh_frame
- Ensure all sections are accounted for in linker script and warn on orphans

That way it's a bit easier to manage, we can revert/backport bits later if
necessary and you get more patches in the kernel ;)

You can also add my Ack on all the patches:

Acked-by: Will Deacon <wi...@kernel.org>

Will

Will Deacon

unread,

Jun 24, 2020, 6:44:04 AM6/24/20

to Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

For the kernel Image, how do we remove these sections? The objcopy flags
in arch/arm64/boot/Makefile look both insufficient and out of date. My
vmlinux ends up with both a ".notes" and a ".init.note.gnu.property"
segment.

Will

Ard Biesheuvel

unread,

Jun 24, 2020, 6:46:45 AM6/24/20

to Will Deacon, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, clang-built-linux, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

The latter is the fault of the libstub make rules, that prepend .init
to all section names.

I'm not sure if there is a point to having PAC and/or BTI in the EFI
stub, given that it runs under the control of the firmware, with its
memory mappings and PAC configuration etc.

Will Deacon

unread,

Jun 24, 2020, 7:26:55 AM6/24/20

to Ard Biesheuvel, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, clang-built-linux, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

Hmm. I tried adding -mbranch-protection=none to arm64 cflags for the stub,
but I still see this note in vmlinux. It looks like it comes in via the
stub copy of lib-ctype.o, but I don't know why that would force the
note. The cflags look ok to me [1] and I confirmed that the note is
being generated by the compiler.

> I'm not sure if there is a point to having PAC and/or BTI in the EFI
> stub, given that it runs under the control of the firmware, with its
> memory mappings and PAC configuration etc.

Agreed, I just can't figure out how to get rid of the note.

Will

[1] -mlittle-endian -DKASAN_SHADOW_SCALE_SHIFT=3 -Qunused-arguments -Wall -Wundef -Werror=strict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -fshort-wchar -fno-PIE -Werror=implicit-function-declaration -Werror=implicit-int -Wno-format-security -std=gnu89 --target=aarch64-linux-gnu --prefix=/usr/local/google/home/willdeacon/bin/ --gcc-toolchain=/usr/local/google/home/willdeacon -no-integrated-as -Werror=unknown-warning-option -mgeneral-regs-only -DCONFIG_CC_HAS_K_CONSTRAINT=1 -fno-asynchronous-unwind-tables -mbranch-protection=pac-ret+leaf+bti -Wa,-march=armv8.3-a -DKASAN_SHADOW_SCALE_SHIFT=3 -fno-delete-null-pointer-checks -Wno-address-of-packed-member -O2 -Wframe-larger-than=2048 -fstack-protector-strong -Wno-format-invalid-specifier -Wno-gnu -mno-global-merge -Wno-unused-const-variable -fno-omit-frame-pointer -fno-optimize-sibling-calls -g -Wdeclaration-after-statement -Wvla -Wno-pointer-sign -Wno-array-bounds -fno-strict-overflow -fno-merge-all-constants -fno-stack-check -Werror=date-time -Werror=incompatible-pointer-types -fmacro-prefix-map=./= -Wno-initializer-overrides -Wno-format -Wno-sign-compare -Wno-format-zero-length -Wno-tautological-constant-out-of-range-compare -fpie -mbranch-protection=none -I./scripts/dtc/libfdt -Os -DDISABLE_BRANCH_PROFILING -include ./drivers/firmware/efi/libstub/hidden.h -D__NO_FORTIFY -ffreestanding -fno-stack-protector -fno-addrsig -D__DISABLE_EXPORTS -DKBUILD_MODFILE='"drivers/firmware/efi/libstub/lib-ctype"' -DKBUILD_BASENAME='"lib_ctype"' -DKBUILD_MODNAME='"lib_ctype"' -c -o drivers/firmware/efi/libstub/lib-ctype.o lib/ctype.c

Dave Martin

unread,

Jun 24, 2020, 9:49:01 AM6/24/20

to Will Deacon, Ard Biesheuvel, Mark Rutland, linux-arch, linux-efi, Kees Cook, Fangrui Song, Catalin Marinas, Masahiro Yamada, X86 ML, Nick Desaulniers, Russell King, Linux Kernel Mailing List, clang-built-linux, Arvind Sankar, Ingo Molnar, James Morse, Linux ARM, Thomas Gleixner, Borislav Petkov, Peter Collingbourne, Nathan Chancellor, Arnd Bergmann

Because this section is generated by the linker itself I think you might
have to send it to /DISCARD/ in the link, or strip it explicitly after
linking.

Cheers
---Dave

Kees Cook

unread,

Jun 24, 2020, 11:21:29 AM6/24/20

to Ard Biesheuvel, Will Deacon, Fangrui Song, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, clang-built-linux, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

On Wed, Jun 24, 2020 at 12:46:32PM +0200, Ard Biesheuvel wrote:

> I'm not sure if there is a point to having PAC and/or BTI in the EFI
> stub, given that it runs under the control of the firmware, with its
> memory mappings and PAC configuration etc.

Is BTI being ignored when the firmware runs?

--
Kees Cook

Will Deacon

unread,

Jun 24, 2020, 11:26:54 AM6/24/20

to Dave Martin, Ard Biesheuvel, Mark Rutland, linux-arch, linux-efi, Kees Cook, Fangrui Song, Catalin Marinas, Masahiro Yamada, X86 ML, Nick Desaulniers, Russell King, Linux Kernel Mailing List, clang-built-linux, Arvind Sankar, Ingo Molnar, James Morse, Linux ARM, Thomas Gleixner, Borislav Petkov, Peter Collingbourne, Nathan Chancellor, Arnd Bergmann

Right, but why is the linker generating that section in the first place? I'm
compiling with -mbranch-protection=none and all the other objects linked
into the stub do not have the section.

I wonder if it's because lib/ctype.c doesn't have any executable code...

Will

Ard Biesheuvel

unread,

Jun 24, 2020, 11:31:19 AM6/24/20

to Kees Cook, Will Deacon, Fangrui Song, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, clang-built-linux, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

Given that it requires the 'guarded' attribute to be set in the page
tables, and the fact that the UEFI spec does not require it for
executables that it invokes, nor describes any means of annotating
such executables as having been built with BTI annotations, I think we
can safely assume that the EFI stub will execute with BTI disabled in
the foreseeable future.

Kees Cook

unread,

Jun 24, 2020, 11:36:23 AM6/24/20

to Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Yeah, this one patch did grow a bit. ;) I've split it up now.

> You can also add my Ack on all the patches:
>
> Acked-by: Will Deacon <wi...@kernel.org>

Thanks!

--
Kees Cook

Arvind Sankar

unread,

Jun 24, 2020, 11:39:34 AM6/24/20

to Kees Cook, Will Deacon, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

On Tue, Jun 23, 2020 at 06:49:33PM -0700, Kees Cook wrote:
> When linking vmlinux with LLD, the synthetic sections .symtab, .strtab,
> and .shstrtab are listed as orphaned. Add them to the STABS_DEBUG section
> so there will be no warnings when --orphan-handling=warn is used more
> widely. (They are added above comment as it is the more common

Nit 1: is "after .comment" better than "above comment"? It's above in the
sense of higher file offset, but it's below in readelf output.
Nit 2: These aren't actually debugging sections, no? Is it better to add
a new macro for it, and is there any plan to stop LLD from warning about
them?

Kees Cook

unread,

Jun 24, 2020, 11:45:50 AM6/24/20

to Ard Biesheuvel, Will Deacon, Fangrui Song, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, clang-built-linux, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

yaaaaaay. *sigh* How long until EFI catches up?

That said, BTI shouldn't _hurt_, right? If EFI ever decides to enable
it, we'll be ready?

--
Kees Cook

Ard Biesheuvel

unread,

Jun 24, 2020, 11:48:54 AM6/24/20

to Kees Cook, Will Deacon, Fangrui Song, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, clang-built-linux, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

Sure. Although I anticipate that we'll need to set some flag in the
PE/COFF header to enable it, and so any BTI opcodes we emit without
that will never take effect in practice.

Fangrui Song

unread,

Jun 24, 2020, 12:16:47 PM6/24/20

to Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

On 2020-06-24, Arvind Sankar wrote:
>On Tue, Jun 23, 2020 at 06:49:33PM -0700, Kees Cook wrote:
>> When linking vmlinux with LLD, the synthetic sections .symtab, .strtab,
>> and .shstrtab are listed as orphaned. Add them to the STABS_DEBUG section
>> so there will be no warnings when --orphan-handling=warn is used more
>> widely. (They are added above comment as it is the more common
>
>Nit 1: is "after .comment" better than "above comment"? It's above in the
>sense of higher file offset, but it's below in readelf output.

I mean this order:)

.comment
.symtab
.shstrtab
.strtab

This is the case in the absence of a linker script if at least one object file has .comment (mostly for GCC/clang version information) or the linker is LLD which adds a .comment

>Nit 2: These aren't actually debugging sections, no? Is it better to add
>a new macro for it, and is there any plan to stop LLD from warning about
>them?

https://reviews.llvm.org/D75149 "[ELF] --orphan-handling=: don't warn/error for unused synthesized sections"
described that .symtab .shstrtab .strtab are different in GNU ld.
Since many other GNU ld synthesized sections (.rela.dyn .plt ...) can be renamed or dropped
via output section descriptions, I don't understand why the 3 sections
can't be customized.

I created a feature request: https://sourceware.org/bugzilla/show_bug.cgi?id=26168
(If this is supported, it is a consistent behavior to warn for orphan
.symtab/.strtab/.shstrtab

There may be 50% chance that the maintainer decides that "LLD diverges"
I would disagree: there is no fundamental problems with .symtab/.strtab/.shstrtab which make them special in output section descriptions or orphan handling.)

Dave Martin

unread,

Jun 24, 2020, 12:27:03 PM6/24/20

to Will Deacon, Mark Rutland, linux-efi, Catalin Marinas, Arvind Sankar, Thomas Gleixner, linux-arch, Fangrui Song, Masahiro Yamada, X86 ML, Russell King, Ard Biesheuvel, clang-built-linux, Ingo Molnar, Borislav Petkov, Kees Cook, Arnd Bergmann, Nathan Chancellor, Peter Collingbourne, Linux ARM, Nick Desaulniers, Linux Kernel Mailing List, James Morse

What compiler and flags are you using for the affected object? I don't
see this with gcc so far.

I wonder if this is a hole in the specs: the property could logically
be emitted in any codeless object, since turning on BTI will obviously
not break that object.

For different linkers and compilers to interoperate though, the specs
would need to say what to do in that situation.

Cheers
---Dave

>
> Will
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-ar...@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Dave Martin

unread,

Jun 24, 2020, 12:29:25 PM6/24/20

to Ard Biesheuvel, Kees Cook, Mark Rutland, linux-arch, linux-efi, Arnd Bergmann, Fangrui Song, Peter Collingbourne, Catalin Marinas, Masahiro Yamada, X86 ML, Nick Desaulniers, Russell King, Linux Kernel Mailing List, clang-built-linux, Arvind Sankar, Ingo Molnar, James Morse, Thomas Gleixner, Borislav Petkov, Will Deacon, Nathan Chancellor, Linux ARM

In the meantime, it is possible to build all the in-tree parts of EFI
for BTI, and just turn it off for out-of-tree EFI binaries?

If there's no easy way to do this though, I guess we should wait for /
push for a PE/COFF flag to describe this properly.

Cheers
---Dave

Ard Biesheuvel

unread,

Jun 24, 2020, 12:41:01 PM6/24/20

to Dave Martin, Kees Cook, Mark Rutland, linux-arch, linux-efi, Arnd Bergmann, Fangrui Song, Peter Collingbourne, Catalin Marinas, Masahiro Yamada, X86 ML, Nick Desaulniers, Russell King, Linux Kernel Mailing List, clang-built-linux, Arvind Sankar, Ingo Molnar, James Morse, Thomas Gleixner, Borislav Petkov, Will Deacon, Nathan Chancellor, Linux ARM

Not sure I understand the question. What do you mean by out-of-tree
EFI binaries? And how would the firmware (which is out of tree itself,
and is in charge of the page tables, vector table, timer interrupt etc
when the EFI stub executes) distinguish such binaries from the EFI
stub?

> If there's no easy way to do this though, I guess we should wait for /
> push for a PE/COFF flag to describe this properly.
>

Yeah good point. I will take this to the forum.

Arvind Sankar

unread,

Jun 24, 2020, 1:11:25 PM6/24/20

to Fangrui Song, Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

On Wed, Jun 24, 2020 at 09:16:43AM -0700, Fangrui Song wrote:
>
> On 2020-06-24, Arvind Sankar wrote:
> >On Tue, Jun 23, 2020 at 06:49:33PM -0700, Kees Cook wrote:
> >> When linking vmlinux with LLD, the synthetic sections .symtab, .strtab,
> >> and .shstrtab are listed as orphaned. Add them to the STABS_DEBUG section
> >> so there will be no warnings when --orphan-handling=warn is used more
> >> widely. (They are added above comment as it is the more common
> >
> >Nit 1: is "after .comment" better than "above comment"? It's above in the
> >sense of higher file offset, but it's below in readelf output.
>
> I mean this order:)
>
> .comment
> .symtab
> .shstrtab
> .strtab
>
> This is the case in the absence of a linker script if at least one object file has .comment (mostly for GCC/clang version information) or the linker is LLD which adds a .comment
>
> >Nit 2: These aren't actually debugging sections, no? Is it better to add
> >a new macro for it, and is there any plan to stop LLD from warning about
> >them?
>
> https://reviews.llvm.org/D75149 "[ELF] --orphan-handling=: don't warn/error for unused synthesized sections"
> described that .symtab .shstrtab .strtab are different in GNU ld.
> Since many other GNU ld synthesized sections (.rela.dyn .plt ...) can be renamed or dropped
> via output section descriptions, I don't understand why the 3 sections
> can't be customized.

So IIUC, lld will now warn about .rela.dyn etc only if they're non-empty?

>
> I created a feature request: https://sourceware.org/bugzilla/show_bug.cgi?id=26168
> (If this is supported, it is a consistent behavior to warn for orphan
> .symtab/.strtab/.shstrtab
>
> There may be 50% chance that the maintainer decides that "LLD diverges"
> I would disagree: there is no fundamental problems with .symtab/.strtab/.shstrtab which make them special in output section descriptions or orphan handling.)
>

.shstrtab is a little special in that it can't be discarded if the ELF
file contains any sections at all. But yeah, there's no reason they
can't be renamed or placed in a custom location in the file.

Dave Martin

unread,

Jun 24, 2020, 1:16:20 PM6/24/20

to Ard Biesheuvel, Mark Rutland, linux-efi, Catalin Marinas, Arvind Sankar, Will Deacon, Nathan Chancellor, linux-arch, Fangrui Song, Masahiro Yamada, X86 ML, Russell King, clang-built-linux, Ingo Molnar, Borislav Petkov, Kees Cook, Arnd Bergmann, Thomas Gleixner, Peter Collingbourne, Linux ARM, Nick Desaulniers, Linux Kernel Mailing List, James Morse

I'm not an EFI expert, but I'm guessing that you configure EFI with
certain compiler flags and build it. Possibly some standalone EFI
executables are built out of the same tree and shipped with the
firmware from the same build, but I'm speculating. If not, we can just
run all EFI executables with BTI off.

> > If there's no easy way to do this though, I guess we should wait for /
> > push for a PE/COFF flag to describe this properly.
> >
>
> Yeah good point. I will take this to the forum.

In the interim, we could set the GP bit in EFI's page tables for the
executable code from the firmware image if we want this protection, but
turn it off in pages mapping the executable code of EFI executables.
This is better than nothing.

Cheers
---Dave

Fangrui Song

unread,

Jun 24, 2020, 1:26:25 PM6/24/20

to Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

HEAD and future 11.0.0 will not warn about unused synthesized sections
like .rela.dyn

For most synthesized sections, empty = unused.

>>
>> I created a feature request: https://sourceware.org/bugzilla/show_bug.cgi?id=26168
>> (If this is supported, it is a consistent behavior to warn for orphan
>> .symtab/.strtab/.shstrtab
>>
>> There may be 50% chance that the maintainer decides that "LLD diverges"
>> I would disagree: there is no fundamental problems with .symtab/.strtab/.shstrtab which make them special in output section descriptions or orphan handling.)
>>
>
>.shstrtab is a little special in that it can't be discarded if the ELF
>file contains any sections at all. But yeah, there's no reason they
>can't be renamed or placed in a custom location in the file.

https://sourceware.org/pipermail/binutils/2020-March/000179.html
proposes -z nosectionheader. With this option, I believe .shstrtab is
not needed. /DISCARD/ : { *(.shstrtab) } should achieve a similar effect.

Arvind Sankar

unread,

Jun 24, 2020, 1:35:13 PM6/24/20

to Fangrui Song, Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

oh wow.

Ard Biesheuvel

unread,

Jun 24, 2020, 2:23:18 PM6/24/20

to Dave Martin, Mark Rutland, linux-efi, Catalin Marinas, Arvind Sankar, Will Deacon, Nathan Chancellor, linux-arch, Fangrui Song, Masahiro Yamada, X86 ML, Russell King, clang-built-linux, Ingo Molnar, Borislav Petkov, Kees Cook, Arnd Bergmann, Thomas Gleixner, Peter Collingbourne, Linux ARM, Nick Desaulniers, Linux Kernel Mailing List, James Morse

'EFI' is not something you build. It is a specification that describes
how a conformant firmware implementation interfaces with a conformant
OS.

