linux-kernel - Re: [PATCH 1/2] arch/x86: Use -fno-asynchronous-unwind-tables to suppress .eh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKwvOdkoy_oaZP1fxybJu23f+V0fyrESzFO63UZenUDy+5290A@mail.gmail.com>
Date:   Mon, 24 Feb 2020 13:22:10 -0800
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Fangrui Song <maskray@...gle.com>
Cc:     Arvind Sankar <nivedita@...m.mit.edu>,
        Borislav Petkov <bp@...en8.de>,
        Nathan Chancellor <natechancellor@...il.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        clang-built-linux <clang-built-linux@...glegroups.com>,
        Michael Matz <matz@...e.de>, Kees Cook <keescook@...omium.org>,
        Ard Biesheuvel <ardb@...nel.org>
Subject: Re: [PATCH 1/2] arch/x86: Use -fno-asynchronous-unwind-tables to
 suppress .eh_frame sections

On Mon, Feb 24, 2020 at 1:17 PM Nick Desaulniers
<ndesaulniers@...gle.com> wrote:
>
> On Mon, Feb 24, 2020 at 1:12 PM Fangrui Song <maskray@...gle.com> wrote:
> >
> > On 2020-02-24, Arvind Sankar wrote:
> > >On Mon, Feb 24, 2020 at 12:33:49PM -0800, Nick Desaulniers wrote:
> > >> On Sun, Feb 23, 2020 at 11:37 AM Arvind Sankar <nivedita@...m.mit.edu> wrote:
> > >> >
> > >> > While discussing a patch to discard .eh_frame from the compressed
> > >> > vmlinux using the linker script, Fangrui Song pointed out [1] that these
> > >> > sections shouldn't exist in the first place because arch/x86/Makefile
> > >> > uses -fno-asynchronous-unwind-tables.
> > >>
> > >> Another benefit is that -fno-asynchronous-unwind-tables may help
> > >> reduce the size of .text!
> > >> https://stackoverflow.com/a/26302715/1027966
> > >
> > >Hm I don't see any change in .text size.
> > >> > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> > >> > index 98a81576213d..a1140c4ee478 100644
> > >> > --- a/drivers/firmware/efi/libstub/Makefile
> > >> > +++ b/drivers/firmware/efi/libstub/Makefile
> > >> > @@ -12,7 +12,8 @@ cflags-$(CONFIG_X86)          += -m$(BITS) -D__KERNEL__ -O2 \
> > >> >                                    -mno-mmx -mno-sse -fshort-wchar \
> > >> >                                    -Wno-pointer-sign \
> > >> >                                    $(call cc-disable-warning, address-of-packed-member) \
> > >> > -                                  $(call cc-disable-warning, gnu)
> > >> > +                                  $(call cc-disable-warning, gnu) \
> > >> > +                                  -fno-asynchronous-unwind-tables
> > >>
> > >> I think we want to add this flag a little lower, line 27 has:
> > >>
> > >> KBUILD_CFLAGS     := $(cflags-y) -DDISABLE_BRANCH_PROFILING \
> > >>
> > >> so the `cflags-y` variable you modify in this hunk will only set
> > >> -fno-asynchronous-unwind-tables for CONFIG_X86, which I don't think is
> > >> intentional.  Though when I run
> > >
> > >It is intentional -- the other case is that we're building for ARM,
> > >which only filters out the regular KBUILD_CFLAGS, so adding the flag for
> > >it should not be necessary. The cflags for ARM are constructed by
> > >manipulating KBUILD_CFLAGS. Besides it may or may not want unwind
> > >tables. 32-bit ARM appears to have an option to enable -funwind-tables.
>
> Ah, right the `subst` from `KBUILD_CFLAGS`.
> Are there other architectures that care about EFI beyond x86 and ARM? IA64?

Looks like while IA64 supports CONFIG_EFI, it doesn't support
CONFIG_EFI_STUB, which controls whether drivers/firmware/efi/libstub/
gets built or not. So that patch should be good to go.

Reviewed-by: Nick Desaulniers <ndesaulniers@...gle.com>

>
> >
> > clang (as of today) has not implemented the
> > -funwind-tables/-fasynchronous-unwind-tables distinction as GCC does..
> > (probably because not many people care..)
>
> Ah, thanks for the clarification.
>
> >
> > >>
> > >> $ llvm-readelf -S drivers/firmware/efi/libstub/lib.a | grep eh_frame
> > >>
> > >> after doing an x86_64 defconfig, I don't get any hits. Do you observe
> > >> .eh_frame sections on any of these objects in this dir? (I'm fine
> > >> adding it to be safe, but I'm curious why I'm not seeing any
> > >> .eh_frame)
> > >>
> > >
> > >You mean before this patch, right? I see hits on every .o file in there
> > >(compiling with gcc 9.2.0).
> > >
> > >> >
> > >> >  # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
> > >> >  # disable the stackleak plugin
> > >> > --
> > >> > 2.24.1
> > >> >
>
>
>
> --
> Thanks,
> ~Nick Desaulniers



-- 
Thanks,
~Nick Desaulniers