On Tue, Jun 23, 2020 at 10:23:17AM -0700, Kristen Carlson Accardi wrote: > Function Granular Kernel Address Space Layout Randomization (fgkaslr) I've built and booted this successfully with both GCC/bfd and Clang/lld: gcc (Ubuntu 9.3.0-10ubuntu2) 9.3.0 GNU ld (GNU Binutils for Ubuntu) 2.34 clang version 11.0.0 (https://github.com/llvm/llvm-project.git c32d695b099109118dbd50dd697fffe23cd9a529) LLD 11.0.0 (https://github.com/llvm/llvm-project.git c32d695b099109118dbd50dd697fffe23cd9a529) Tested-by: Kees Cook <keescook@xxxxxxxxxxxx> Clang + objtool is a bit noisy, but I haven't investigated why: kernel/panic.o: warning: objtool: .text.nmi_panic: unexpected end of section kernel/panic.o: warning: objtool: .text.__warn_printk: unexpected end of section kernel/cred.o: warning: objtool: .text.exit_creds: unexpected end of section kernel/cred.o: warning: objtool: .text.get_task_cred: unexpected end of section kernel/cred.o: warning: objtool: .text.cred_alloc_blank: unexpected end of section kernel/cred.o: warning: objtool: .text.abort_creds: unexpected end of section kernel/cred.o: warning: objtool: .text.prepare_creds: unexpected end of section kernel/cred.o: warning: objtool: .text.copy_creds: unexpected end of section kernel/cred.o: warning: objtool: .text.override_creds: unexpected end of section kernel/cred.o: warning: objtool: .text.revert_creds: unexpected end of section kernel/cred.o: warning: objtool: .text.prepare_kernel_cred: unexpected end of section And when interacting with my orphan-section series[1], this patch is needed to keep from getting A LOT of warnings. ;) diff --git a/arch/x86/Makefile b/arch/x86/Makefile index af3d004d9a7e..de687ffa4966 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -57,9 +57,14 @@ ifndef CONFIG_FG_KASLR endif endif +ifndef CONFIG_FG_KASLR # We never want expected sections to be placed heuristically by the # linker. All sections should be explicitly named in the linker script. +# However, without a way to provide a wildcard mapping from input +# sections named .text.* to identically named output sections, this +# can only be used with FGKASLR is disabled. LDFLAGS_vmlinux += --orphan-handling=warn +endif # # Prevent GCC from generating any FP code by mistake. [1] https://lore.kernel.org/lkml/20200624014940.1204448-1-keescook@xxxxxxxxxxxx/ -- Kees Cook
