linux-kernel - Re: [RFC PATCH 2/4] Kbuild: Introduce Kconfig symbol for linking vmlinux with relocations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAK7LNAT7YLZAeX+x+TMN30KwDfs4c5DM=mh7w_FWmv082xTztg@mail.gmail.com>
Date: Sat, 8 Mar 2025 03:58:48 +0900
From: Masahiro Yamada <masahiroy@...nel.org>
To: Ard Biesheuvel <ardb+git@...gle.com>
Cc: linux-kernel@...r.kernel.org, x86@...nel.org, linux-kbuild@...r.kernel.org, 
	Ard Biesheuvel <ardb@...nel.org>, Ingo Molnar <mingo@...nel.org>
Subject: Re: [RFC PATCH 2/4] Kbuild: Introduce Kconfig symbol for linking
 vmlinux with relocations

On Mon, Feb 24, 2025 at 10:21 PM Ard Biesheuvel <ardb+git@...gle.com> wrote:
>
> From: Ard Biesheuvel <ardb@...nel.org>
>
> Some architectures build vmlinux with static relocations preserved, but
> strip them again from the final vmlinux image. Arch specific tools
> consume these static relocations in order to construct relocation tables
> for KASLR.
>
> The fact that vmlinux is created, consumed and subsequently updated goes
> against the typical, declarative paradigm used by Make, which is based
> on rules and dependencies. So as a first step towards cleaning this up,
> introduce a Kconfig symbol to declare that the arch wants to consume the
> static relocations emitted into vmlinux. This will be wired up further
> in subsequent patches.
>
> Signed-off-by: Ard Biesheuvel <ardb@...nel.org>

I have no objection to this patch.

The code diff seems a good clean-up.