Sorry to be pedantic, but that is really quite relevant. By adhering
to the EFI spec rigorously, we no longer have to care about who
implements the opposite side, and how.

So yes, of course there are ways to build the opposite side with BTI
enabled, in a way that all its constituent pieces keep working as
expected. A typical EDK2 based implementation of EFI consists of
50-100 individual PE/COFF executables that all get loaded, relocated
and started like ordinary user space programs.

What we cannot do, though, is invent our own Linux specific way of
decorating the kernel's PE/COFF header with an annotation that
instructs a Linux specific EFI loader when to enable the GP bit for
the .text pages.

> Possibly some standalone EFI
> executables are built out of the same tree and shipped with the
> firmware from the same build, but I'm speculating. If not, we can just
> run all EFI executables with BTI off.
>
> > > If there's no easy way to do this though, I guess we should wait for /
> > > push for a PE/COFF flag to describe this properly.
> > >
> >
> > Yeah good point. I will take this to the forum.
>
> In the interim, we could set the GP bit in EFI's page tables for the
> executable code from the firmware image if we want this protection, but
> turn it off in pages mapping the executable code of EFI executables.
> This is better than nothing.
>

We need to distinguish between the EFI stub and the EFI runtime services here.

The EFI stub consists of kernel code that executes in the context of
the firmware, at which point the loader has no control whatsoever over
page tables, vector tables, etc. This is the stage where the loading
and starting of PE/COFF images takes place. If we want to enable BTI
for code running in this context, we need PE/COFF annotations, as
discussed above.

The EFI runtime services are firmware code that gets invoked by the OS
at runtime. Whether or not such code is emitted with BTI annotations
is a separate matter (but should also be taken to the forum
nonetheless), and does not need any changes at the PE/COFF level.
However, for this code, I'd like the sandboxing to be much more
rigorous than it is today, to the point where the security it provides
doesn't even matter deeply to the OS itself. (I had some patches a
while ago that reused the KPTI infrastructure to unmap the entire
kernel while EFI runtime services are in progress. There was also an
intern in the team that implemented something similar on top of KVM)

kernel test robot

unread,

Jun 24, 2020, 2:37:09 PM6/24/20

to Kees Cook, kbuil...@lists.01.org, clang-bu...@googlegroups.com

Hi Kees,

I love your patch! Perhaps something to improve:

[auto build test WARNING on linus/master]
[also build test WARNING on v5.8-rc2 next-20200624]
[cannot apply to arm64/for-next/core tip/x86/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use as documented in
https://git-scm.com/docs/git-format-patch]

url: https://github.com/0day-ci/linux/commits/Kees-Cook/Warn-on-orphan-section-placement/20200624-095336
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3e08a95294a4fb3702bb3d35ed08028433c37fe6
config: x86_64-randconfig-a012-20200624 (attached as .config)
compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project 1d4c87335d5236ea1f35937e1014980ba961ae34)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install x86_64 cross compiling tool for clang build
# apt-get install binutils-x86-64-linux-gnu
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <l...@intel.com>

All warnings (new ones prefixed by >>):

ld.lld: warning: drivers/built-in.a(mfd/mt6397-irq.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(mfd/mt6358-irq.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(mfd/intel_soc_pmic_mrfld.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dax/super.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dax/bus.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dax/device.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-buf.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-fence.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-fence-array.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-fence-chain.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-resv.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/seqno-fence.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/udmabuf.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-ioctls.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-io.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-iops.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-lib.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-probe.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-taskfile.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-pm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-park.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-sysfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-devsets.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-io-std.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-eh.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-pio-blacklist.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-xfer-mode.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-timings.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-atapi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-proc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-acpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/cmd640.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-pnp.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-gd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-tape.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide_platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/hosts.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_ioctl.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsicam.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_error.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_lib.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/constants.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_lib_dma.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_scan.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_sysfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_devinfo.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_sysctl.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_proc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_logging.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_pm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_common.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/raid_class.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_transport_sas.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sd_dif.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sd_zbc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sg.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/ch.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/ses.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/configfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/admin-cmd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/fabrics-cmd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/discovery.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/io-cmd-file.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/io-cmd-bdev.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-scsi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-eh.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-transport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-sata.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-acpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-pata-timings.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/ahci_platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libahci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libahci_platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_configfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_device.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_fabric_configfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_fabric_lib.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_hba.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_pr.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_alua.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_tmr.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_tpg.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_transport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_sbc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_spc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_ua.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_rd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_stat.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_xcopy.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_iblock.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_pscsi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/loopback/tcm_loop.o):(.init_array.0) is being placed in '.init_array.0'
>> ld.lld: warning: drivers/built-in.a(target/sbp/sbp_target.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(spmi/spmi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(hsi/hsi_core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(hsi/hsi_boardinfo.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(hsi/clients/hsi_char.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/messaging.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/sched.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/stream.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/Space.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/loopback.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_main.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_hw.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_ethtool.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_param.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-card.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-cdev.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-device.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-iso.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-topology.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-transaction.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/sbp2.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/common.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/debug.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/usb-conn-gpio.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/usb-otg-fsm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/ulpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/usb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/hub.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/urb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/message.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/driver.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/config.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/file.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/buffer.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/sysfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/endpoint.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/devio.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/notify.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/generic.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/quirks.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/devices.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/phy.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/port.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/hcd-pci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/usb-acpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/ledtrig-usbport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy-generic.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy-gpio-vbus-usb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy-isp1301.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/host.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/debugfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/dwc3-pci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/dwc3-haps.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/isp1760/isp1760-core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/isp1760/isp1760-if.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/isp1760/isp1760-hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/drd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/host.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/cdns3-pci-wrap.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_main.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_stat.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_text.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_bin.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/pci-quirks.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/ohci-hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/ohci-pci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/ohci-platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/r8a66597-hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/class/cdc-acm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/class/usblp.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/uas.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/scsiglue.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/protocol.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/transport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/usb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/initializers.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/sierra_ms.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/option_ms.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/usual-tables.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/cypress_atacb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/datafab.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/ene_ub6250.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/freecom.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/isd200.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/onetouch.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/sddr09.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/shuttle_usbat.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/image/mdc800.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/image/microtek.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/usb-serial.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/generic.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/bus.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/console.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/ch341.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/cp210x.o):(.init_array.0) is being placed in '.init_array.0'
--
ld.lld: warning: drivers/built-in.a(mfd/mt6397-irq.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(mfd/mt6358-irq.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(mfd/intel_soc_pmic_mrfld.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dax/super.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dax/bus.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dax/device.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-buf.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-fence.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-fence-array.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-fence-chain.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/dma-resv.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/seqno-fence.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(dma-buf/udmabuf.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-ioctls.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-io.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-iops.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-lib.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-probe.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-taskfile.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-pm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-park.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-sysfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-devsets.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-io-std.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-eh.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-pio-blacklist.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-xfer-mode.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-timings.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-atapi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-proc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-acpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/cmd640.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-pnp.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-gd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide-tape.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ide/ide_platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/hosts.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_ioctl.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsicam.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_error.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_lib.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/constants.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_lib_dma.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_scan.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_sysfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_devinfo.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_sysctl.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_proc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_logging.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_pm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_common.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/raid_class.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/scsi_transport_sas.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sd_dif.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sd_zbc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/sg.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/ch.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(scsi/ses.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/configfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/admin-cmd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/fabrics-cmd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/discovery.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/io-cmd-file.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/io-cmd-bdev.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(nvme/target/trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-scsi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-eh.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-transport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-sata.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-acpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libata-pata-timings.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/ahci_platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libahci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(ata/libahci_platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_configfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_device.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_fabric_configfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_fabric_lib.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_hba.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_pr.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_alua.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_tmr.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_tpg.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_transport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_sbc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_spc.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_ua.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_rd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_stat.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_xcopy.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_iblock.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/target_core_pscsi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(target/loopback/tcm_loop.o):(.init_array.0) is being placed in '.init_array.0'
>> ld.lld: warning: drivers/built-in.a(target/sbp/sbp_target.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(spmi/spmi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(hsi/hsi_core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(hsi/hsi_boardinfo.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(hsi/clients/hsi_char.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/messaging.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/sched.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(slimbus/stream.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/Space.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/loopback.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_main.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_hw.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_ethtool.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(net/ethernet/intel/e1000/e1000_param.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-card.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-cdev.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-device.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-iso.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-topology.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/core-transaction.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(firewire/sbp2.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/common.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/debug.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/usb-conn-gpio.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/usb-otg-fsm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/common/ulpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/usb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/hub.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/urb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/message.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/driver.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/config.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/file.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/buffer.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/sysfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/endpoint.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/devio.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/notify.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/generic.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/quirks.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/devices.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/phy.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/port.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/hcd-pci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/usb-acpi.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/core/ledtrig-usbport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy-generic.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy-gpio-vbus-usb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/phy/phy-isp1301.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/trace.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/host.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/debugfs.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/dwc3-pci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/dwc3/dwc3-haps.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/isp1760/isp1760-core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/isp1760/isp1760-if.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/isp1760/isp1760-hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/core.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/drd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/host.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/cdns3/cdns3-pci-wrap.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_main.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_stat.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_text.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/mon/mon_bin.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/pci-quirks.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/ohci-hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/ohci-pci.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/ohci-platform.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/host/r8a66597-hcd.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/class/cdc-acm.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/class/usblp.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/uas.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/scsiglue.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/protocol.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/transport.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/usb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/initializers.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/sierra_ms.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/option_ms.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/usual-tables.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/cypress_atacb.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/datafab.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/ene_ub6250.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/freecom.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/isd200.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/onetouch.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/sddr09.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/storage/shuttle_usbat.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/image/mdc800.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/image/microtek.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/usb-serial.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/generic.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/bus.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/console.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/ch341.o):(.init_array.0) is being placed in '.init_array.0'
ld.lld: warning: drivers/built-in.a(usb/serial/cp210x.o):(.init_array.0) is being placed in '.init_array.0'
..

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuil...@lists.01.org

.config.gz

Ard Biesheuvel

unread,

Jun 24, 2020, 2:57:53 PM6/24/20

to Dave Martin, Mark Rutland, linux-efi, Catalin Marinas, Arvind Sankar, Will Deacon, Nathan Chancellor, linux-arch, Fangrui Song, Masahiro Yamada, X86 ML, Russell King, clang-built-linux, Ingo Molnar, Borislav Petkov, Kees Cook, Arnd Bergmann, Thomas Gleixner, Peter Collingbourne, Linux ARM, Nick Desaulniers, Linux Kernel Mailing List, James Morse

... the security *bti* provides ...

Kees Cook

unread,

Jun 27, 2020, 11:44:11 AM6/27/20

to kernel test robot, kbuil...@lists.01.org, clang-bu...@googlegroups.com, linux-...@vger.kernel.org, Marco Elver, Dmitry Vyukov, kasa...@googlegroups.com

On Thu, Jun 25, 2020 at 02:36:27AM +0800, kernel test robot wrote:
> I love your patch! Perhaps something to improve:

> [...]

> config: x86_64-randconfig-a012-20200624 (attached as .config)

CONFIG_KCSAN=y

> compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project 1d4c87335d5236ea1f35937e1014980ba961ae34)

> [...]

> All warnings (new ones prefixed by >>):
>
> ld.lld: warning: drivers/built-in.a(mfd/mt6397-irq.o):(.init_array.0) is being placed in '.init_array.0'

As far as I can tell, this is a Clang bug. But I don't know the
internals here, so I've opened:
https://bugs.llvm.org/show_bug.cgi?id=46478

and created a work-around patch for the kernel:

commit 915f2c343e59a14f00c68f4d7afcfdc621de0674
Author: Kees Cook <kees...@chromium.org>
Date: Sat Jun 27 08:07:54 2020 -0700

vmlinux.lds.h: Avoid KCSAN's unwanted sections

KCSAN (-fsanitize=thread) produces unwanted[1] .eh_frame and .init_array.*
sections. Add them to DISCARDS, except with CONFIG_CONSTRUCTORS, which
wants to keep .init_array.* sections.

[1] https://bugs.llvm.org/show_bug.cgi?id=46478

Signed-off-by: Kees Cook <kees...@chromium.org>

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index f8a5b2333729..41c8c73de6c4 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -195,7 +195,9 @@ endif
# Workaround for a gcc prelease that unfortunately was shipped in a suse release
KBUILD_CFLAGS += -Wno-sign-compare
#
-KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
+KBUILD_AFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+KBUILD_LDFLAGS += $(call ld-option,--no-ld-generated-unwind-info)

# Avoid indirect branches in kernel to deal with Spectre
ifdef CONFIG_RETPOLINE
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index b1dca0762fc5..a44ee16abc78 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -934,10 +934,28 @@
EXIT_DATA
#endif

+/*
+ * Clang's -fsanitize=thread produces unwanted sections (.eh_frame
+ * and .init_array.*), but CONFIG_CONSTRUCTORS wants to keep any
+ * .init_array.* sections.
+ * https://bugs.llvm.org/show_bug.cgi?id=46478
+ */
+#if defined(CONFIG_KCSAN) && !defined(CONFIG_CONSTRUCTORS)
+#define KCSAN_DISCARDS \
+ *(.init_array) *(.init_array.*) \
+ *(.eh_frame)
+#elif defined(CONFIG_KCSAN) && defined(CONFIG_CONSTRUCTORS)
+#define KCSAN_DISCARDS \
+ *(.eh_frame)
+#else
+#define KCSAN_DISCARDS
+#endif
+
#define DISCARDS \
/DISCARD/ : { \
EXIT_DISCARDS \
EXIT_CALL \
+ KCSAN_DISCARDS \
*(.discard) \
*(.discard.*) \
*(.modinfo) \

--
Kees Cook

Kees Cook

unread,

Jun 29, 2020, 2:18:46 AM6/29/20

to Will Deacon, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

For vmlinux linking, no architecture uses the .gnu.version* sections,
so remove it via the common DISCARDS macro in preparation for adding
--orphan-handling=warn more widely. This is a work-around for what
appears to be a bug[1] in ld.bfd which warns for this synthetic section
even when none is found in input objects, and even when no section is
emitted for an output object[2].

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=26153
[2] https://lore.kernel.org/lkml/202006221524.CEB86E036B@keescook/

Reviewed-by: Fangrui Song <mas...@google.com>
Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 2 ++
1 file changed, 2 insertions(+)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index db600ef218d7..1248a206be8d 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -934,6 +934,8 @@
*(.discard) \
*(.discard.*) \
*(.modinfo) \
+ /* ld.bfd warns about .gnu.version* even when not emitted */ \
+ *(.gnu.version*) \
}

/**
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:47 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

v4:
- explicitly add .ARM.attributes
- split up arm64 changes into separate patches
- split up arm changes into separate patches
- work around Clang section generation bug in -mbranch-protection
- work around Clang section generation bug in KASAN and KCSAN
- split "common" ELF sections out of STABS_DEBUG
- changed relative position of .comment
- add reviews/acks
v3: https://lore.kernel.org/lkml/20200624014940.1...@chromium.org/
v2: https://lore.kernel.org/lkml/20200622205815.2...@chromium.org/
v1: https://lore.kernel.org/lkml/20200228002244....@chromium.org/

A recent bug[1] was solved for builds linked with ld.lld, and tracking
it down took way longer than it needed to (a year). Ultimately, it
boiled down to differences between ld.bfd and ld.lld's handling of
orphan sections. Similarly, the recent FGKASLR series brough up orphan
section handling too[2]. In both cases, it would have been nice if the
linker was running with --orphan-handling=warn so that surprise sections
wouldn't silently get mapped into the kernel image at locations up to the
whim of the linker's orphan handling logic. Instead, all desired sections
should be explicitly identified in the linker script (to be either kept or
discarded) with any orphans throwing a warning. The powerpc architecture
actually already does this, so this series extends coverage to x86, arm,
and arm64.

All three architectures depend on the first four commits (to
vmlinux.lds.h), and arm64 depends on the 5th and 6th patches (to ctype,
and efi/libstub). As such, I'd like to land this series as a whole. Given
that two thirds of it is in the arm universe, perhaps this can land via
the arm64 tree? If x86 -tip is preferred, that works too. Or I could
just carry this myself in -next. In all cases, I would really appreciate
reviews/acks/etc. :)

Thanks!

