I didn't test DSE with explicit KEEP() in the previous mail. So, I will make up for it now. This test result is about DEAD_CODE_DATA_ELIMINATION (DCE) and dead syscalls elimination (DSE). It's based on config[1] and a simple hello.c initramfs. We set CONFIG_SYSCALLS_USED="sys_write sys_exit sys_reboot", which is used by hello.c to simply print "Hello" then exit and shut down qemu. | | syscall remain | vmlinux size | vmlinux after strip | | ------------------------------------------------------------ | -------------- | ---------------- | ------------------- | | disable DCE | 236 | 2559632 | 1963400 | | enable DCE | 208 | 2037384 (-20.4%) | 1485776 (-24.3%) | | enable DCE and DSE with explicit KEEP() of except table | 17 | 1899208 (-25.8%) | 1387272 (-29.3%) | | enable DCE and DSE without KEEP() (By SHF_GROUP method) | 3 | 1856640 (-27.6%) | 1354424 (-31.0%) | | enable DCE and DSE without KEEP() (By SHE_LINK_ORDER method) | 3 | 1856664 (-27.6%) | 1354424 (-31.0%) | It shows that dead syscalls elimination can save 7% of space based on DCE. Although no KEEP() can only save up 2% space, it can reduce the attack surface and eliminate the misuse of KEEP(). It ensures that every orphan section is not orphaned anymore. [1]: https://pastebin.com/KG4fd7aT
