linux-kernel - Re: [RFC] Don't create sframes during build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b2ae9afe-b919-45a3-b6ae-37c651c57981@debian.org>
Date: Thu, 4 Sep 2025 18:26:14 +0200
From: Matthias Klose <doko@...ian.org>
To: Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-kbuild@...r.kernel.org
Cc: Arnd Bergmann <arnd@...db.de>, Josh Poimboeuf <jpoimboe@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Nathan Chancellor
 <nathan@...nel.org>,
        Nicolas Schier <nicolas.schier@...ux.dev>,
        Binutils <binutils@...rceware.org>
Subject: Re: [RFC] Don't create sframes during build

On 9/4/25 16:02, Matthias Klose wrote:
> [ CCing binutils@...rceware.org ]
> 
> On 9/4/25 15:18, Sebastian Andrzej Siewior wrote:
>> Hi,
>>
>> gcc in Debian, starting with 15.2.0-2, 14.3.0-6 enables sframe
>> generation. Unless options like -ffreestanding are passed. Since this
>> isn't done, there are a few warnings during compile
> 
> If there are other options when sframe shouldn't be enabled, please tell.
> 
> Gentoo chose another approach, enabling sframe unconditionally in gas, 
> unless disabled by --gsframe=no.
> 
>> | crypto/chacha.o: warning: objtool: .sframe+0x30: data relocation 
>> to !ENDBR: chacha_stream_xor+0x0
>> | crypto/chacha.o: warning: objtool: .sframe+0x94: data relocation 
>> to !ENDBR: crypto_xchacha_crypt+0x0
>>
>> followed by warnings at the end
>>
>> |   AR      vmlinux.a
>> |   LD      vmlinux.o
>> | vmlinux.o: warning: objtool: .sframe+0x15c: data relocation to ! 
>> ENDBR: repair_env_string+0x0
>> | vmlinux.o: warning: objtool: .sframe+0x1c0: data relocation to ! 
>> ENDBR: run_init_process+0x0
>> | vmlinux.o: warning: objtool: .sframe+0x1d4: data relocation to ! 
>> ENDBR: try_to_run_init_process+0x0
>> | vmlinux.o: warning: objtool: .sframe+0x1e8: data relocation to ! 
>> ENDBR: rcu_read_unlock+0x0
>> …
>> | vmlinux.o: warning: objtool: .sframe+0x12765c: data relocation to ! 
>> ENDBR: get_eff_addr_reg+0x0
>> | vmlinux.o: warning: objtool: .sframe+0x1276ac: data relocation to ! 
>> ENDBR: get_seg_base_limit+0x0
>> |   OBJCOPY modules.builtin.modinfo
>>
>> followed by a boom
>> |   LD      .tmp_vmlinux1
>> | ld: error: unplaced orphan section `.sframe' from `vmlinux.o'
>>
>> We could drop the sframe during the final link but this does not get rid
>> of the objtool warnings so we would have to ignore them. But we don't
>> need it. So what about the following:
>>
>> diff --git a/Makefile b/Makefile
>> --- a/Makefile
>> +++ b/Makefile
>> @@ -886,6 +886,8 @@ ifdef CONFIG_CC_IS_GCC
>>   KBUILD_CFLAGS    += $(call cc-option,--param=allow-store-data-races=0)
>>   KBUILD_CFLAGS    += $(call cc-option,-fno-allow-store-data-races)
>>   endif
>> +# No sframe generation for kernel if enabled by default
>> +KBUILD_CFLAGS    += $(call cc-option,-Xassembler --gsframe=no)
>>   ifdef CONFIG_READABLE_ASM
>>   # Disable optimizations that make assembler listings hard to read.
> This is what I chose for package builds that need disablement of sframe.


Fyi, I will disable that again next week, until sframe v3 is ready.