-Kees

https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/warn/v4

Kees Cook (17):
vmlinux.lds.h: Add .gnu.version* to DISCARDS
vmlinux.lds.h: Avoid KASAN and KCSAN's unwanted sections
vmlinux.lds.h: Split ELF_DETAILS from STABS_DEBUG
vmlinux.lds.h: Add .symtab, .strtab, and .shstrtab to ELF_DETAILS
ctype: Work around Clang -mbranch-protection=none bug
efi/libstub: Disable -mbranch-protection
arm64/build: Use common DISCARDS in linker script
arm64/mm: Remove needless section quotes
arm64/build: Remove .eh_frame* sections due to unwind tables
arm64/kernel: Remove needless Call Frame Information annotations
arm64/build: Warn on orphan section placement
arm/build: Refactor linker script headers
arm/build: Explicitly keep .ARM.attributes sections
arm/build: Warn on orphan section placement
arm/boot: Warn on orphan section placement
x86/build: Warn on orphan section placement
x86/boot: Warn on orphan section placement

arch/alpha/kernel/vmlinux.lds.S | 1 +
arch/arc/kernel/vmlinux.lds.S | 1 +
arch/arm/boot/compressed/Makefile | 2 ++
arch/arm/boot/compressed/vmlinux.lds.S | 18 +++++-----
.../arm/{kernel => include/asm}/vmlinux.lds.h | 25 ++++++++++---
arch/arm/kernel/vmlinux-xip.lds.S | 6 ++--
arch/arm/kernel/vmlinux.lds.S | 6 ++--
arch/arm64/Makefile | 9 ++++-
arch/arm64/kernel/smccc-call.S | 2 --
arch/arm64/kernel/vmlinux.lds.S | 17 ++++++---
arch/arm64/mm/mmu.c | 2 +-
arch/csky/kernel/vmlinux.lds.S | 1 +
arch/hexagon/kernel/vmlinux.lds.S | 1 +
arch/ia64/kernel/vmlinux.lds.S | 1 +
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/nds32/kernel/vmlinux.lds.S | 1 +
arch/nios2/kernel/vmlinux.lds.S | 1 +
arch/openrisc/kernel/vmlinux.lds.S | 1 +
arch/parisc/boot/compressed/vmlinux.lds.S | 1 +
arch/parisc/kernel/vmlinux.lds.S | 1 +
arch/powerpc/kernel/vmlinux.lds.S | 2 +-
arch/riscv/kernel/vmlinux.lds.S | 1 +
arch/s390/kernel/vmlinux.lds.S | 1 +
arch/sh/kernel/vmlinux.lds.S | 1 +
arch/sparc/kernel/vmlinux.lds.S | 1 +
arch/um/kernel/dyn.lds.S | 2 +-
arch/um/kernel/uml.lds.S | 2 +-
arch/unicore32/kernel/vmlinux.lds.S | 1 +
arch/x86/Makefile | 8 ++++-
arch/x86/boot/compressed/Makefile | 3 +-
arch/x86/boot/compressed/vmlinux.lds.S | 12 +++++++
arch/x86/include/asm/asm.h | 6 +++-
arch/x86/kernel/vmlinux.lds.S | 7 ++++
drivers/firmware/efi/libstub/Makefile | 3 +-
include/asm-generic/vmlinux.lds.h | 35 +++++++++++++++++--
lib/ctype.c | 10 ++++++
36 files changed, 154 insertions(+), 39 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (88%)

--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:47 AM6/29/20

to Will Deacon, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

When linking vmlinux with LLD, the synthetic sections .symtab, .strtab,

and .shstrtab are listed as orphaned. Add them to the ELF_DETAILS section

so there will be no warnings when --orphan-handling=warn is used more
widely. (They are added above comment as it is the more common

order[1].)

ld.lld: warning: <internal>:(.symtab) is being placed in '.symtab'
ld.lld: warning: <internal>:(.shstrtab) is being placed in '.shstrtab'
ld.lld: warning: <internal>:(.strtab) is being placed in '.strtab'

[1] https://lore.kernel.org/lkml/20200622224928....@google.com/

Reported-by: Fangrui Song <mas...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index c5d10bc53996..9477359278a2 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -796,7 +796,10 @@

/* Required sections not related to debugging. */
#define ELF_DETAILS \

Kees Cook

unread,

Jun 29, 2020, 2:18:49 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

The .comment section doesn't belong in STABS_DEBUG. Split it out into a
new macro named ELF_DETAILS. This will gain other non-debug sections
that need to be accounted for when linking with --orphan-handling=warn.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/alpha/kernel/vmlinux.lds.S | 1 +
arch/arc/kernel/vmlinux.lds.S | 1 +

arch/arm/kernel/vmlinux-xip.lds.S | 1 +
arch/arm/kernel/vmlinux.lds.S | 1 +
arch/arm64/kernel/vmlinux.lds.S | 1 +

arch/x86/boot/compressed/vmlinux.lds.S | 2 ++
arch/x86/kernel/vmlinux.lds.S | 1 +
include/asm-generic/vmlinux.lds.h | 8 ++++++--
25 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/arch/alpha/kernel/vmlinux.lds.S b/arch/alpha/kernel/vmlinux.lds.S
index bc6f727278fd..5b78d640725d 100644
--- a/arch/alpha/kernel/vmlinux.lds.S
+++ b/arch/alpha/kernel/vmlinux.lds.S
@@ -72,6 +72,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
index 54139a6f469b..33ce59d91461 100644
--- a/arch/arc/kernel/vmlinux.lds.S
+++ b/arch/arc/kernel/vmlinux.lds.S
@@ -122,6 +122,7 @@ SECTIONS
_end = . ;

STABS_DEBUG
+ ELF_DETAILS
DISCARDS

.arcextmap 0 : {
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 6d2be994ae58..3d4e88f08196 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -152,6 +152,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ ELF_DETAILS
}

/*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 7f24bc08403e..5592f14b7e35 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -151,6 +151,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ ELF_DETAILS
}

#ifdef CONFIG_STRICT_KERNEL_RWX
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 6827da7f3aa5..55ae731b6368 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -245,6 +245,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ ELF_DETAILS

HEAD_SYMBOLS
}
diff --git a/arch/csky/kernel/vmlinux.lds.S b/arch/csky/kernel/vmlinux.lds.S
index f05b413df328..f03033e17c29 100644
--- a/arch/csky/kernel/vmlinux.lds.S
+++ b/arch/csky/kernel/vmlinux.lds.S
@@ -109,6 +109,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S
index 0ca2471ddb9f..35b18e55eae8 100644
--- a/arch/hexagon/kernel/vmlinux.lds.S
+++ b/arch/hexagon/kernel/vmlinux.lds.S
@@ -67,5 +67,6 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

}
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index d259690eb91a..9b265783be6a 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -218,6 +218,7 @@ SECTIONS {

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* Default discards */
DISCARDS
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index f185a85a27c1..5e97e9d02f98 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -202,6 +202,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* These must appear regardless of . */
.gptab.sdata : {
diff --git a/arch/nds32/kernel/vmlinux.lds.S b/arch/nds32/kernel/vmlinux.lds.S
index 7a6c1cefe3fe..6a91b965fb1e 100644
--- a/arch/nds32/kernel/vmlinux.lds.S
+++ b/arch/nds32/kernel/vmlinux.lds.S
@@ -64,6 +64,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/nios2/kernel/vmlinux.lds.S b/arch/nios2/kernel/vmlinux.lds.S
index c55a7cfa1075..126e114744cb 100644
--- a/arch/nios2/kernel/vmlinux.lds.S
+++ b/arch/nios2/kernel/vmlinux.lds.S
@@ -58,6 +58,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/openrisc/kernel/vmlinux.lds.S b/arch/openrisc/kernel/vmlinux.lds.S
index 60449fd7f16f..d287dbb84d0f 100644
--- a/arch/openrisc/kernel/vmlinux.lds.S
+++ b/arch/openrisc/kernel/vmlinux.lds.S
@@ -115,6 +115,7 @@ SECTIONS
/* Throw in the debugging sections */
STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* Sections to be discarded -- must be last */
DISCARDS
diff --git a/arch/parisc/boot/compressed/vmlinux.lds.S b/arch/parisc/boot/compressed/vmlinux.lds.S
index 2ac3a643f2eb..ab7b43990857 100644
--- a/arch/parisc/boot/compressed/vmlinux.lds.S
+++ b/arch/parisc/boot/compressed/vmlinux.lds.S
@@ -84,6 +84,7 @@ SECTIONS
}

STABS_DEBUG
+ ELF_DETAILS
.note 0 : { *(.note) }

/* Sections to be discarded */
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 53e29d88f99c..2769eb991f58 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -164,6 +164,7 @@ SECTIONS
_end = . ;

STABS_DEBUG
+ ELF_DETAILS
.note 0 : { *(.note) }

/* Sections to be discarded */
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 326e113d2e45..e0548b4950de 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -360,8 +360,8 @@ SECTIONS
PROVIDE32 (end = .);

STABS_DEBUG
-
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
/DISCARD/ : {
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index e6f8016b366a..00a325289a26 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -97,6 +97,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 37695499717d..177ccfbda40a 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -181,6 +181,7 @@ SECTIONS
/* Debugging sections. */
STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* Sections to be discarded */
DISCARDS
diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
index bde7a6c01aaf..3161b9ccd2a5 100644
--- a/arch/sh/kernel/vmlinux.lds.S
+++ b/arch/sh/kernel/vmlinux.lds.S
@@ -76,6 +76,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index f99e99e58075..d55ae65a07ad 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -187,6 +187,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S
index f5001481010c..dacbfabf66d8 100644
--- a/arch/um/kernel/dyn.lds.S
+++ b/arch/um/kernel/dyn.lds.S
@@ -164,8 +164,8 @@ SECTIONS
PROVIDE (end = .);

STABS_DEBUG
-
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
index 3b6dab3d4501..45d957d7004c 100644
--- a/arch/um/kernel/uml.lds.S
+++ b/arch/um/kernel/uml.lds.S
@@ -108,8 +108,8 @@ SECTIONS
PROVIDE (end = .);

STABS_DEBUG
-
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/unicore32/kernel/vmlinux.lds.S b/arch/unicore32/kernel/vmlinux.lds.S
index 6fb320b337ef..22eb642c7280 100644
--- a/arch/unicore32/kernel/vmlinux.lds.S
+++ b/arch/unicore32/kernel/vmlinux.lds.S
@@ -54,6 +54,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS /* Exit code and data */
}
diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S
index 8f1025d1f681..d88612e3091f 100644
--- a/arch/x86/boot/compressed/vmlinux.lds.S
+++ b/arch/x86/boot/compressed/vmlinux.lds.S
@@ -75,5 +75,7 @@ SECTIONS
. = ALIGN(PAGE_SIZE); /* keep ZO size page aligned */
_end = .;

+ ELF_DETAILS
+
DISCARDS
}
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 3bfc8dd8a43d..504d16968ed8 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -410,6 +410,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index e53a2d4f47f6..c5d10bc53996 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -34,6 +34,7 @@
*
* STABS_DEBUG
* DWARF_DEBUG
+ * ELF_DETAILS
*
* DISCARDS // must be the last
* }
@@ -784,14 +785,17 @@
.debug_macro 0 : { *(.debug_macro) } \
.debug_addr 0 : { *(.debug_addr) }

- /* Stabs debugging sections. */
+/* Stabs debugging sections. */
#define STABS_DEBUG \
.stab 0 : { *(.stab) } \
.stabstr 0 : { *(.stabstr) } \
.stab.excl 0 : { *(.stab.excl) } \

.stab.exclstr 0 : { *(.stab.exclstr) } \
.stab.index 0 : { *(.stab.index) } \

- .stab.indexstr 0 : { *(.stab.indexstr) } \
+ .stab.indexstr 0 : { *(.stab.indexstr) }
+
+/* Required sections not related to debugging. */
+#define ELF_DETAILS \
.comment 0 : { *(.comment) }

#ifdef CONFIG_GENERIC_BUG
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:50 AM6/29/20

to Will Deacon, Kees Cook, Ard Biesheuvel, Dave Martin, clang-bu...@googlegroups.com, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for building efi/libstub with -mbranch-protection=none
(EFI does not support branch protection features[1]), add no-op code
to work around a Clang bug that emits an unwanted .note.gnu.property
section for object files without code[2].

[1] https://lore.kernel.org/lkml/CAMj1kXHck12juGi=E=P4hWP_8vQhQ+-x3v...@mail.gmail.com
[2] https://bugs.llvm.org/show_bug.cgi?id=46480

Cc: Ard Biesheuvel <ar...@kernel.org>
Cc: Will Deacon <wi...@kernel.org>
Cc: Dave Martin <Dave....@arm.com>
Cc: clang-bu...@googlegroups.com

Signed-off-by: Kees Cook <kees...@chromium.org>
---

lib/ctype.c | 10 ++++++++++
1 file changed, 10 insertions(+)

diff --git a/lib/ctype.c b/lib/ctype.c
index c819fe269eb2..21245ed57d90 100644
--- a/lib/ctype.c
+++ b/lib/ctype.c
@@ -36,3 +36,13 @@ _L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L, /* 224-239 */
_L,_L,_L,_L,_L,_L,_L,_P,_L,_L,_L,_L,_L,_L,_L,_L}; /* 240-255 */

EXPORT_SYMBOL(_ctype);
+
+/*
+ * Clang will generate .note.gnu.property sections for object files
+ * without code, even in the presence of -mbranch-protection=none.
+ * To work around this, define an unused static function.
+ * https://bugs.llvm.org/show_bug.cgi?id=46480
+ */
+#ifdef CONFIG_CC_IS_CLANG
+void __maybe_unused __clang_needs_code_here(void) { }
+#endif
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:50 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Use the common DISCARDS rule for the linker script in an effort to
regularize the linker script to prepare for warning on orphaned
sections. Additionally clean up left-over no-op macros.

Signed-off-by: Kees Cook <kees...@chromium.org>
Acked-by: Will Deacon <wi...@kernel.org>
---
arch/arm64/kernel/vmlinux.lds.S | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 55ae731b6368..b5a94ec1eada 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -6,6 +6,7 @@
*/

#define RO_EXCEPTION_TABLE_ALIGN 8
+#define RUNTIME_DISCARD_EXIT

#include <asm-generic/vmlinux.lds.h>
#include <asm/cache.h>
@@ -89,10 +90,8 @@ SECTIONS
* matching the same input section name. There is no documented
* order of matching.
*/
+ DISCARDS
/DISCARD/ : {
- EXIT_CALL
- *(.discard)
- *(.discard.*)
*(.interp .dynamic)
*(.dynsym .dynstr .hash .gnu.hash)
*(.eh_frame)
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:50 AM6/29/20

to Will Deacon, Kees Cook, Ard Biesheuvel, Arvind Sankar, Atish Patra, linu...@vger.kernel.org, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn to more architectures,
this disables -mbranch-protection, as EFI does not yet support it[1].
This was noticed due to it producing unwanted .note.gnu.property sections
(prefixed with .init due to the objcopy build step).

[1] https://lore.kernel.org/lkml/CAMj1kXHck12juGi=E=P4hWP_8vQhQ+-x3v...@mail.gmail.com

Cc: Ard Biesheuvel <ar...@kernel.org>
Cc: Arvind Sankar <nive...@alum.mit.edu>
Cc: Atish Patra <atish...@wdc.com>
Cc: linu...@vger.kernel.org

Signed-off-by: Kees Cook <kees...@chromium.org>
---

drivers/firmware/efi/libstub/Makefile | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 75daaf20374e..10fa342ef40c 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -18,7 +18,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \
# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
# disable the stackleak plugin
cflags-$(CONFIG_ARM64) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
- -fpie $(DISABLE_STACKLEAK_PLUGIN)
+ -fpie $(DISABLE_STACKLEAK_PLUGIN) \
+ $(call cc-option,-mbranch-protection=none)
cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
-fno-builtin -fpic \
$(call cc-option,-mno-single-pic-base)
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:51 AM6/29/20

to Will Deacon, Kees Cook, Ard Biesheuvel, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Remove last instance of an .eh_frame section by removing the needless Call
Frame Information annotations which were likely leftovers from 32-bit arm.

Suggested-by: Ard Biesheuvel <ar...@kernel.org>
Acked-by: Will Deacon <wi...@kernel.org>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/kernel/smccc-call.S | 2 --
1 file changed, 2 deletions(-)

diff --git a/arch/arm64/kernel/smccc-call.S b/arch/arm64/kernel/smccc-call.S
index 1f93809528a4..d62447964ed9 100644
--- a/arch/arm64/kernel/smccc-call.S
+++ b/arch/arm64/kernel/smccc-call.S
@@ -9,7 +9,6 @@
#include <asm/assembler.h>

.macro SMCCC instr
- .cfi_startproc
\instr #0
ldr x4, [sp]
stp x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS]
@@ -21,7 +20,6 @@
b.ne 1f
str x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS]
1: ret
- .cfi_endproc
.endm

/*
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:51 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Fix a case of needless quotes in __section(), which Clang doesn't like.

Acked-by: Will Deacon <wi...@kernel.org>
Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/mm/mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 1df25f26571d..dce024ea6084 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -42,7 +42,7 @@
u64 idmap_t0sz = TCR_T0SZ(VA_BITS);
u64 idmap_ptrs_per_pgd = PTRS_PER_PGD;

-u64 __section(".mmuoff.data.write") vabits_actual;
+u64 __section(.mmuoff.data.write) vabits_actual;
EXPORT_SYMBOL(vabits_actual);

u64 kimage_voffset __ro_after_init;
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:53 AM6/29/20

to Will Deacon, Kees Cook, Ard Biesheuvel, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Avoid .eh_frame* section generation by making sure both CFLAGS and AFLAGS
contain -fno-asychronous-unwind-tables and -fno-unwind-tables.

