Messages in this thread | | | From | Sedat Dilek <> | Date | Wed, 15 Jul 2020 10:54:19 +0200 | Subject | Re: [PATCH v5 2/7] x86/boot/compressed: Force hidden visibility for all symbol references |
| |
On Wed, Jul 15, 2020 at 2:41 AM Arvind Sankar <nivedita@alum.mit.edu> wrote: > > From: Ard Biesheuvel <ardb@kernel.org> > > Eliminate all GOT entries in the decompressor binary, by forcing hidden > visibility for all symbol references, which informs the compiler that > such references will be resolved at link time without the need for > allocating GOT entries. > > To ensure that no GOT entries will creep back in, add an assertion to > the decompressor linker script that will fire if the .got section has > a non-zero size. > > [Arvind: move hidden.h to include/linux instead of making a copy] >
Tested-by: Sedat Dilek <sedat.dilek@gmail.com> Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Reported hidden.h breakage and asked for a follow-up.
- Sedat -
[1] https://marc.info/?l=linux-kernel&m=159056070321982&w=2
> Reviewed-by: Kees Cook <keescook@chromium.org> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org> > Acked-by: Arvind Sankar <nivedita@alum.mit.edu> > Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu> > From: Ard Biesheuvel <ardb@kernel.org> > Link: https://lore.kernel.org/r/20200523120021.34996-3-ardb@kernel.org > --- > arch/x86/boot/compressed/Makefile | 1 + > arch/x86/boot/compressed/vmlinux.lds.S | 1 + > drivers/firmware/efi/libstub/Makefile | 2 +- > drivers/firmware/efi/libstub/hidden.h | 6 ------ > include/linux/hidden.h | 19 +++++++++++++++++++ > 5 files changed, 22 insertions(+), 7 deletions(-) > delete mode 100644 drivers/firmware/efi/libstub/hidden.h > create mode 100644 include/linux/hidden.h > > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > index 7619742f91c9..c829d874dcac 100644 > --- a/arch/x86/boot/compressed/Makefile > +++ b/arch/x86/boot/compressed/Makefile > @@ -42,6 +42,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning, gnu) > KBUILD_CFLAGS += -Wno-pointer-sign > KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=) > KBUILD_CFLAGS += -fno-asynchronous-unwind-tables > +KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h > > KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ > GCOV_PROFILE := n > diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S > index b17d218ccdf9..4bcc943842ab 100644 > --- a/arch/x86/boot/compressed/vmlinux.lds.S > +++ b/arch/x86/boot/compressed/vmlinux.lds.S > @@ -81,6 +81,7 @@ SECTIONS > DISCARDS > } > > +ASSERT(SIZEOF(.got) == 0, "Unexpected GOT entries detected!") > #ifdef CONFIG_X86_64 > ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!") > #else > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile > index 4cce372edaf4..609157a40493 100644 > --- a/drivers/firmware/efi/libstub/Makefile > +++ b/drivers/firmware/efi/libstub/Makefile > @@ -27,7 +27,7 @@ cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \ > cflags-$(CONFIG_EFI_GENERIC_STUB) += -I$(srctree)/scripts/dtc/libfdt > > KBUILD_CFLAGS := $(cflags-y) -Os -DDISABLE_BRANCH_PROFILING \ > - -include $(srctree)/drivers/firmware/efi/libstub/hidden.h \ > + -include $(srctree)/include/linux/hidden.h \ > -D__NO_FORTIFY \ > $(call cc-option,-ffreestanding) \ > $(call cc-option,-fno-stack-protector) \ > diff --git a/drivers/firmware/efi/libstub/hidden.h b/drivers/firmware/efi/libstub/hidden.h > deleted file mode 100644 > index 3493b041f419..000000000000 > --- a/drivers/firmware/efi/libstub/hidden.h > +++ /dev/null > @@ -1,6 +0,0 @@ > -/* SPDX-License-Identifier: GPL-2.0 */ > -/* > - * To prevent the compiler from emitting GOT-indirected (and thus absolute) > - * references to any global symbols, override their visibility as 'hidden' > - */ > -#pragma GCC visibility push(hidden) > diff --git a/include/linux/hidden.h b/include/linux/hidden.h > new file mode 100644 > index 000000000000..49a17b6b5962 > --- /dev/null > +++ b/include/linux/hidden.h > @@ -0,0 +1,19 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * When building position independent code with GCC using the -fPIC option, > + * (or even the -fPIE one on older versions), it will assume that we are > + * building a dynamic object (either a shared library or an executable) that > + * may have symbol references that can only be resolved at load time. For a > + * variety of reasons (ELF symbol preemption, the CoW footprint of the section > + * that is modified by the loader), this results in all references to symbols > + * with external linkage to go via entries in the Global Offset Table (GOT), > + * which carries absolute addresses which need to be fixed up when the > + * executable image is loaded at an offset which is different from its link > + * time offset. > + * > + * Fortunately, there is a way to inform the compiler that such symbol > + * references will be satisfied at link time rather than at load time, by > + * giving them 'hidden' visibility. > + */ > + > +#pragma GCC visibility push(hidden) > -- > 2.26.2 >
| |