On Thu, 2020-05-21 at 14:33 -0700, Kees Cook wrote: > Oh! And I am reminded suddenly about CONFIG_FG_KASLR needing to > interact > correctly with CONFIG_LD_DEAD_CODE_DATA_ELIMINATION in that we do NOT > want the sections to be collapsed at link time:
sorry - I'm a little confused and was wondering if you could clarify something. Does this mean you expect CONFIG_FG_KASLR=y and CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y to be a valid config? I am not familiar with the option, but it seems like you are saying that it requires sections to be collapsed, in which case both of these options as yes would not be allowed? Should I actively prevent this in the Kconfig? Thanks. Kristen > > #ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION > #define TEXT_MAIN .text .text.[0-9a-zA-Z_]* > > (I think I had fixed this in some earlier version?) > > I think you want this (untested): > > > diff --git a/Makefile b/Makefile > index 04f5662ae61a..a0d9acd3b900 100644 > --- a/Makefile > +++ b/Makefile > @@ -853,8 +853,11 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH > KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called- > once) > endif > > +ifneq ($(CONFIG_LD_DEAD_CODE_DATA_ELIMINATION)$(CONFIG_FG_KASLR),) > +KBUILD_CFLAGS_KERNEL += -ffunction-sections > +endif > ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION > -KBUILD_CFLAGS_KERNEL += -ffunction-sections -fdata-sections > +KBUILD_CFLAGS_KERNEL += -fdata-sections > LDFLAGS_vmlinux += --gc-sections > endif > > diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm- > generic/vmlinux.lds.h > index 71e387a5fe90..5f5c692751dd 100644 > --- a/include/asm-generic/vmlinux.lds.h > +++ b/include/asm-generic/vmlinux.lds.h > @@ -93,20 +93,31 @@ > * sections to be brought in with rodata. > */ > #ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION > -#define TEXT_MAIN .text .text.[0-9a-zA-Z_]* > #define DATA_MAIN .data .data.[0-9a-zA-Z_]* .data..LPBX* > #define SDATA_MAIN .sdata .sdata.[0-9a-zA-Z_]* > #define RODATA_MAIN .rodata .rodata.[0-9a-zA-Z_]* > #define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* > #define SBSS_MAIN .sbss .sbss.[0-9a-zA-Z_]* > #else > -#define TEXT_MAIN .text > #define DATA_MAIN .data > #define SDATA_MAIN .sdata > #define RODATA_MAIN .rodata > #define BSS_MAIN .bss > #define SBSS_MAIN .sbss > #endif > +/* > + * Both LD_DEAD_CODE_DATA_ELIMINATION and CONFIG_FG_KASLR options > enable > + * -ffunction-sections, which produces separately named .text > sections. In > + * the case of CONFIG_FG_KASLR, they need to stay distinct so they > can be > + * separately randomized. Without CONFIG_FG_KASLR, the separate > .text > + * sections can be collected back into a common section, which makes > the > + * resulting image slightly smaller. > + */ > +#if defined(CONFIG_LD_DEAD_CODE_DATA_ELIMINATION) && > !defined(CONFIG_FG_KASLR) > +#define TEXT_MAIN .text .text.[0-9a-zA-Z_]* > +#else > +#define TEXT_MAIN .text > +#endif