Suggested-by: Ard Biesheuvel <ar...@kernel.org>

Acked-by: Will Deacon <wi...@kernel.org>
Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/Makefile | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index a0d94d063fa8..895486606f74 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -47,13 +47,16 @@ endif

KBUILD_CFLAGS += -mgeneral-regs-only \
$(compat_vdso) $(cc_has_k_constraint)
-KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
KBUILD_CFLAGS += $(call cc-disable-warning, psabi)
KBUILD_AFLAGS += $(compat_vdso)

KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
KBUILD_AFLAGS += $(call cc-option,-mabi=lp64)

+# Avoid generating .eh_frame* sections.
+KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+KBUILD_AFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+
ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y)
prepare: stack_protector_prepare
stack_protector_prepare: prepare0
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:53 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Remove .eh_frame, since there are none left.

Add .plt, .data.rel.ro, .igot.*, and .iplt to discards as they are not
actually used. While .got.plt is also not used, it must be included
otherwise ld.bfd will fail to link with the error:

aarch64-linux-gnu-ld: discarded output section: `.got.plt'

However, as it'd be better to validate that it stays effectively empty,
add an assert, as suggested by Ard Biesheuvel.

Explicitly include debug sections when they're present.

Finally, enable orphan section warnings.

Acked-by: Will Deacon <wi...@kernel.org>
Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/Makefile | 4 ++++
arch/arm64/kernel/vmlinux.lds.S | 11 ++++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 895486606f74..fb3aa2d7de4d 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -29,6 +29,10 @@ LDFLAGS_vmlinux += --fix-cortex-a53-843419
endif
endif

+# We never want expected sections to be placed heuristically by the
+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+
ifeq ($(CONFIG_ARM64_USE_LSE_ATOMICS), y)
ifneq ($(CONFIG_ARM64_LSE_ATOMICS), y)
$(warning LSE atomics not supported by binutils)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index b5a94ec1eada..320ba5ec2adc 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -94,7 +94,8 @@ SECTIONS
/DISCARD/ : {

*(.interp .dynamic)
*(.dynsym .dynstr .hash .gnu.hash)

- *(.eh_frame)
+ *(.plt) *(.data.rel.ro)
+ *(.igot.*) *(.iplt)
}

. = KIMAGE_VADDR + TEXT_OFFSET;
@@ -244,9 +245,17 @@ SECTIONS
_end = .;

STABS_DEBUG
+ DWARF_DEBUG
ELF_DETAILS

HEAD_SYMBOLS
+
+ /*
+ * Make sure that the .got.plt is either completely empty or it
+ * contains only the lazy dispatch entries.
+ */
+ .got.plt (INFO) : { *(.got.plt) }
+ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, ".got.plt not empty")
}

#include "image-vars.h"
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:54 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn, refactor the linker
script header includes, and extract common macros. (The ARM_COMMON_DISCARD
macro will be shared with the boot linker script in a future patch.)

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/{kernel => include/asm}/vmlinux.lds.h | 17 ++++++++++++-----
arch/arm/kernel/vmlinux-xip.lds.S | 4 +---
arch/arm/kernel/vmlinux.lds.S | 4 +---
3 files changed, 14 insertions(+), 11 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (95%)

diff --git a/arch/arm/kernel/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
similarity index 95%
rename from arch/arm/kernel/vmlinux.lds.h
rename to arch/arm/include/asm/vmlinux.lds.h
index 381a8e105fa5..142c038b2e97 100644
--- a/arch/arm/kernel/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -1,4 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0 */
+#include <asm-generic/vmlinux.lds.h>

#ifdef CONFIG_HOTPLUG_CPU
#define ARM_CPU_DISCARD(x)
@@ -37,6 +38,10 @@
*(.idmap.text) \
__idmap_text_end = .; \

+#define ARM_COMMON_DISCARD \
+ *(.discard) \
+ *(.discard.*)
+
#define ARM_DISCARD \
*(.ARM.exidx.exit.text) \
*(.ARM.extab.exit.text) \
@@ -49,8 +54,12 @@
EXIT_CALL \
ARM_MMU_DISCARD(*(.text.fixup)) \
ARM_MMU_DISCARD(*(__ex_table)) \
- *(.discard) \
- *(.discard.*)
+ ARM_COMMON_DISCARD
+
+#define ARM_STUBS_TEXT \
+ *(.gnu.warning) \
+ *(.glue_7) \
+ *(.glue_7t)

#define ARM_TEXT \
IDMAP_TEXT \
@@ -64,9 +73,7 @@
CPUIDLE_TEXT \
LOCK_TEXT \
KPROBES_TEXT \
- *(.gnu.warning) \
- *(.glue_7) \
- *(.glue_7t) \
+ ARM_STUBS_TEXT \
. = ALIGN(4); \
*(.got) /* Global offset table */ \
ARM_CPU_KEEP(PROC_INFO)
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 3d4e88f08196..904c31fa20ed 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -9,15 +9,13 @@

#include <linux/sizes.h>

-#include <asm-generic/vmlinux.lds.h>
+#include <asm/vmlinux.lds.h>
#include <asm/cache.h>
#include <asm/thread_info.h>
#include <asm/memory.h>
#include <asm/mpu.h>
#include <asm/page.h>

-#include "vmlinux.lds.h"
-
OUTPUT_ARCH(arm)
ENTRY(stext)

diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 5592f14b7e35..bb950c896a67 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -9,15 +9,13 @@
#else

#include <linux/pgtable.h>
-#include <asm-generic/vmlinux.lds.h>
+#include <asm/vmlinux.lds.h>
#include <asm/cache.h>
#include <asm/thread_info.h>
#include <asm/memory.h>
#include <asm/mpu.h>
#include <asm/page.h>

-#include "vmlinux.lds.h"
-
OUTPUT_ARCH(arm)
ENTRY(stext)

--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:55 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Specifically, this would have made a recently fixed bug very obvious:

ld: warning: orphan section `.fixup' from `arch/arm/lib/copy_from_user.o' being placed in section `.fixup'

Discard unneeded sections .iplt, .rel.iplt, .igot.plt, and .modinfo.

Add missing text stub sections .vfp11_veneer and .v4_bx.

Add debug sections explicitly.

Finally enable orphan section warning.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/include/asm/vmlinux.lds.h | 6 +++++-

arch/arm/kernel/vmlinux-xip.lds.S | 1 +
arch/arm/kernel/vmlinux.lds.S | 1 +

3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/arm/include/asm/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
index c66b16cd8837..d44fae722e7a 100644
--- a/arch/arm/include/asm/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -39,6 +39,8 @@
__idmap_text_end = .; \

#define ARM_COMMON_DISCARD \
+ *(.iplt) *(.rel.iplt) *(.igot.plt) \
+ *(.modinfo) \
*(.discard) \
*(.discard.*)

@@ -63,7 +65,9 @@
#define ARM_STUBS_TEXT \
*(.gnu.warning) \
*(.glue_7) \
- *(.glue_7t)
+ *(.glue_7t) \
+ *(.vfp11_veneer) \
+ *(.v4_bx)

#define ARM_TEXT \
IDMAP_TEXT \
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 57fcbf55f913..11ffa79751da 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -150,6 +150,7 @@ SECTIONS

_end = .;

STABS_DEBUG
+ DWARF_DEBUG

ARM_DETAILS
}

diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 1d3d3b599635..dc672fe35de3 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -149,6 +149,7 @@ SECTIONS

_end = .;

STABS_DEBUG
+ DWARF_DEBUG

ARM_DETAILS
}

--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:18:55 AM6/29/20

to Will Deacon, Kees Cook, Nick Desaulniers, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn, explicitly keep the
.ARM.attributes section by expanding the existing ELF_DETAILS macro into
ARM_DETAILS.

Suggested-by: Nick Desaulniers <ndesau...@google.com>
Link: https://lore.kernel.org/lkml/CAKwvOdk-racgq5pxsoGS6Vti...@mail.gmail.com/

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/include/asm/vmlinux.lds.h | 4 ++++
arch/arm/kernel/vmlinux-xip.lds.S | 2 +-
arch/arm/kernel/vmlinux.lds.S | 2 +-
3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm/include/asm/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
index 142c038b2e97..c66b16cd8837 100644
--- a/arch/arm/include/asm/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -56,6 +56,10 @@
ARM_MMU_DISCARD(*(__ex_table)) \
ARM_COMMON_DISCARD

+#define ARM_DETAILS \
+ ELF_DETAILS \
+ .ARM.attributes 0 : { *(.ARM.attributes) }
+
#define ARM_STUBS_TEXT \
*(.gnu.warning) \
*(.glue_7) \
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 904c31fa20ed..57fcbf55f913 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -150,7 +150,7 @@ SECTIONS
_end = .;

STABS_DEBUG
- ELF_DETAILS
+ ARM_DETAILS
}

/*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index bb950c896a67..1d3d3b599635 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -149,7 +149,7 @@ SECTIONS
_end = .;

STABS_DEBUG
- ELF_DETAILS
+ ARM_DETAILS
}

#ifdef CONFIG_STRICT_KERNEL_RWX
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:27:29 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Use common macros for debug sections, discards, and text stubs. Add
discards for unwanted .note, and .rel sections. Finally, enable orphan
section warning.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/boot/compressed/Makefile | 2 ++
arch/arm/boot/compressed/vmlinux.lds.S | 18 ++++++++----------
2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 00602a6fba04..b8a97d81662d 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -128,6 +128,8 @@ endif
LDFLAGS_vmlinux += --no-undefined
# Delete all temporary local symbols
LDFLAGS_vmlinux += -X
+# Report orphan sections
+LDFLAGS_vmlinux += --orphan-handling=warn
# Next argument is a linker script
LDFLAGS_vmlinux += -T

diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
index 09ac33f52814..636e9ceb79ec 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.S
+++ b/arch/arm/boot/compressed/vmlinux.lds.S
@@ -2,6 +2,7 @@
/*
* Copyright (C) 2000 Russell King
*/
+#include <asm/vmlinux.lds.h>

#ifdef CONFIG_CPU_ENDIAN_BE8
#define ZIMAGE_MAGIC(x) ( (((x) >> 24) & 0x000000ff) | \
@@ -17,8 +18,11 @@ ENTRY(_start)
SECTIONS
{
/DISCARD/ : {
+ ARM_COMMON_DISCARD
*(.ARM.exidx*)
*(.ARM.extab*)
+ *(.note.*)
+ *(.rel.*)
/*
* Discard any r/w data - this produces a link error if we have any,
* which is required for PIC decompression. Local data generates
@@ -36,9 +40,7 @@ SECTIONS
*(.start)
*(.text)
*(.text.*)
- *(.gnu.warning)
- *(.glue_7t)
- *(.glue_7)
+ ARM_STUBS_TEXT
}
.table : ALIGN(4) {
_table_start = .;
@@ -128,12 +130,8 @@ SECTIONS
PROVIDE(__pecoff_data_size = ALIGN(512) - ADDR(.data));
PROVIDE(__pecoff_end = ALIGN(512));

- .stab 0 : { *(.stab) }
- .stabstr 0 : { *(.stabstr) }
- .stab.excl 0 : { *(.stab.excl) }
- .stab.exclstr 0 : { *(.stab.exclstr) }
- .stab.index 0 : { *(.stab.index) }
- .stab.indexstr 0 : { *(.stab.indexstr) }
- .comment 0 : { *(.comment) }
+ STABS_DEBUG
+ DWARF_DEBUG
+ ARM_DETAILS
}
ASSERT(_edata_real == _edata, "error: zImage file size is incorrect");
--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:27:30 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Discards the unused rela, plt, and got sections that are not needed
in the final vmlinux, stop emitting kprobe sections without kprobes,
and enable orphan section warnings.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/Makefile | 4 ++++
arch/x86/include/asm/asm.h | 6 +++++-
arch/x86/kernel/vmlinux.lds.S | 6 ++++++
3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 00e378de8bc0..f8a5b2333729 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -51,6 +51,10 @@ ifdef CONFIG_X86_NEED_RELOCS
LDFLAGS_vmlinux := --emit-relocs --discard-none

endif

+# We never want expected sections to be placed heuristically by the

+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+
#
# Prevent GCC from generating any FP code by mistake.
#
diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index 0f63585edf5f..92feec0f0a12 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -138,11 +138,15 @@
# define _ASM_EXTABLE_FAULT(from, to) \
_ASM_EXTABLE_HANDLE(from, to, ex_handler_fault)

-# define _ASM_NOKPROBE(entry) \
+# ifdef CONFIG_KPROBES
+# define _ASM_NOKPROBE(entry) \
.pushsection "_kprobe_blacklist","aw" ; \
_ASM_ALIGN ; \
_ASM_PTR (entry); \
.popsection
+# else
+# define _ASM_NOKPROBE(entry)
+# endif

#else
# define _EXPAND_EXTABLE_HANDLE(x) #x
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 504d16968ed8..52e2b4952a0b 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -413,6 +413,12 @@ SECTIONS
ELF_DETAILS

DISCARDS
+ /DISCARD/ : {
+ *(.rela.*) *(.rela_*)
+ *(.rel.*) *(.rel_*)
+ *(.got) *(.got.*)
+ *(.igot.*) *(.iplt)
+ }
}

--
2.25.1

Kees Cook

unread,

Jun 29, 2020, 2:27:31 AM6/29/20

to Will Deacon, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly named in the linker
script.

Add the common debugging sections. Discard the unused note, rel, plt,
dyn, and hash sections that are not needed in the compressed vmlinux.
Disable .eh_frame generation in the linker and enable orphan section

warnings.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/boot/compressed/Makefile | 3 ++-
arch/x86/boot/compressed/vmlinux.lds.S | 10 ++++++++++
2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 7619742f91c9..646720a05f89 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -48,6 +48,7 @@ GCOV_PROFILE := n
UBSAN_SANITIZE :=n

KBUILD_LDFLAGS := -m elf_$(UTS_MACHINE)
+KBUILD_LDFLAGS += $(call ld-option,--no-ld-generated-unwind-info)
# Compressed kernel should be built as PIE since it may be loaded at any
# address by the bootloader.
ifeq ($(CONFIG_X86_32),y)
@@ -59,7 +60,7 @@ else
KBUILD_LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \
&& echo "-z noreloc-overflow -pie --no-dynamic-linker")
endif
-LDFLAGS_vmlinux := -T
+LDFLAGS_vmlinux := --orphan-handling=warn -T

hostprogs := mkpiggy
HOST_EXTRACFLAGS += -I$(srctree)/tools/include
diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S
index d88612e3091f..9afb8737896f 100644
--- a/arch/x86/boot/compressed/vmlinux.lds.S
+++ b/arch/x86/boot/compressed/vmlinux.lds.S
@@ -75,7 +75,17 @@ SECTIONS

. = ALIGN(PAGE_SIZE); /* keep ZO size page aligned */
_end = .;

+ STABS_DEBUG
+ DWARF_DEBUG
ELF_DETAILS

DISCARDS
+ /DISCARD/ : {
+ *(.note.*)

+ *(.rela.*) *(.rela_*)
+ *(.rel.*) *(.rel_*)

+ *(.plt) *(.plt.*)
+ *(.dyn*)
+ *(.hash) *(.gnu.hash)
+ }
}
--
2.25.1

Ard Biesheuvel

unread,

Jun 29, 2020, 4:16:01 AM6/29/20

to Kees Cook, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

I take it we don't need this horrible hack if we build the EFI stub
with branch protections and filter out the .note.gnu.property section
explicitly?

Sorry to backpedal, but that is probably a better approach after all,
given that the instructions don't hurt, and we will hopefully be able
to arm them once UEFI (as well as PE/COFF) gets around to describing
this in a way that both the firmware and the OS can consume.

Kees Cook

unread,

Jun 29, 2020, 10:43:39 AM6/29/20

to Ard Biesheuvel, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

Correct.

> Sorry to backpedal, but that is probably a better approach after all,
> given that the instructions don't hurt, and we will hopefully be able
> to arm them once UEFI (as well as PE/COFF) gets around to describing
> this in a way that both the firmware and the OS can consume.

Okay, will revert to the v3 solution.

--
Kees Cook

Marco Elver

unread,

Jun 29, 2020, 10:54:26 AM6/29/20

to Kees Cook, kernel test robot, kbuil...@lists.01.org, clang-built-linux, LKML, Dmitry Vyukov, kasan-dev

On Sat, 27 Jun 2020 at 17:44, Kees Cook <kees...@chromium.org> wrote:
>
> On Thu, Jun 25, 2020 at 02:36:27AM +0800, kernel test robot wrote:
> > I love your patch! Perhaps something to improve:
> > [...]
> > config: x86_64-randconfig-a012-20200624 (attached as .config)
>
> CONFIG_KCSAN=y
>
> > compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project 1d4c87335d5236ea1f35937e1014980ba961ae34)
> > [...]
> > All warnings (new ones prefixed by >>):
> >
> > ld.lld: warning: drivers/built-in.a(mfd/mt6397-irq.o):(.init_array.0) is being placed in '.init_array.0'
>
> As far as I can tell, this is a Clang bug. But I don't know the
> internals here, so I've opened:
> https://bugs.llvm.org/show_bug.cgi?id=46478
>
> and created a work-around patch for the kernel:

Thanks, minor comments below.