> ---
>  Makefile            | 4 ++++
>  arch/Kconfig        | 7 +++++++
>  arch/mips/Kconfig   | 1 +
>  arch/mips/Makefile  | 4 ----
>  arch/riscv/Kconfig  | 1 +
>  arch/riscv/Makefile | 2 +-
>  arch/s390/Kconfig   | 1 +
>  arch/s390/Makefile  | 2 +-
>  arch/x86/Kconfig    | 1 +
>  arch/x86/Makefile   | 6 ------
>  10 files changed, 17 insertions(+), 12 deletions(-)
>
> diff --git a/Makefile b/Makefile
> index 30dab4c8b012..a3302dce56de 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -1119,6 +1119,10 @@ ifdef CONFIG_LD_ORPHAN_WARN
>  LDFLAGS_vmlinux += --orphan-handling=$(CONFIG_LD_ORPHAN_WARN_LEVEL)
>  endif
>
> +ifneq ($(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS),)
> +LDFLAGS_vmlinux        += --emit-relocs --discard-none
> +endif
> +
>  # Align the bit size of userspace programs with the kernel
>  KBUILD_USERCFLAGS  += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS))
>  KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS))
> diff --git a/arch/Kconfig b/arch/Kconfig
> index b8a4ff365582..101a13fcde8e 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -1695,6 +1695,13 @@ config ARCH_HAS_KERNEL_FPU_SUPPORT
>           Architectures that select this option can run floating-point code in
>           the kernel, as described in Documentation/core-api/floating-point.rst.
>
> +config ARCH_VMLINUX_NEEDS_RELOCS
> +       bool
> +       help
> +         Whether the architecture needs vmlinux to be built with static
> +         relocations preserved. This is used by some architectures to
> +         construct bespoke relocation tables for KASLR.
> +
>  source "kernel/gcov/Kconfig"
>
>  source "scripts/gcc-plugins/Kconfig"
> diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
> index 1924f2d83932..5aedbd7afadb 100644
> --- a/arch/mips/Kconfig
> +++ b/arch/mips/Kconfig
> @@ -2617,6 +2617,7 @@ config RELOCATABLE
>                    CPU_MIPS32_R6 || CPU_MIPS64_R6 || \
>                    CPU_P5600 || CAVIUM_OCTEON_SOC || \
>                    CPU_LOONGSON64
> +       select ARCH_VMLINUX_NEEDS_RELOCS
>         help
>           This builds a kernel image that retains relocation information
>           so it can be loaded someplace besides the default 1MB.
> diff --git a/arch/mips/Makefile b/arch/mips/Makefile
> index be8cb44a89fd..d9057e29bc62 100644
> --- a/arch/mips/Makefile
> +++ b/arch/mips/Makefile
> @@ -100,10 +100,6 @@ LDFLAGS_vmlinux                    += -G 0 -static -n -nostdlib
>  KBUILD_AFLAGS_MODULE           += -mlong-calls
>  KBUILD_CFLAGS_MODULE           += -mlong-calls
>
> -ifeq ($(CONFIG_RELOCATABLE),y)
> -LDFLAGS_vmlinux                        += --emit-relocs
> -endif
> -
>  cflags-y += -ffreestanding
>
>  cflags-$(CONFIG_CPU_BIG_ENDIAN)                += -EB
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index 7612c52e9b1e..6f5800114416 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -1077,6 +1077,7 @@ config RELOCATABLE
>         bool "Build a relocatable kernel"
>         depends on MMU && 64BIT && !XIP_KERNEL
>         select MODULE_SECTIONS if MODULES
> +       select ARCH_VMLINUX_NEEDS_RELOCS
>         help
>            This builds a kernel as a Position Independent Executable (PIE),
>            which retains all relocation metadata required to relocate the
> diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
> index 13fbc0f94238..6ef0d10e0c50 100644
> --- a/arch/riscv/Makefile
> +++ b/arch/riscv/Makefile
> @@ -8,7 +8,7 @@
>
>  LDFLAGS_vmlinux := -z norelro
>  ifeq ($(CONFIG_RELOCATABLE),y)
> -       LDFLAGS_vmlinux += -shared -Bsymbolic -z notext --emit-relocs
> +       LDFLAGS_vmlinux += -shared -Bsymbolic -z notext
>         KBUILD_CFLAGS += -fPIE
>  endif
>  ifeq ($(CONFIG_DYNAMIC_FTRACE),y)
> diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
> index 9c9ec08d78c7..ea67b7317138 100644
> --- a/arch/s390/Kconfig
> +++ b/arch/s390/Kconfig
> @@ -630,6 +630,7 @@ endchoice
>
>  config RELOCATABLE
>         def_bool y
> +       select ARCH_VMLINUX_NEEDS_RELOCS
>         help
>           This builds a kernel image that retains relocation information
>           so it can be loaded at an arbitrary address.
> diff --git a/arch/s390/Makefile b/arch/s390/Makefile
> index 5fae311203c2..d5f4be440879 100644
> --- a/arch/s390/Makefile
> +++ b/arch/s390/Makefile
> @@ -15,7 +15,7 @@ KBUILD_CFLAGS_MODULE += -fPIC
>  KBUILD_AFLAGS  += -m64
>  KBUILD_CFLAGS  += -m64
>  KBUILD_CFLAGS  += -fPIC
> -LDFLAGS_vmlinux        := -no-pie --emit-relocs --discard-none
> +LDFLAGS_vmlinux        := -no-pie
>  extra_tools    := relocs
>  aflags_dwarf   := -Wa,-gdwarf-2
>  KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index be2c311f5118..2005d80ff8d1 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2199,6 +2199,7 @@ config RANDOMIZE_BASE
>  config X86_NEED_RELOCS
>         def_bool y
>         depends on RANDOMIZE_BASE || (X86_32 && RELOCATABLE)
> +       select ARCH_VMLINUX_NEEDS_RELOCS
>
>  config PHYSICAL_ALIGN
>         hex "Alignment value to which kernel should be aligned"
> diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> index 5b773b34768d..f65ed6dcd6fb 100644
> --- a/arch/x86/Makefile
> +++ b/arch/x86/Makefile
> @@ -251,12 +251,6 @@ endif
>
>  KBUILD_LDFLAGS += -m elf_$(UTS_MACHINE)
>
> -ifdef CONFIG_X86_NEED_RELOCS
> -LDFLAGS_vmlinux := --emit-relocs --discard-none
> -else
> -LDFLAGS_vmlinux :=
> -endif
> -
>  #
>  # The 64-bit kernel must be aligned to 2MB.  Pass -z max-page-size=0x200000 to
>  # the linker to force 2MB page size regardless of the default page size used
> --
> 2.48.1.601.g30ceb7b040-goog
>
>


-- 
Best Regards
Masahiro Yamada