> On Feb 6, 2020, at 11:41 AM, Kristen Carlson Accardi <kristen@xxxxxxxxxxxxxxx> wrote: > > On Thu, 2020-02-06 at 04:26 -0800, Kees Cook wrote: >>> On Wed, Feb 05, 2020 at 02:39:45PM -0800, Kristen Carlson Accardi >>> wrote: >>> We will be using -ffunction-sections to place each function in >>> it's own text section so it can be randomized at load time. The >>> linker considers these .text.* sections "orphaned sections", and >>> will place them after the first similar section (.text). However, >>> we need to move _etext so that it is after both .text and .text.* >>> We also need to calculate text size to include .text AND .text.* >> >> The dependency on the linker's orphan section handling is, I feel, >> rather fragile (during work on CFI and generally building kernels >> with >> Clang's LLD linker, we keep tripping over difference between how BFD >> and >> LLD handle orphans). However, this is currently no way to perform a >> section "pass through" where input sections retain their name as an >> output section. (If anyone knows a way to do this, I'm all ears). >> >> Right now, you can only collect sections like this: >> >> .text : AT(ADDR(.text) - LOAD_OFFSET) { >> *(.text.*) >> } >> >> or let them be orphans, which then the linker attempts to find a >> "similar" (code, data, etc) section to put them near: >> https://sourceware.org/binutils/docs-2.33.1/ld/Orphan-Sections.html >> >> So, basically, yes, this works, but I'd like to see BFD and LLD grow >> some kind of /PASSTHRU/ special section (like /DISCARD/), that would >> let >> a linker script specify _where_ these sections should roughly live. >> >> Related thoughts: >> >> I know x86_64 stack alignment is 16 bytes. I cannot find evidence for >> what function start alignment should be. It seems the linker is 16 >> byte >> aligning these functions, when I think no alignment is needed for >> function starts, so we're wasting some memory (average 8 bytes per >> function, at say 50,000 functions, so approaching 512KB) between >> functions. If we can specify a 1 byte alignment for these orphan >> sections, that would be nice, as mentioned in the cover letter: we >> lose >> a 4 bits of entropy to this alignment, since all randomized function >> addresses will have their low bits set to zero. > > So, when I was developing this patch set, I initially ignored the value > of sh_addralign and just packed the functions in one right after > another when I did the new layout. They were byte aligned :). I later > realized that I should probably pay attention to alignment and thus > started respecting the value that was in sh_addralign. There is > actually nothing stopping me from ignoring it again, other than I am > concerned that I will make runtime performance suffer even more than I > already have. If you start randomizing *data* sections, then alignment matters. Also, in the shiny new era of Intel-CPUs-can’t-handle-Jcc-spanning-a-cacheline, function alignment may actually matter. Sigh. The symptom will be horrible maybe-exploitable crashes on old microcode and “minimal performance impact” on new microcode. In this context, “minimal” may actually mean “huge, throw away your CPU and replace it with one from a different vendor.” Of course, there doesn’t appear to be anything resembling credible public documentation for any of this.