With KCSAN this is:

Tested-by: Marco Elver <el...@google.com>

> commit 915f2c343e59a14f00c68f4d7afcfdc621de0674
> Author: Kees Cook <kees...@chromium.org>
> Date: Sat Jun 27 08:07:54 2020 -0700
>
> vmlinux.lds.h: Avoid KCSAN's unwanted sections

Since you found that it's also KASAN, this probably wants updating.

> KCSAN (-fsanitize=thread) produces unwanted[1] .eh_frame and .init_array.*
> sections. Add them to DISCARDS, except with CONFIG_CONSTRUCTORS, which
> wants to keep .init_array.* sections.
>
> [1] https://bugs.llvm.org/show_bug.cgi?id=46478
>
> Signed-off-by: Kees Cook <kees...@chromium.org>
>
> diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> index f8a5b2333729..41c8c73de6c4 100644
> --- a/arch/x86/Makefile
> +++ b/arch/x86/Makefile
> @@ -195,7 +195,9 @@ endif
> # Workaround for a gcc prelease that unfortunately was shipped in a suse release
> KBUILD_CFLAGS += -Wno-sign-compare
> #
> -KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
> +KBUILD_AFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
> +KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
> +KBUILD_LDFLAGS += $(call ld-option,--no-ld-generated-unwind-info)

Why are they needed? They are not mentioned in the commit message.

> # Avoid indirect branches in kernel to deal with Spectre
> ifdef CONFIG_RETPOLINE
> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
> index b1dca0762fc5..a44ee16abc78 100644
> --- a/include/asm-generic/vmlinux.lds.h
> +++ b/include/asm-generic/vmlinux.lds.h
> @@ -934,10 +934,28 @@
> EXIT_DATA
> #endif
>
> +/*
> + * Clang's -fsanitize=thread produces unwanted sections (.eh_frame
> + * and .init_array.*), but CONFIG_CONSTRUCTORS wants to keep any
> + * .init_array.* sections.
> + * https://bugs.llvm.org/show_bug.cgi?id=46478
> + */
> +#if defined(CONFIG_KCSAN) && !defined(CONFIG_CONSTRUCTORS)

CONFIG_KASAN as well?

> +#define KCSAN_DISCARDS \
> + *(.init_array) *(.init_array.*) \
> + *(.eh_frame)
> +#elif defined(CONFIG_KCSAN) && defined(CONFIG_CONSTRUCTORS)
> +#define KCSAN_DISCARDS \
> + *(.eh_frame)
> +#else
> +#define KCSAN_DISCARDS
> +#endif
> +
> #define DISCARDS \
> /DISCARD/ : { \
> EXIT_DISCARDS \
> EXIT_CALL \
> + KCSAN_DISCARDS \

Maybe just 'SANITIZER_DISCARDS'?

Kees Cook

unread,

Jun 29, 2020, 11:06:23 AM6/29/20

to Ard Biesheuvel, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

On Mon, Jun 29, 2020 at 10:15:47AM +0200, Ard Biesheuvel wrote:

How does this look?

commit 051ef0b75a386c3fe2f216d16246468147a48c5b
Author: Kees Cook <kees...@chromium.org>
Date: Tue Jun 23 18:02:56 2020 -0700

efi/libstub: Disable -mbranch-protection

In preparation for adding --orphan-handling=warn to more architectures,

disable -mbranch-protection, as EFI does not yet support it[1]. This was

noticed due to it producing unwanted .note.gnu.property sections (prefixed
with .init due to the objcopy build step).

However, we must also work around a bug in Clang where the section is
still emitted for code-less object files[2], so also remove the section
during the objcopy.

[1] https://lore.kernel.org/lkml/CAMj1kXHck12juGi=E=P4hWP_8vQhQ+-x3v...@mail.gmail.com
[2] https://bugs.llvm.org/show_bug.cgi?id=46480

Cc: Ard Biesheuvel <ar...@kernel.org>

Cc: Arvind Sankar <nive...@alum.mit.edu>
Cc: Atish Patra <atish...@wdc.com>
Cc: linu...@vger.kernel.org

Signed-off-by: Kees Cook <kees...@chromium.org>

diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 75daaf20374e..f9f1922f8f28 100644

--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -18,7 +18,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \
# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
# disable the stackleak plugin
cflags-$(CONFIG_ARM64) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
- -fpie $(DISABLE_STACKLEAK_PLUGIN)
+ -fpie $(DISABLE_STACKLEAK_PLUGIN) \
+ $(call cc-option,-mbranch-protection=none)
cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
-fno-builtin -fpic \
$(call cc-option,-mno-single-pic-base)

@@ -66,6 +67,12 @@ lib-$(CONFIG_X86) += x86-stub.o
CFLAGS_arm32-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
CFLAGS_arm64-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)

+# Even when -mbranch-protection=none is set, Clang will generate a
+# .note.gnu.property for code-less object files (like lib/ctype.c),
+# so work around this by explicitly removing the unwanted section.
+# https://bugs.llvm.org/show_bug.cgi?id=46480
+STUBCOPY_FLAGS-y += --remove-section=.note.gnu.property
+
#
# For x86, bootloaders like systemd-boot or grub-efi do not zero-initialize the
# .bss section, so the .bss section of the EFI stub needs to be included in the

--
Kees Cook

Ard Biesheuvel

unread,

Jun 29, 2020, 11:08:17 AM6/29/20

to Kees Cook, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

Looks fine

Acked-by: Ard Biesheuvel <ar...@kernel.org>

if you want to keep it with the set, or I can take it as a EFI fix.

Kees Cook

unread,

Jun 29, 2020, 11:16:17 AM6/29/20

to Ard Biesheuvel, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List

Thanks!

> if you want to keep it with the set, or I can take it as a EFI fix.

My current plan is to just keep it all together.

--
Kees Cook

Kees Cook

unread,

Jun 29, 2020, 11:26:36 AM6/29/20

to Marco Elver, kernel test robot, kbuil...@lists.01.org, clang-built-linux, LKML, Dmitry Vyukov, kasan-dev

On Mon, Jun 29, 2020 at 04:54:13PM +0200, Marco Elver wrote:
> On Sat, 27 Jun 2020 at 17:44, Kees Cook <kees...@chromium.org> wrote:
> >
> > On Thu, Jun 25, 2020 at 02:36:27AM +0800, kernel test robot wrote:
> > > I love your patch! Perhaps something to improve:
> > > [...]
> > > config: x86_64-randconfig-a012-20200624 (attached as .config)
> >
> > CONFIG_KCSAN=y
> >
> > > compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project 1d4c87335d5236ea1f35937e1014980ba961ae34)
> > > [...]
> > > All warnings (new ones prefixed by >>):
> > >
> > > ld.lld: warning: drivers/built-in.a(mfd/mt6397-irq.o):(.init_array.0) is being placed in '.init_array.0'
> >
> > As far as I can tell, this is a Clang bug. But I don't know the
> > internals here, so I've opened:
> > https://bugs.llvm.org/show_bug.cgi?id=46478
> >
> > and created a work-around patch for the kernel:
>
> Thanks, minor comments below.
>
> With KCSAN this is:
>
> Tested-by: Marco Elver <el...@google.com>

Thanks!

>
>
> > commit 915f2c343e59a14f00c68f4d7afcfdc621de0674
> > Author: Kees Cook <kees...@chromium.org>
> > Date: Sat Jun 27 08:07:54 2020 -0700
> >
> > vmlinux.lds.h: Avoid KCSAN's unwanted sections
>
> Since you found that it's also KASAN, this probably wants updating.

Yeah, I found that while testing the v4 series and updated the patch
there.

> > KCSAN (-fsanitize=thread) produces unwanted[1] .eh_frame and .init_array.*
> > sections. Add them to DISCARDS, except with CONFIG_CONSTRUCTORS, which
> > wants to keep .init_array.* sections.
> >
> > [1] https://bugs.llvm.org/show_bug.cgi?id=46478
> >
> > Signed-off-by: Kees Cook <kees...@chromium.org>
> >
> > diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> > index f8a5b2333729..41c8c73de6c4 100644
> > --- a/arch/x86/Makefile
> > +++ b/arch/x86/Makefile
> > @@ -195,7 +195,9 @@ endif
> > # Workaround for a gcc prelease that unfortunately was shipped in a suse release
> > KBUILD_CFLAGS += -Wno-sign-compare
> > #
> > -KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
> > +KBUILD_AFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
> > +KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
> > +KBUILD_LDFLAGS += $(call ld-option,--no-ld-generated-unwind-info)
>
> Why are they needed? They are not mentioned in the commit message.

This was a mis-applied chunk (I also noticed this in the v4).

> > +/*
> > + * Clang's -fsanitize=thread produces unwanted sections (.eh_frame
> > + * and .init_array.*), but CONFIG_CONSTRUCTORS wants to keep any
> > + * .init_array.* sections.
> > + * https://bugs.llvm.org/show_bug.cgi?id=46478
> > + */
> > +#if defined(CONFIG_KCSAN) && !defined(CONFIG_CONSTRUCTORS)
>
> CONFIG_KASAN as well?
>
> > +#define KCSAN_DISCARDS \
> > + *(.init_array) *(.init_array.*) \
> > + *(.eh_frame)
> > +#elif defined(CONFIG_KCSAN) && defined(CONFIG_CONSTRUCTORS)
> > +#define KCSAN_DISCARDS \
> > + *(.eh_frame)
> > +#else
> > +#define KCSAN_DISCARDS
> > +#endif
> > +
> > #define DISCARDS \
> > /DISCARD/ : { \
> > EXIT_DISCARDS \
> > EXIT_CALL \
> > + KCSAN_DISCARDS \
>
> Maybe just 'SANITIZER_DISCARDS'?

Sure! I will rename it.

>
> > *(.discard) \
> > *(.discard.*) \
> > *(.modinfo) \
> >
> > --
> > Kees Cook

--
Kees Cook

Arvind Sankar

unread,

Jun 29, 2020, 11:54:05 AM6/29/20

to Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

On Sun, Jun 28, 2020 at 11:18:37PM -0700, Kees Cook wrote:
> We don't want to depend on the linker's orphan section placement
> heuristics as these can vary between linkers, and may change between
> versions. All sections need to be explicitly named in the linker
> script.
>
> Specifically, this would have made a recently fixed bug very obvious:
>
> ld: warning: orphan section `.fixup' from `arch/arm/lib/copy_from_user.o' being placed in section `.fixup'
>
> Discard unneeded sections .iplt, .rel.iplt, .igot.plt, and .modinfo.
>
> Add missing text stub sections .vfp11_veneer and .v4_bx.
>
> Add debug sections explicitly.
>
> Finally enable orphan section warning.

This is unrelated to this patch as such, but I noticed that ARM32/64 places
the .got section inside .text -- is that expected on ARM?

Nick Desaulniers

unread,

Jun 29, 2020, 2:03:03 PM6/29/20

to Kees Cook, Ard Biesheuvel, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List, Daniel Kiss

This is definitely better than the empty function. Though a patch is
posted for fixing this in LLVM. Assuming that lands before this, we
might not actually need this workaround?

arch/arm64/Kconfig
1625 config ARM64_BTI_KERNEL
...
1633 # https://reviews.llvm.org/rGb8ae3fdfa579dbf366b1bb1cbfdbf8c51db7fa55
1634 depends on !CC_IS_CLANG || CLANG_VERSION >= 100001

So if Daniel's patch lands AND is backported into the clang 10.0.1
release, then we might not need to carry this workaround? Either way,

Reviewed-by: Nick Desaulniers <ndesau...@google.com>

> +
> #
> # For x86, bootloaders like systemd-boot or grub-efi do not zero-initialize the
> # .bss section, so the .bss section of the EFI stub needs to be included in the
>
> --
> Kees Cook

--
Thanks,
~Nick Desaulniers

Russell King - ARM Linux admin

unread,

Jun 29, 2020, 2:07:15 PM6/29/20

to Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Do you mean in general, in the kernel vmlinux, in the decompressor
vmlinux or ... ?

--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

Arvind Sankar

unread,

Jun 29, 2020, 2:15:17 PM6/29/20

to Russell King - ARM Linux admin, Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

On Mon, Jun 29, 2020 at 07:07:04PM +0100, Russell King - ARM Linux admin wrote:
> On Mon, Jun 29, 2020 at 11:54:01AM -0400, Arvind Sankar wrote:
> > On Sun, Jun 28, 2020 at 11:18:37PM -0700, Kees Cook wrote:
> > > We don't want to depend on the linker's orphan section placement
> > > heuristics as these can vary between linkers, and may change between
> > > versions. All sections need to be explicitly named in the linker
> > > script.
> > >
> > > Specifically, this would have made a recently fixed bug very obvious:
> > >
> > > ld: warning: orphan section `.fixup' from `arch/arm/lib/copy_from_user.o' being placed in section `.fixup'
> > >
> > > Discard unneeded sections .iplt, .rel.iplt, .igot.plt, and .modinfo.
> > >
> > > Add missing text stub sections .vfp11_veneer and .v4_bx.
> > >
> > > Add debug sections explicitly.
> > >
> > > Finally enable orphan section warning.
> >
> > This is unrelated to this patch as such, but I noticed that ARM32/64 places
> > the .got section inside .text -- is that expected on ARM?
>
> Do you mean in general, in the kernel vmlinux, in the decompressor
> vmlinux or ... ?
>

Sorry, in the kernel vmlinux. ARM_TEXT includes *(.got) for 32-bit, and
the 64-bit vmlinux.lds.S includes it in .text as well. The decompressor
for 32-bit keeps it separate for non-EFI stub kernel and puts it inside
.data for EFI stub.

Kees Cook

unread,

Jun 29, 2020, 2:37:19 PM6/29/20

to Nick Desaulniers, Ard Biesheuvel, Will Deacon, Dave Martin, clang-built-linux, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, X86 ML, linux-arch, linux-efi, Linux ARM, Linux Kernel Mailing List, Daniel Kiss

On Mon, Jun 29, 2020 at 11:02:51AM -0700, Nick Desaulniers wrote:
> This is definitely better than the empty function. Though a patch is
> posted for fixing this in LLVM. Assuming that lands before this, we
> might not actually need this workaround?
>
> arch/arm64/Kconfig
> 1625 config ARM64_BTI_KERNEL
> ...
> 1633 # https://reviews.llvm.org/rGb8ae3fdfa579dbf366b1bb1cbfdbf8c51db7fa55
> 1634 depends on !CC_IS_CLANG || CLANG_VERSION >= 100001
>
> So if Daniel's patch lands AND is backported into the clang 10.0.1
> release, then we might not need to carry this workaround? Either way,

True, though as I mentioned in the review, I don't think it's quite
right -- the warning getting removed is actually quite valuable.

> Reviewed-by: Nick Desaulniers <ndesau...@google.com>

Thanks!

--
Kees Cook

Russell King - ARM Linux admin

unread,

Jun 29, 2020, 3:03:26 PM6/29/20

to Arvind Sankar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Masahiro Yamada, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

The main 32-bit kernel image doesn't use the .got - I don't think it
actually even exists.

The decompressor (non-EFI) uses the .got as a way of getting position
independence, and that must be part of the binary image at a fixed
offset from the .text section. The decompressor self-fixes up the
GOT entries.

In the case of the decompressor being flashed and executed from NOR
flash, the decompressor must be built for the specific address(es)
that it will reside (which does away with the .got table.)

For EFI, it needs to be in the .data section (which is in that case
always a fixed offset from .text) so that it can be written to so the
fix-ups work.

Nick Desaulniers

unread,

Jun 29, 2020, 3:47:16 PM6/29/20

to Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML

On Sun, Jun 28, 2020 at 11:18 PM Kees Cook <kees...@chromium.org> wrote:
>
> We don't want to depend on the linker's orphan section placement
> heuristics as these can vary between linkers, and may change between
> versions. All sections need to be explicitly named in the linker
> script.
>
> Specifically, this would have made a recently fixed bug very obvious:
>
> ld: warning: orphan section `.fixup' from `arch/arm/lib/copy_from_user.o' being placed in section `.fixup'
>
> Discard unneeded sections .iplt, .rel.iplt, .igot.plt, and .modinfo.
>
> Add missing text stub sections .vfp11_veneer and .v4_bx.
>
> Add debug sections explicitly.
>
> Finally enable orphan section warning.
>
> Signed-off-by: Kees Cook <kees...@chromium.org>

Thanks for following up on the previous suggestion regarding .glu_7 /
.glu_7t ordering. LGTM
Reviewed-by: Nick Desaulniers <ndesau...@google.com>

> --
> You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-li...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20200629061840.4065483-15-keescook%40chromium.org.

