Commit 527afc21 authored by Arvind Sankar's avatar Arvind Sankar Committed by Ingo Molnar
Browse files

x86/boot: Check that there are no run-time relocations 



Add a linker script check that there are no run-time relocations, and
remove the old one that tries to check via looking for specially-named
sections in the object files.

Drop the tests for -fPIE compiler option and -pie linker option, as they
are available in all supported gcc and binutils versions (as well as
clang and lld).

Signed-off-by: default avatarArvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Tested-by: default avatarNick Desaulniers <ndesaulniers@google.com>
Tested-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarArd Biesheuvel <ardb@kernel.org>
Reviewed-by: default avatarFangrui Song <maskray@google.com>
Reviewed-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
Link: https://lore.kernel.org/r/20200731230820.1742553-8-keescook@chromium.org
parent 3f086189

arch/x86/boot/compressed/Makefile

+3 −25
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma \ 
	vmlinux.bin.xz vmlinux.bin.lzo vmlinux.bin.lz4 vmlinux.bin.zst



KBUILD_CFLAGS := -m$(BITS) -O2

KBUILD_CFLAGS += -fno-strict-aliasing $(call cc-option, -fPIE, -fPIC)

KBUILD_CFLAGS += -fno-strict-aliasing -fPIE

KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING

cflags-$(CONFIG_X86_32) := -march=i386

cflags-$(CONFIG_X86_64) := -mcmodel=small
@@ -52,7 +52,7 @@ UBSAN_SANITIZE :=n 
KBUILD_LDFLAGS := -m elf_$(UTS_MACHINE)

# Compressed kernel should be built as PIE since it may be loaded at any

# address by the bootloader.

LDFLAGS_vmlinux := $(call ld-option, -pie) $(call ld-option, --no-dynamic-linker)

LDFLAGS_vmlinux := -pie $(call ld-option, --no-dynamic-linker)

LDFLAGS_vmlinux += -T



hostprogs	:= mkpiggy
@@ -87,30 +87,8 @@ vmlinux-objs-$(CONFIG_ACPI) += $(obj)/acpi.o 
vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o

efi-obj-$(CONFIG_EFI_STUB) = $(objtree)/drivers/firmware/efi/libstub/lib.a



# The compressed kernel is built with -fPIC/-fPIE so that a boot loader

# can place it anywhere in memory and it will still run. However, since

# it is executed as-is without any ELF relocation processing performed

# (and has already had all relocation sections stripped from the binary),

# none of the code can use data relocations (e.g. static assignments of

# pointer values), since they will be meaningless at runtime. This check

# will refuse to link the vmlinux if any of these relocations are found.

quiet_cmd_check_data_rel = DATAREL $@

define cmd_check_data_rel

	for obj in $(filter %.o,$^); do \

		$(READELF) -S $$obj | grep -qF .rel.local && { \

			echo "error: $$obj has data relocations!" >&2; \

			exit 1; \

		} || true; \

	done

endef



# We need to run two commands under "if_changed", so merge them into a

# single invocation.

quiet_cmd_check-and-link-vmlinux = LD      $@

      cmd_check-and-link-vmlinux = $(cmd_check_data_rel); $(cmd_ld)



$(obj)/vmlinux: $(vmlinux-objs-y) $(efi-obj-y) FORCE

	$(call if_changed,check-and-link-vmlinux)

	$(call if_changed,ld)



OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S

$(obj)/vmlinux.bin: vmlinux FORCE

arch/x86/boot/compressed/vmlinux.lds.S

+8 −0
Original line number Diff line number Diff line
@@ -42,6 +42,12 @@ SECTIONS 
		*(.rodata.*)

		_erodata = . ;

	}

	.rel.dyn : {

		*(.rel.*)

	}

	.rela.dyn : {

		*(.rela.*)

	}

	.got : {

		*(.got)

	}
@@ -85,3 +91,5 @@ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT en 
#else

ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0xc, "Unexpected GOT/PLT entries detected!")

#endif



ASSERT(SIZEOF(.rel.dyn) == 0 && SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations detected!")