--
Thanks,
~Nick Desaulniers

Nick Desaulniers

unread,

Jun 29, 2020, 3:53:59 PM6/29/20

to Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML, Joe Perches

On Sun, Jun 28, 2020 at 11:18 PM Kees Cook <kees...@chromium.org> wrote:
>

> Fix a case of needless quotes in __section(), which Clang doesn't like.
>
> Acked-by: Will Deacon <wi...@kernel.org>
> Signed-off-by: Kees Cook <kees...@chromium.org>

Yep, I remember bugs from this. Probably should scan the kernel for
other instances of this. +Joe for checkpatch.pl validation.
Reviewed-by: Nick Desaulniers <ndesau...@google.com>

> ---
> arch/arm64/mm/mmu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
> index 1df25f26571d..dce024ea6084 100644
> --- a/arch/arm64/mm/mmu.c
> +++ b/arch/arm64/mm/mmu.c
> @@ -42,7 +42,7 @@
> u64 idmap_t0sz = TCR_T0SZ(VA_BITS);
> u64 idmap_ptrs_per_pgd = PTRS_PER_PGD;
>
> -u64 __section(".mmuoff.data.write") vabits_actual;
> +u64 __section(.mmuoff.data.write) vabits_actual;
> EXPORT_SYMBOL(vabits_actual);
>
> u64 kimage_voffset __ro_after_init;
> --
> 2.25.1
>

--
Thanks,
~Nick Desaulniers

Joe Perches

unread,

Jun 29, 2020, 4:03:18 PM6/29/20

to Nick Desaulniers, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML

On Mon, 2020-06-29 at 12:53 -0700, Nick Desaulniers wrote:
> On Sun, Jun 28, 2020 at 11:18 PM Kees Cook <kees...@chromium.org> wrote:
> > Fix a case of needless quotes in __section(), which Clang doesn't like.
> >
> > Acked-by: Will Deacon <wi...@kernel.org>
> > Signed-off-by: Kees Cook <kees...@chromium.org>
>
> Yep, I remember bugs from this. Probably should scan the kernel for
> other instances of this. +Joe for checkpatch.pl validation.
> Reviewed-by: Nick Desaulniers <ndesau...@google.com>

$ git grep -P -n '__section\s*\(\s*\"'
arch/arm64/mm/mmu.c:45:u64 __section(".mmuoff.data.write") vabits_actual;
include/linux/compiler.h:211: __section("___kentry" "+" #sym ) \
include/linux/export.h:133: static int __ksym_marker_##sym[0] __section(".discard.ksym") __used
include/linux/srcutree.h:127: __section("___srcu_struct_ptrs") = &name

My recollection is I submitted a patch
to _add_ quotes

https://lore.kernel.org/patchwork/patch/1125785/

Kees Cook

unread,

Jun 29, 2020, 4:04:34 PM6/29/20

to Nick Desaulniers, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML, Joe Perches

On Mon, Jun 29, 2020 at 12:53:47PM -0700, Nick Desaulniers wrote:
> On Sun, Jun 28, 2020 at 11:18 PM Kees Cook <kees...@chromium.org> wrote:
> >
> > Fix a case of needless quotes in __section(), which Clang doesn't like.
> >
> > Acked-by: Will Deacon <wi...@kernel.org>
> > Signed-off-by: Kees Cook <kees...@chromium.org>
>
> Yep, I remember bugs from this. Probably should scan the kernel for
> other instances of this. +Joe for checkpatch.pl validation.

I think the others are safe because they're in macros:

$ git grep -4 '__section("'
include/linux/compiler.h-# define KENTRY(sym) \
include/linux/compiler.h- extern typeof(sym) sym; \
include/linux/compiler.h- static const unsigned long __kentry_##sym \
include/linux/compiler.h- __used \
include/linux/compiler.h: __section("___kentry" "+" #sym ) \
include/linux/compiler.h- = (unsigned long)&sym;
--
include/linux/export.h-#define __ksym_marker(sym) \
include/linux/export.h: static int __ksym_marker_##sym[0] __section(".discard.ksym") __used
--
include/linux/srcutree.h-# define __DEFINE_SRCU(name, is_static) \
include/linux/srcutree.h- is_static struct srcu_struct name; \
include/linux/srcutree.h- struct srcu_struct * const __srcu_struct_##name \
include/linux/srcutree.h: __section("___srcu_struct_ptrs") = &name

Nick Desaulniers

unread,

Jun 29, 2020, 4:29:50 PM6/29/20

to Joe Perches, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML

Hey, yeah! Did you end up sending v2?

--
Thanks,
~Nick Desaulniers

Arvind Sankar

unread,

Jun 29, 2020, 4:54:52 PM6/29/20

to Kees Cook, Nick Desaulniers, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML, Joe Perches

On Mon, Jun 29, 2020 at 01:04:31PM -0700, Kees Cook wrote:
> On Mon, Jun 29, 2020 at 12:53:47PM -0700, Nick Desaulniers wrote:
> > On Sun, Jun 28, 2020 at 11:18 PM Kees Cook <kees...@chromium.org> wrote:
> > >
> > > Fix a case of needless quotes in __section(), which Clang doesn't like.
> > >
> > > Acked-by: Will Deacon <wi...@kernel.org>
> > > Signed-off-by: Kees Cook <kees...@chromium.org>
> >
> > Yep, I remember bugs from this. Probably should scan the kernel for
> > other instances of this. +Joe for checkpatch.pl validation.
>
> I think the others are safe because they're in macros:

Why does that make it safe -- the commit msg is a bit sparse, but I
assume the problem is that it generates
__attribute__((__section__("\".foo\"")))
from
__section(".foo")
after preprocessing, and clang keeps the quotes in the section name when
generating assembly, while gcc appears to strip them off.

It does that even if nested in another macro, no?

>
> $ git grep -4 '__section("'
> include/linux/compiler.h-# define KENTRY(sym) \

Am I missing something, or is KENTRY unused in the tree?

Arvind Sankar

unread,

Jun 29, 2020, 5:06:23 PM6/29/20

to Arvind Sankar, Kees Cook, Nick Desaulniers, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Nathan Chancellor, Arnd Bergmann, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), clang-built-linux, linux-arch, linux-efi, Linux ARM, LKML, Joe Perches

On Mon, Jun 29, 2020 at 04:54:48PM -0400, Arvind Sankar wrote:
> On Mon, Jun 29, 2020 at 01:04:31PM -0700, Kees Cook wrote:
> > On Mon, Jun 29, 2020 at 12:53:47PM -0700, Nick Desaulniers wrote:
> > > On Sun, Jun 28, 2020 at 11:18 PM Kees Cook <kees...@chromium.org> wrote:
> > > >
> > > > Fix a case of needless quotes in __section(), which Clang doesn't like.
> > > >
> > > > Acked-by: Will Deacon <wi...@kernel.org>
> > > > Signed-off-by: Kees Cook <kees...@chromium.org>
> > >
> > > Yep, I remember bugs from this. Probably should scan the kernel for
> > > other instances of this. +Joe for checkpatch.pl validation.
> >
> > I think the others are safe because they're in macros:
>
> Why does that make it safe -- the commit msg is a bit sparse, but I
> assume the problem is that it generates
> __attribute__((__section__("\".foo\"")))
> from
> __section(".foo")
> after preprocessing, and clang keeps the quotes in the section name when
> generating assembly, while gcc appears to strip them off.
>
> It does that even if nested in another macro, no?

Yep, I can see things like:
[25] ".discard.ksym" PROGBITS 0000000000000000 0000217c
0000000000000000 0000000000000000 WA 0 0 4

Doesn't seem to cause a build error, but that can't be good.

Will Deacon

unread,

Aug 21, 2020, 12:02:45 PM8/21/20

to Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Hi Kees,

On Sun, Jun 28, 2020 at 11:18:23PM -0700, Kees Cook wrote:
> v4:
> - explicitly add .ARM.attributes
> - split up arm64 changes into separate patches
> - split up arm changes into separate patches
> - work around Clang section generation bug in -mbranch-protection
> - work around Clang section generation bug in KASAN and KCSAN
> - split "common" ELF sections out of STABS_DEBUG
> - changed relative position of .comment
> - add reviews/acks

What's the plan with this series? I thought it might have landed during the
merge window, but I can't even seem to find it in next. Anything else you
need on the arm64 side?

Will

Kees Cook

unread,

Aug 21, 2020, 1:36:28 PM8/21/20

to Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Thomas Gleixner, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

I need to rebase/refresh -- the plan is for it to go via -tip (based on
what Ingo said). I'm working on a v6 right now.

--
Kees Cook

Kees Cook

unread,

Aug 21, 2020, 3:44:21 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Hi Ingo,

Based on my testing, this is ready to go. I've reviewed the feedback on
v5 and made a few small changes, noted below.

https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=linker/orphans/warn/v6

v6:
- rebase to -tip x86/boot
- remove 0-sized NOLOAD
- move .got.plt to end with INFO (NOLOAD warns)
- add Reviewed-bys
v5: https://lore.kernel.org/lkml/20200731230820.1...@chromium.org/
v4: https://lore.kernel.org/lkml/20200629061840.4...@chromium.org/
v3: https://lore.kernel.org/lkml/20200624014940.1...@chromium.org/
v2: https://lore.kernel.org/lkml/20200622205815.2...@chromium.org/
v1: https://lore.kernel.org/lkml/20200228002244....@chromium.org/

A recent bug[1] was solved for builds linked with ld.lld, and tracking
it down took way longer than it needed to (a year). Ultimately, it
boiled down to differences between ld.bfd and ld.lld's handling of
orphan sections. Similar situation have continued to recur, and it's
clear the kernel build needs to be much more explicit about linker
sections. Similarly, the recent FGKASLR series brought up orphan section
handling too[2]. In all cases, it would have been nice if the linker was
running with --orphan-handling=warn so that surprise sections wouldn't
silently get mapped into the kernel image at locations up to the whim
of the linker's orphan handling logic. Instead, all desired sections
should be explicitly identified in the linker script (to be either kept,
discarded, or verified to be zero-sized) with any orphans throwing a
warning. The powerpc architecture has actually been doing this for some
time, so this series just extends that coverage to x86, arm, and arm64.

This has gotten sucecssful build testing under the following matrix:

compiler/linker: gcc+ld.bfd, clang+ld.lld
targets: defconfig, allmodconfig
architectures: x86, i386, arm64, arm
versions: -tip x86/boot

All three architectures depend on the first several commits to
vmlinux.lds.h. x86 depends on Arvind's GOT series (in -tip x86/boot now).
arm64 depends on the efi/libstub patch. As such, I'd like to land this
series as a whole. Ingo has suggested he'd take it into -tip.

Thanks!

-Kees

[1] https://github.com/ClangBuiltLinux/linux/issues/282
[2] https://lore.kernel.org/lkml/202002242122.AA4D1B8@keescook/

Kees Cook (28):
vmlinux.lds.h: Create COMMON_DISCARDS
vmlinux.lds.h: Add .gnu.version* to COMMON_DISCARDS
vmlinux.lds.h: Avoid KASAN and KCSAN's unwanted sections
vmlinux.lds.h: Split ELF_DETAILS from STABS_DEBUG
vmlinux.lds.h: Add .symtab, .strtab, and .shstrtab to ELF_DETAILS
efi/libstub: Disable -mbranch-protection
arm64/mm: Remove needless section quotes
arm64/kernel: Remove needless Call Frame Information annotations
arm64/build: Remove .eh_frame* sections due to unwind tables
arm64/build: Use common DISCARDS in linker script
arm64/build: Add missing DWARF sections
arm64/build: Assert for unwanted sections
arm64/build: Warn on orphan section placement
arm/build: Refactor linker script headers
arm/build: Explicitly keep .ARM.attributes sections
arm/build: Add missing sections
arm/build: Assert for unwanted sections
arm/build: Warn on orphan section placement
arm/boot: Handle all sections explicitly
arm/boot: Warn on orphan section placement
x86/asm: Avoid generating unused kprobe sections
x86/build: Enforce an empty .got.plt section
x86/build: Assert for unwanted sections
x86/build: Warn on orphan section placement
x86/boot/compressed: Reorganize zero-size section asserts
x86/boot/compressed: Remove, discard, or assert for unwanted sections
x86/boot/compressed: Add missing debugging sections to output
x86/boot/compressed: Warn on orphan section placement

Nick Desaulniers (1):
vmlinux.lds.h: add PGO and AutoFDO input sections

arch/alpha/kernel/vmlinux.lds.S | 1 +
arch/arc/kernel/vmlinux.lds.S | 1 +
arch/arm/Makefile | 4 ++
arch/arm/boot/compressed/Makefile | 2 +
arch/arm/boot/compressed/vmlinux.lds.S | 20 +++----
.../arm/{kernel => include/asm}/vmlinux.lds.h | 30 ++++++++--
arch/arm/kernel/vmlinux-xip.lds.S | 8 ++-
arch/arm/kernel/vmlinux.lds.S | 8 ++-
arch/arm64/Makefile | 9 ++-
arch/arm64/kernel/smccc-call.S | 2 -
arch/arm64/kernel/vmlinux.lds.S | 28 +++++++--
arch/arm64/mm/mmu.c | 2 +-
arch/csky/kernel/vmlinux.lds.S | 1 +
arch/hexagon/kernel/vmlinux.lds.S | 1 +
arch/ia64/kernel/vmlinux.lds.S | 1 +
arch/mips/kernel/vmlinux.lds.S | 1 +
arch/nds32/kernel/vmlinux.lds.S | 1 +
arch/nios2/kernel/vmlinux.lds.S | 1 +
arch/openrisc/kernel/vmlinux.lds.S | 1 +
arch/parisc/boot/compressed/vmlinux.lds.S | 1 +
arch/parisc/kernel/vmlinux.lds.S | 1 +
arch/powerpc/kernel/vmlinux.lds.S | 2 +-
arch/riscv/kernel/vmlinux.lds.S | 1 +
arch/s390/kernel/vmlinux.lds.S | 1 +
arch/sh/kernel/vmlinux.lds.S | 1 +
arch/sparc/kernel/vmlinux.lds.S | 1 +
arch/um/kernel/dyn.lds.S | 2 +-
arch/um/kernel/uml.lds.S | 2 +-
arch/x86/Makefile | 4 ++
arch/x86/boot/compressed/Makefile | 2 +
arch/x86/boot/compressed/vmlinux.lds.S | 58 +++++++++++++------
arch/x86/include/asm/asm.h | 6 +-
arch/x86/kernel/vmlinux.lds.S | 39 ++++++++++++-
drivers/firmware/efi/libstub/Makefile | 9 ++-
include/asm-generic/vmlinux.lds.h | 49 +++++++++++++---
35 files changed, 241 insertions(+), 60 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (84%)

--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:22 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

The .comment section doesn't belong in STABS_DEBUG. Split it out into a
new macro named ELF_DETAILS. This will gain other non-debug sections
that need to be accounted for when linking with --orphan-handling=warn.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/alpha/kernel/vmlinux.lds.S | 1 +
arch/arc/kernel/vmlinux.lds.S | 1 +

arch/arm/kernel/vmlinux-xip.lds.S | 1 +
arch/arm/kernel/vmlinux.lds.S | 1 +

arch/arm64/kernel/vmlinux.lds.S | 1 +

arch/x86/boot/compressed/vmlinux.lds.S | 2 ++
arch/x86/kernel/vmlinux.lds.S | 1 +
include/asm-generic/vmlinux.lds.h | 8 ++++++--
24 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/arch/alpha/kernel/vmlinux.lds.S b/arch/alpha/kernel/vmlinux.lds.S
index bc6f727278fd..5b78d640725d 100644
--- a/arch/alpha/kernel/vmlinux.lds.S
+++ b/arch/alpha/kernel/vmlinux.lds.S
@@ -72,6 +72,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
index 54139a6f469b..33ce59d91461 100644
--- a/arch/arc/kernel/vmlinux.lds.S
+++ b/arch/arc/kernel/vmlinux.lds.S
@@ -122,6 +122,7 @@ SECTIONS
_end = . ;

STABS_DEBUG
+ ELF_DETAILS
DISCARDS

.arcextmap 0 : {
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 6d2be994ae58..3d4e88f08196 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -152,6 +152,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ ELF_DETAILS
}

/*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 7f24bc08403e..5592f14b7e35 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -151,6 +151,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ ELF_DETAILS
}

#ifdef CONFIG_STRICT_KERNEL_RWX
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index ec8e894684a7..13fc2ec46aae 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -241,6 +241,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ ELF_DETAILS

HEAD_SYMBOLS
}
diff --git a/arch/csky/kernel/vmlinux.lds.S b/arch/csky/kernel/vmlinux.lds.S
index f05b413df328..f03033e17c29 100644
--- a/arch/csky/kernel/vmlinux.lds.S
+++ b/arch/csky/kernel/vmlinux.lds.S
@@ -109,6 +109,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S
index 0ca2471ddb9f..35b18e55eae8 100644
--- a/arch/hexagon/kernel/vmlinux.lds.S
+++ b/arch/hexagon/kernel/vmlinux.lds.S
@@ -67,5 +67,6 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

}
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index d259690eb91a..9b265783be6a 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -218,6 +218,7 @@ SECTIONS {

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* Default discards */
DISCARDS
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index f185a85a27c1..5e97e9d02f98 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -202,6 +202,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* These must appear regardless of . */
.gptab.sdata : {
diff --git a/arch/nds32/kernel/vmlinux.lds.S b/arch/nds32/kernel/vmlinux.lds.S
index 7a6c1cefe3fe..6a91b965fb1e 100644
--- a/arch/nds32/kernel/vmlinux.lds.S
+++ b/arch/nds32/kernel/vmlinux.lds.S
@@ -64,6 +64,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/nios2/kernel/vmlinux.lds.S b/arch/nios2/kernel/vmlinux.lds.S
index c55a7cfa1075..126e114744cb 100644
--- a/arch/nios2/kernel/vmlinux.lds.S
+++ b/arch/nios2/kernel/vmlinux.lds.S
@@ -58,6 +58,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/openrisc/kernel/vmlinux.lds.S b/arch/openrisc/kernel/vmlinux.lds.S
index 60449fd7f16f..d287dbb84d0f 100644
--- a/arch/openrisc/kernel/vmlinux.lds.S
+++ b/arch/openrisc/kernel/vmlinux.lds.S
@@ -115,6 +115,7 @@ SECTIONS
/* Throw in the debugging sections */
STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* Sections to be discarded -- must be last */
DISCARDS
diff --git a/arch/parisc/boot/compressed/vmlinux.lds.S b/arch/parisc/boot/compressed/vmlinux.lds.S
index 2ac3a643f2eb..ab7b43990857 100644
--- a/arch/parisc/boot/compressed/vmlinux.lds.S
+++ b/arch/parisc/boot/compressed/vmlinux.lds.S
@@ -84,6 +84,7 @@ SECTIONS
}

STABS_DEBUG
+ ELF_DETAILS
.note 0 : { *(.note) }

/* Sections to be discarded */
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 53e29d88f99c..2769eb991f58 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -164,6 +164,7 @@ SECTIONS
_end = . ;

STABS_DEBUG
+ ELF_DETAILS
.note 0 : { *(.note) }

/* Sections to be discarded */
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 326e113d2e45..e0548b4950de 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -360,8 +360,8 @@ SECTIONS
PROVIDE32 (end = .);

STABS_DEBUG
-
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
/DISCARD/ : {
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index f3586e31ed1e..6f3af7bbc49d 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -97,6 +97,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 37695499717d..177ccfbda40a 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -181,6 +181,7 @@ SECTIONS
/* Debugging sections. */
STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

/* Sections to be discarded */
DISCARDS
diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
index bde7a6c01aaf..3161b9ccd2a5 100644
--- a/arch/sh/kernel/vmlinux.lds.S
+++ b/arch/sh/kernel/vmlinux.lds.S
@@ -76,6 +76,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index f99e99e58075..d55ae65a07ad 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -187,6 +187,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S
index f5001481010c..dacbfabf66d8 100644
--- a/arch/um/kernel/dyn.lds.S
+++ b/arch/um/kernel/dyn.lds.S
@@ -164,8 +164,8 @@ SECTIONS
PROVIDE (end = .);

STABS_DEBUG
-
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
index 3b6dab3d4501..45d957d7004c 100644
--- a/arch/um/kernel/uml.lds.S
+++ b/arch/um/kernel/uml.lds.S
@@ -108,8 +108,8 @@ SECTIONS
PROVIDE (end = .);

STABS_DEBUG
-
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S
index 29df99b6cc64..3c2ee9a5bf43 100644
--- a/arch/x86/boot/compressed/vmlinux.lds.S
+++ b/arch/x86/boot/compressed/vmlinux.lds.S
@@ -82,6 +82,8 @@ SECTIONS

. = ALIGN(PAGE_SIZE); /* keep ZO size page aligned */
_end = .;

+ ELF_DETAILS
+
DISCARDS
}

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 9a03e5b23135..0cc035cb15f1 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -411,6 +411,7 @@ SECTIONS

STABS_DEBUG
DWARF_DEBUG
+ ELF_DETAILS

DISCARDS
}
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 6b89a03e636e..cadcbc3cdabd 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -34,6 +34,7 @@
*
* STABS_DEBUG
* DWARF_DEBUG
+ * ELF_DETAILS
*
* DISCARDS // must be the last
* }
@@ -811,14 +812,17 @@
.debug_macro 0 : { *(.debug_macro) } \
.debug_addr 0 : { *(.debug_addr) }

- /* Stabs debugging sections. */
+/* Stabs debugging sections. */
#define STABS_DEBUG \
.stab 0 : { *(.stab) } \
.stabstr 0 : { *(.stabstr) } \
.stab.excl 0 : { *(.stab.excl) } \
.stab.exclstr 0 : { *(.stab.exclstr) } \
.stab.index 0 : { *(.stab.index) } \
- .stab.indexstr 0 : { *(.stab.indexstr) } \
+ .stab.indexstr 0 : { *(.stab.indexstr) }
+
+/* Required sections not related to debugging. */
+#define ELF_DETAILS \
.comment 0 : { *(.comment) }

#ifdef CONFIG_GENERIC_BUG
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:23 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Collect the common DISCARD sections for architectures that need more
specialized discard control than what the standard DISCARDS section
provides.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 7616ff0b96ec..184b23d62784 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -954,13 +954,16 @@
EXIT_DATA
#endif

+#define COMMON_DISCARDS \
+ *(.discard) \
+ *(.discard.*) \
+ *(.modinfo)

+
#define DISCARDS \
/DISCARD/ : { \
EXIT_DISCARDS \
EXIT_CALL \

- *(.discard) \
- *(.discard.*) \
- *(.modinfo) \
+ COMMON_DISCARDS \
}

/**
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:24 PM8/21/20

to Ingo Molnar, Kees Cook, Marco Elver, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

KASAN (-fsanitize=kernel-address) and KCSAN (-fsanitize=thread)
produce unwanted[1] .eh_frame and .init_array.* sections. Add them to
COMMON_DISCARDS, except with CONFIG_CONSTRUCTORS, which wants to keep

.init_array.* sections.

[1] https://bugs.llvm.org/show_bug.cgi?id=46478

Tested-by: Marco Elver <el...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index f1f02a2f71b7..6b89a03e636e 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -954,7 +954,27 @@
EXIT_DATA
#endif

+/*
+ * Clang's -fsanitize=kernel-address and -fsanitize=thread produce
+ * unwanted sections (.eh_frame and .init_array.*), but
+ * CONFIG_CONSTRUCTORS wants to keep any .init_array.* sections.

+ * https://bugs.llvm.org/show_bug.cgi?id=46478
+ */

+#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KCSAN)
+# ifdef CONFIG_CONSTRUCTORS
+# define SANITIZER_DISCARDS \
+ *(.eh_frame)
+# else
+# define SANITIZER_DISCARDS \

+ *(.init_array) *(.init_array.*) \
+ *(.eh_frame)

+# endif
+#else
+# define SANITIZER_DISCARDS
+#endif
+
#define COMMON_DISCARDS \
+ SANITIZER_DISCARDS \
*(.discard) \
*(.discard.*) \
*(.modinfo) \
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:25 PM8/21/20

to Ingo Molnar, Kees Cook, Nick Desaulniers, Jian Cai, Fāng-ruì Sòng, Luis Lozano, Manoj Gupta, sta...@vger.kernel.org, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

From: Nick Desaulniers <ndesau...@google.com>

Basically, consider .text.{hot|unlikely|unknown}.* part of .text, too.

When compiling with profiling information (collected via PGO
instrumentations or AutoFDO sampling), Clang will separate code into
.text.hot, .text.unlikely, or .text.unknown sections based on profiling
information. After D79600 (clang-11), these sections will have a
trailing `.` suffix, ie. .text.hot., .text.unlikely., .text.unknown..

When using -ffunction-sections together with profiling infomation,
either explicitly (FGKASLR) or implicitly (LTO), code may be placed in
sections following the convention:
.text.hot.<foo>, .text.unlikely.<bar>, .text.unknown.<baz>
where <foo>, <bar>, and <baz> are functions. (This produces one section
per function; we generally try to merge these all back via linker script
so that we don't have 50k sections).

For the above cases, we need to teach our linker scripts that such
sections might exist and that we'd explicitly like them grouped
together, otherwise we can wind up with code outside of the
_stext/_etext boundaries that might not be mapped properly for some
architectures, resulting in boot failures.

If the linker script is not told about possible input sections, then
where the section is placed as output is a heuristic-laiden mess that's
non-portable between linkers (ie. BFD and LLD), and has resulted in many
hard to debug bugs. Kees Cook is working on cleaning this up by adding
--orphan-handling=warn linker flag used in ARCH=powerpc to additional
architectures. In the case of linker scripts, borrowing from the Zen of
Python: explicit is better than implicit.

Also, ld.bfd's internal linker script considers .text.hot AND
.text.hot.* to be part of .text, as well as .text.unlikely and
.text.unlikely.*. I didn't see support for .text.unknown.*, and didn't
see Clang producing such code in our kernel builds, but I see code in
LLVM that can produce such section names if profiling information is
missing. That may point to a larger issue with generating or collecting
profiles, but I would much rather be safe and explicit than have to
debug yet another issue related to orphan section placement.

Reported-by: Jian Cai <jia...@google.com>
Suggested-by: Fāng-ruì Sòng <mas...@google.com>
Tested-by: Luis Lozano <llo...@google.com>
Tested-by: Manoj Gupta <manoj...@google.com>
Acked-by: Kees Cook <kees...@chromium.org>
Cc: sta...@vger.kernel.org
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=add44f8d5c5c05e08b11e033127a744d61c26aee
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=1de778ed23ce7492c523d5850c6c6dbb34152655
Link: https://reviews.llvm.org/D79600
Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1084760
Debugged-by: Luis Lozano <llo...@google.com>
Signed-off-by: Nick Desaulniers <ndesau...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 98d013dcc11a..91dcfb91ac45 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -581,7 +581,10 @@
*/
#define TEXT_TEXT \
ALIGN_FUNCTION(); \
- *(.text.hot TEXT_MAIN .text.fixup .text.unlikely) \
+ *(.text.hot .text.hot.*) \
+ *(TEXT_MAIN .text.fixup) \
+ *(.text.unlikely .text.unlikely.*) \
+ *(.text.unknown .text.unknown.*) \
NOINSTR_TEXT \
*(.text..refcount) \
*(.ref.text) \
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:25 PM8/21/20

to Ingo Molnar, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

For vmlinux linking, no architecture uses the .gnu.version* sections,
so remove it via the COMMON_DISCARDS macro in preparation for adding
--orphan-handling=warn more widely. This is a work-around for what
appears to be a bug[1] in ld.bfd which warns for this synthetic section
even when none is found in input objects, and even when no section is
emitted for an output object[2].

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=26153
[2] https://lore.kernel.org/lkml/202006221524.CEB86E036B@keescook/

Reviewed-by: Fangrui Song <mas...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 184b23d62784..f1f02a2f71b7 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -957,7 +957,9 @@
#define COMMON_DISCARDS \
*(.discard) \
*(.discard.*) \
- *(.modinfo)
+ *(.modinfo) \
+ /* ld.bfd warns about .gnu.version* even when not emitted */ \
+ *(.gnu.version*) \

#define DISCARDS \
/DISCARD/ : { \
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:25 PM8/21/20

to Ingo Molnar, Kees Cook, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

When linking vmlinux with LLD, the synthetic sections .symtab, .strtab,
and .shstrtab are listed as orphaned. Add them to the ELF_DETAILS section
so there will be no warnings when --orphan-handling=warn is used more
widely. (They are added above comment as it is the more common
order[1].)

ld.lld: warning: <internal>:(.symtab) is being placed in '.symtab'
ld.lld: warning: <internal>:(.shstrtab) is being placed in '.shstrtab'
ld.lld: warning: <internal>:(.strtab) is being placed in '.strtab'

[1] https://lore.kernel.org/lkml/20200622224928....@google.com/

Reported-by: Fangrui Song <mas...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

include/asm-generic/vmlinux.lds.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index cadcbc3cdabd..98d013dcc11a 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -823,7 +823,10 @@

/* Required sections not related to debugging. */

#define ELF_DETAILS \
- .comment 0 : { *(.comment) }
+ .comment 0 : { *(.comment) } \
+ .symtab 0 : { *(.symtab) } \
+ .strtab 0 : { *(.strtab) } \
+ .shstrtab 0 : { *(.shstrtab) }

#ifdef CONFIG_GENERIC_BUG
#define BUG_TABLE \
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:28 PM8/21/20

to Ingo Molnar, Kees Cook, Ard Biesheuvel, Will Deacon, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Avoid .eh_frame* section generation by making sure both CFLAGS and AFLAGS
contain -fno-asychronous-unwind-tables and -fno-unwind-tables.

With all sources of .eh_frame now removed from the build, drop this
DISCARD so we can be alerted in the future if it returns unexpectedly
once orphan section warnings have been enabled.

Suggested-by: Ard Biesheuvel <ar...@kernel.org>
Acked-by: Will Deacon <wi...@kernel.org>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/Makefile | 5 ++++-
arch/arm64/kernel/vmlinux.lds.S | 1 -
2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 55bc8546d9c7..6de7f551b821 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -47,13 +47,16 @@ endif

KBUILD_CFLAGS += -mgeneral-regs-only \
$(compat_vdso) $(cc_has_k_constraint)
-KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
KBUILD_CFLAGS += $(call cc-disable-warning, psabi)
KBUILD_AFLAGS += $(compat_vdso)

KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
KBUILD_AFLAGS += $(call cc-option,-mabi=lp64)

+# Avoid generating .eh_frame* sections.
+KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+KBUILD_AFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
+
ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y)
prepare: stack_protector_prepare
stack_protector_prepare: prepare0
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 13fc2ec46aae..c2b8426bf4bd 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -94,7 +94,6 @@ SECTIONS
*(.discard.*)
*(.interp .dynamic)
*(.dynsym .dynstr .hash .gnu.hash)
- *(.eh_frame)
}

. = KIMAGE_VADDR + TEXT_OFFSET;
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:28 PM8/21/20

to Ingo Molnar, Kees Cook, Nick Desaulniers, Fangrui Song, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn, explicitly keep the
.ARM.attributes section (at address 0[1]) by expanding the existing
ELF_DETAILS macro into ARM_DETAILS.

[1] https://reviews.llvm.org/D85867

Suggested-by: Nick Desaulniers <ndesau...@google.com>
Link: https://lore.kernel.org/lkml/CAKwvOdk-racgq5pxsoGS6Vti...@mail.gmail.com/
Reviewed-by: Fangrui Song <mas...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/include/asm/vmlinux.lds.h | 4 ++++
arch/arm/kernel/vmlinux-xip.lds.S | 2 +-
arch/arm/kernel/vmlinux.lds.S | 2 +-
3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm/include/asm/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
index a08f4301b718..c4af5182ab48 100644
--- a/arch/arm/include/asm/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -52,6 +52,10 @@
ARM_MMU_DISCARD(*(__ex_table)) \
COMMON_DISCARDS

+#define ARM_DETAILS \
+ ELF_DETAILS \
+ .ARM.attributes 0 : { *(.ARM.attributes) }
+
#define ARM_STUBS_TEXT \
*(.gnu.warning) \
*(.glue_7) \
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 904c31fa20ed..57fcbf55f913 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -150,7 +150,7 @@ SECTIONS
_end = .;

STABS_DEBUG
- ELF_DETAILS
+ ARM_DETAILS

}

/*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S

index bb950c896a67..1d3d3b599635 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -149,7 +149,7 @@ SECTIONS
_end = .;

STABS_DEBUG
- ELF_DETAILS
+ ARM_DETAILS
}

#ifdef CONFIG_STRICT_KERNEL_RWX
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:28 PM8/21/20

to Ingo Molnar, Kees Cook, Will Deacon, Nick Desaulniers, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Fix a case of needless quotes in __section(), which Clang doesn't like.

Acked-by: Will Deacon <wi...@kernel.org>

Reviewed-by: Nick Desaulniers <ndesau...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/mm/mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c

index 75df62fea1b6..e43c805b7b8c 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -43,7 +43,7 @@

Kees Cook

unread,

Aug 21, 2020, 3:44:28 PM8/21/20

to Ingo Molnar, Kees Cook, Ard Biesheuvel, Will Deacon, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Remove last instance of an .eh_frame section by removing the needless Call
Frame Information annotations which were likely leftovers from 32-bit arm.

Suggested-by: Ard Biesheuvel <ar...@kernel.org>
Acked-by: Will Deacon <wi...@kernel.org>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/kernel/smccc-call.S | 2 --
1 file changed, 2 deletions(-)

diff --git a/arch/arm64/kernel/smccc-call.S b/arch/arm64/kernel/smccc-call.S
index 1f93809528a4..d62447964ed9 100644
--- a/arch/arm64/kernel/smccc-call.S
+++ b/arch/arm64/kernel/smccc-call.S
@@ -9,7 +9,6 @@
#include <asm/assembler.h>

.macro SMCCC instr
- .cfi_startproc
\instr #0
ldr x4, [sp]
stp x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS]
@@ -21,7 +20,6 @@
b.ne 1f
str x6, [x4, ARM_SMCCC_QUIRK_STATE_OFFS]
1: ret
- .cfi_endproc
.endm

/*
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:29 PM8/21/20

to Ingo Molnar, Kees Cook, Arvind Sankar, Atish Patra, linu...@vger.kernel.org, Ard Biesheuvel, Nick Desaulniers, Catalin Marinas, Mark Rutland, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn to more architectures,
disable -mbranch-protection, as EFI does not yet support it[1]. This was
noticed due to it producing unwanted .note.gnu.property sections (prefixed
with .init due to the objcopy build step).

However, we must also work around a bug in Clang where the section is
still emitted for code-less object files[2], so also remove the section
during the objcopy.

[1] https://lore.kernel.org/lkml/CAMj1kXHck12juGi=E=P4hWP_8vQhQ+-x3v...@mail.gmail.com
[2] https://bugs.llvm.org/show_bug.cgi?id=46480

Cc: Arvind Sankar <nive...@alum.mit.edu>
Cc: Atish Patra <atish...@wdc.com>
Cc: linu...@vger.kernel.org

Acked-by: Ard Biesheuvel <ar...@kernel.org>
Reviewed-by: Nick Desaulniers <ndesau...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

drivers/firmware/efi/libstub/Makefile | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 5eefd60917df..0c911e391d75 100644

--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -18,7 +18,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \
# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
# disable the stackleak plugin
cflags-$(CONFIG_ARM64) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
- -fpie $(DISABLE_STACKLEAK_PLUGIN)
+ -fpie $(DISABLE_STACKLEAK_PLUGIN) \
+ $(call cc-option,-mbranch-protection=none)
cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
-fno-builtin -fpic \
$(call cc-option,-mno-single-pic-base)
@@ -66,6 +67,12 @@ lib-$(CONFIG_X86) += x86-stub.o
CFLAGS_arm32-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
CFLAGS_arm64-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)

+# Even when -mbranch-protection=none is set, Clang will generate a
+# .note.gnu.property for code-less object files (like lib/ctype.c),
+# so work around this by explicitly removing the unwanted section.
+# https://bugs.llvm.org/show_bug.cgi?id=46480
+STUBCOPY_FLAGS-y += --remove-section=.note.gnu.property

+
#
# For x86, bootloaders like systemd-boot or grub-efi do not zero-initialize the
# .bss section, so the .bss section of the EFI stub needs to be included in the
--

2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:30 PM8/21/20

to Ingo Molnar, Kees Cook, Will Deacon, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Use the common DISCARDS rule for the linker script in an effort to
regularize the linker script to prepare for warning on orphaned
sections. Additionally clean up left-over no-op macros.

Signed-off-by: Kees Cook <kees...@chromium.org>
Acked-by: Will Deacon <wi...@kernel.org>
---
arch/arm64/kernel/vmlinux.lds.S | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index c2b8426bf4bd..082e9efa2b43 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -6,6 +6,7 @@
*/

#define RO_EXCEPTION_TABLE_ALIGN 8
+#define RUNTIME_DISCARD_EXIT

#include <asm-generic/vmlinux.lds.h>
#include <asm/cache.h>
@@ -88,10 +89,8 @@ SECTIONS
* matching the same input section name. There is no documented
* order of matching.
*/
+ DISCARDS
/DISCARD/ : {
- EXIT_CALL
- *(.discard)
- *(.discard.*)

*(.interp .dynamic)
*(.dynsym .dynstr .hash .gnu.hash)
}

--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:30 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Explicitly include DWARF sections when they're present in the build.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm64/kernel/vmlinux.lds.S | 1 +
1 file changed, 1 insertion(+)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 082e9efa2b43..16eb2ef806cd 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -239,6 +239,7 @@ SECTIONS
_end = .;

STABS_DEBUG
+ DWARF_DEBUG
ELF_DETAILS

HEAD_SYMBOLS
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:31 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for adding --orphan-handling=warn, refactor the linker
script header includes, and extract common macros.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/{kernel => include/asm}/vmlinux.lds.h | 13 ++++++++-----
arch/arm/kernel/vmlinux-xip.lds.S | 4 +---
arch/arm/kernel/vmlinux.lds.S | 4 +---
3 files changed, 10 insertions(+), 11 deletions(-)
rename arch/arm/{kernel => include/asm}/vmlinux.lds.h (96%)

diff --git a/arch/arm/kernel/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
similarity index 96%
rename from arch/arm/kernel/vmlinux.lds.h
rename to arch/arm/include/asm/vmlinux.lds.h
index 381a8e105fa5..a08f4301b718 100644
--- a/arch/arm/kernel/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -1,4 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0 */
+#include <asm-generic/vmlinux.lds.h>

#ifdef CONFIG_HOTPLUG_CPU
#define ARM_CPU_DISCARD(x)
@@ -49,8 +50,12 @@
EXIT_CALL \
ARM_MMU_DISCARD(*(.text.fixup)) \
ARM_MMU_DISCARD(*(__ex_table)) \
- *(.discard) \
- *(.discard.*)
+ COMMON_DISCARDS
+
+#define ARM_STUBS_TEXT \
+ *(.gnu.warning) \
+ *(.glue_7) \
+ *(.glue_7t)

#define ARM_TEXT \
IDMAP_TEXT \
@@ -64,9 +69,7 @@
CPUIDLE_TEXT \
LOCK_TEXT \
KPROBES_TEXT \
- *(.gnu.warning) \
- *(.glue_7) \
- *(.glue_7t) \
+ ARM_STUBS_TEXT \
. = ALIGN(4); \
*(.got) /* Global offset table */ \
ARM_CPU_KEEP(PROC_INFO)
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 3d4e88f08196..904c31fa20ed 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -9,15 +9,13 @@

#include <linux/sizes.h>

-#include <asm-generic/vmlinux.lds.h>
+#include <asm/vmlinux.lds.h>
#include <asm/cache.h>
#include <asm/thread_info.h>
#include <asm/memory.h>
#include <asm/mpu.h>
#include <asm/page.h>

-#include "vmlinux.lds.h"
-
OUTPUT_ARCH(arm)
ENTRY(stext)

diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 5592f14b7e35..bb950c896a67 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -9,15 +9,13 @@
#else

#include <linux/pgtable.h>
-#include <asm-generic/vmlinux.lds.h>
+#include <asm/vmlinux.lds.h>
#include <asm/cache.h>
#include <asm/thread_info.h>
#include <asm/memory.h>
#include <asm/mpu.h>
#include <asm/page.h>

-#include "vmlinux.lds.h"
-
OUTPUT_ARCH(arm)
ENTRY(stext)

--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:32 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for warning on orphan sections, enforce
expected-to-be-zero-sized sections (since discarding them might hide
problems with them suddenly gaining unexpected entries).

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/include/asm/vmlinux.lds.h | 11 +++++++++++
arch/arm/kernel/vmlinux-xip.lds.S | 2 ++
arch/arm/kernel/vmlinux.lds.S | 2 ++
3 files changed, 15 insertions(+)

diff --git a/arch/arm/include/asm/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
index 6624dd97475c..4a91428c324d 100644
--- a/arch/arm/include/asm/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -52,6 +52,17 @@
ARM_MMU_DISCARD(*(__ex_table)) \
COMMON_DISCARDS

+/*
+ * Sections that should stay zero sized, which is safer to explicitly
+ * check instead of blindly discarding.
+ */
+#define ARM_ASSERTS \
+ .plt : { \
+ *(.iplt) *(.rel.iplt) *(.iplt) *(.igot.plt) \
+ } \
+ ASSERT(SIZEOF(.plt) == 0, \
+ "Unexpected run-time procedure linkages detected!")
+
#define ARM_DETAILS \
ELF_DETAILS \
.ARM.attributes 0 : { *(.ARM.attributes) }
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 11ffa79751da..50136828f5b5 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -152,6 +152,8 @@ SECTIONS
STABS_DEBUG
DWARF_DEBUG
ARM_DETAILS
+
+ ARM_ASSERTS
}

/*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index dc672fe35de3..5f4922e858d0 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -151,6 +151,8 @@ SECTIONS
STABS_DEBUG
DWARF_DEBUG
ARM_DETAILS
+
+ ARM_ASSERTS
}

#ifdef CONFIG_STRICT_KERNEL_RWX
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:32 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for warning on orphan sections, use common macros for
debug sections, discards, and text stubs. Add discards for unwanted .note,
and .rel sections.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/boot/compressed/vmlinux.lds.S | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
index 09ac33f52814..b914be3a207b 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.S
+++ b/arch/arm/boot/compressed/vmlinux.lds.S
@@ -2,6 +2,7 @@
/*
* Copyright (C) 2000 Russell King
*/
+#include <asm/vmlinux.lds.h>

#ifdef CONFIG_CPU_ENDIAN_BE8
#define ZIMAGE_MAGIC(x) ( (((x) >> 24) & 0x000000ff) | \
@@ -17,8 +18,11 @@ ENTRY(_start)
SECTIONS
{
/DISCARD/ : {
+ COMMON_DISCARDS
*(.ARM.exidx*)
*(.ARM.extab*)
+ *(.note.*)
+ *(.rel.*)
/*
* Discard any r/w data - this produces a link error if we have any,
* which is required for PIC decompression. Local data generates
@@ -36,9 +40,7 @@ SECTIONS
*(.start)
*(.text)
*(.text.*)
- *(.gnu.warning)
- *(.glue_7t)
- *(.glue_7)
+ ARM_STUBS_TEXT
}
.table : ALIGN(4) {
_table_start = .;
@@ -128,12 +130,10 @@ SECTIONS
PROVIDE(__pecoff_data_size = ALIGN(512) - ADDR(.data));
PROVIDE(__pecoff_end = ALIGN(512));

- .stab 0 : { *(.stab) }
- .stabstr 0 : { *(.stabstr) }
- .stab.excl 0 : { *(.stab.excl) }
- .stab.exclstr 0 : { *(.stab.exclstr) }
- .stab.index 0 : { *(.stab.index) }
- .stab.indexstr 0 : { *(.stab.indexstr) }
- .comment 0 : { *(.comment) }
+ STABS_DEBUG
+ DWARF_DEBUG
+ ARM_DETAILS
+
+ ARM_ASSERTS
}
ASSERT(_edata_real == _edata, "error: zImage file size is incorrect");
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:33 PM8/21/20

to Ingo Molnar, Kees Cook, Nick Desaulniers, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Add missing text stub sections .vfp11_veneer and .v4_bx, as well as
missing DWARF sections, when present in the build.

Reviewed-by: Nick Desaulniers <ndesau...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/include/asm/vmlinux.lds.h | 4 +++-

arch/arm/kernel/vmlinux-xip.lds.S | 1 +
arch/arm/kernel/vmlinux.lds.S | 1 +

3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/arm/include/asm/vmlinux.lds.h b/arch/arm/include/asm/vmlinux.lds.h
index c4af5182ab48..6624dd97475c 100644
--- a/arch/arm/include/asm/vmlinux.lds.h
+++ b/arch/arm/include/asm/vmlinux.lds.h
@@ -59,7 +59,9 @@
#define ARM_STUBS_TEXT \
*(.gnu.warning) \
*(.glue_7) \
- *(.glue_7t)
+ *(.glue_7t) \
+ *(.vfp11_veneer) \
+ *(.v4_bx)

#define ARM_TEXT \
IDMAP_TEXT \
diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 57fcbf55f913..11ffa79751da 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -150,6 +150,7 @@ SECTIONS

_end = .;

STABS_DEBUG
+ DWARF_DEBUG

ARM_DETAILS
}

diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 1d3d3b599635..dc672fe35de3 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -149,6 +149,7 @@ SECTIONS

_end = .;

STABS_DEBUG
+ DWARF_DEBUG

ARM_DETAILS
}

--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:34 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

In preparation for warning on orphan sections, enforce other

expected-to-be-zero-sized sections (since discarding them might hide
problems with them suddenly gaining unexpected entries).

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/kernel/vmlinux.lds.S | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 4b1b936a6e7d..45d72447df84 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -427,6 +427,30 @@ SECTIONS
SIZEOF(.got.plt) == 0xc,
#endif
"Unexpected GOT/PLT entries detected!")
+
+ /*

+ * Sections that should stay zero sized, which is safer to

+ * explicitly check instead of blindly discarding.
+ */
+ .got : {
+ *(.got) *(.igot.*)
+ }
+ ASSERT(SIZEOF(.got) == 0, "Unexpected GOT entries detected!")
+
+ .plt : {
+ *(.plt) *(.plt.*) *(.iplt)
+ }
+ ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
+
+ .rel.dyn : {
+ *(.rel.*) *(.rel_*)
+ }
+ ASSERT(SIZEOF(.rel.dyn) == 0, "Unexpected run-time relocations (.rel) detected!")
+
+ .rela.dyn : {
+ *(.rela.*) *(.rela_*)
+ }
+ ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!")
}

#ifdef CONFIG_X86_32
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:44:35 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

The .got.plt section should always be zero (or filled only with the
linker-generated lazy dispatch entry). Enforce this with an assert and
mark the section as INFO. This is more sensitive than just blindly
discarding the section.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/kernel/vmlinux.lds.S | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 0cc035cb15f1..4b1b936a6e7d 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -414,8 +414,20 @@ SECTIONS
ELF_DETAILS

DISCARDS
-}

+ /*
+ * Make sure that the .got.plt is either completely empty or it
+ * contains only the lazy dispatch entries.
+ */
+ .got.plt (INFO) : { *(.got.plt) }
+ ASSERT(SIZEOF(.got.plt) == 0 ||
+#ifdef CONFIG_X86_64
+ SIZEOF(.got.plt) == 0x18,
+#else
+ SIZEOF(.got.plt) == 0xc,
+#endif
+ "Unexpected GOT/PLT entries detected!")
+}

#ifdef CONFIG_X86_32
/*
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:54:00 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

Include the missing DWARF and STABS sections in the compressed image,
when they are present.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/boot/compressed/vmlinux.lds.S | 2 ++
1 file changed, 2 insertions(+)

diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S
index 02f6feb0e55b..112b2375d021 100644
--- a/arch/x86/boot/compressed/vmlinux.lds.S
+++ b/arch/x86/boot/compressed/vmlinux.lds.S
@@ -69,6 +69,8 @@ SECTIONS

. = ALIGN(PAGE_SIZE); /* keep ZO size page aligned */
_end = .;

+ STABS_DEBUG
+ DWARF_DEBUG
ELF_DETAILS

DISCARDS
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:54:01 PM8/21/20

to Ingo Molnar, Kees Cook, Nick Desaulniers, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly handled in the linker
script.

Specifically, this would have made a recently fixed bug very obvious:

ld: warning: orphan section `.fixup' from `arch/arm/lib/copy_from_user.o' being placed in section `.fixup'

With all sections handled, enable orphan section warning.

Reviewed-by: Nick Desaulniers <ndesau...@google.com>

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/Makefile | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 4e877354515f..0aa133c4ddec 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -16,6 +16,10 @@ LDFLAGS_vmlinux += --be8
KBUILD_LDFLAGS_MODULE += --be8
endif

+# We never want expected sections to be placed heuristically by the
+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+
ifeq ($(CONFIG_ARM_MODULE_PLTS),y)
KBUILD_LDS_MODULE += $(srctree)/arch/arm/kernel/module.lds
endif
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:54:02 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly handled in the linker script.

With all sections now handled, enable orphan section warning.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/arm/boot/compressed/Makefile | 2 ++

1 file changed, 2 insertions(+)

diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index b1147b7f2c8d..d6cd2688ad7e 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -123,6 +123,8 @@ endif
LDFLAGS_vmlinux += --no-undefined
# Delete all temporary local symbols
LDFLAGS_vmlinux += -X
+# Report orphan sections
+LDFLAGS_vmlinux += --orphan-handling=warn
# Next argument is a linker script
LDFLAGS_vmlinux += -T

--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:54:03 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

When !CONFIG_KPROBES, do not generate kprobe sections. This makes
sure there are no unexpected sections encountered by the linker scripts.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/include/asm/asm.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index 5c15f95b1ba7..4712206c4325 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -138,11 +138,15 @@
# define _ASM_EXTABLE_FAULT(from, to) \
_ASM_EXTABLE_HANDLE(from, to, ex_handler_fault)

-# define _ASM_NOKPROBE(entry) \
+# ifdef CONFIG_KPROBES
+# define _ASM_NOKPROBE(entry) \
.pushsection "_kprobe_blacklist","aw" ; \
_ASM_ALIGN ; \
_ASM_PTR (entry); \
.popsection
+# else
+# define _ASM_NOKPROBE(entry)
+# endif

#else /* ! __ASSEMBLY__ */
# define _EXPAND_EXTABLE_HANDLE(x) #x
--
2.25.1

Kees Cook

unread,

Aug 21, 2020, 3:54:03 PM8/21/20

to Ingo Molnar, Kees Cook, Catalin Marinas, Mark Rutland, Ard Biesheuvel, Peter Collingbourne, James Morse, Borislav Petkov, Ingo Molnar, Russell King, Masahiro Yamada, Arvind Sankar, Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, x...@kernel.org, clang-bu...@googlegroups.com, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-ar...@lists.infradead.org, linux-...@vger.kernel.org

We don't want to depend on the linker's orphan section placement
heuristics as these can vary between linkers, and may change between
versions. All sections need to be explicitly handled in the linker script.

Now that all sections are explicitly handled, enable orphan section
warnings.

Signed-off-by: Kees Cook <kees...@chromium.org>
---

arch/x86/Makefile | 4 ++++

1 file changed, 4 insertions(+)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 4346ffb2e39f..ccacbf808552 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -209,6 +209,10 @@ ifdef CONFIG_X86_64
LDFLAGS_vmlinux += -z max-page-size=0x200000

endif

+# We never want expected sections to be placed heuristically by the
+# linker. All sections should be explicitly named in the linker script.
+LDFLAGS_vmlinux += --orphan-handling=warn
+

archscripts: scripts_basic
$(Q)$(MAKE) $(build)=arch/x86/tools relocs

--
2.25.1