[PATCH stable v5.4] arm64: link with -z norelro for LLD or aarch64-elf

[PATCH stable v5.4] arm64: link with -z norelro for LLD or aarch64-elf

[Jisheng Zhang]

From: Nick Desaulniers <ndesaulniers@google.com>

commit 311bea3cb9ee20ef150ca76fc60a592bf6b159f5 upstream.

With GNU binutils 2.35+, linking with BFD produces warnings for vmlinux:
aarch64-linux-gnu-ld: warning: -z norelro ignored

BFD can produce this warning when the target emulation mode does not
support RELRO program headers, and -z relro or -z norelro is passed.

Alan Modra clarifies:
  The default linker emulation for an aarch64-linux ld.bfd is
  -maarch64linux, the default for an aarch64-elf linker is
  -maarch64elf.  They are not equivalent.  If you choose -maarch64elf
  you get an emulation that doesn't support -z relro.

The ARCH=arm64 kernel prefers -maarch64elf, but may fall back to
-maarch64linux based on the toolchain configuration.

LLD will always create RELRO program header regardless of target
emulation.

To avoid the above warning when linking with BFD, pass -z norelro only
when linking with LLD or with -maarch64linux.

Fixes: 3b92fa7485eb ("arm64: link with -z norelro regardless of CONFIG_RELOCATABLE")
Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options")
Cc: <stable@vger.kernel.org> # 5.0.x-
Reported-by: kernelci.org bot <bot@kernelci.org>
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Alan Modra <amodra@gmail.com>
Cc: Fāng-ruì Sòng <maskray@google.com>
Link: https://lore.kernel.org/r/20201218002432.788499-1-ndesaulniers@google.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
---
 arch/arm64/Makefile | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index cd8f3cdabfd0..d227cf87c48f 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -10,7 +10,7 @@
 #
 # Copyright (C) 1995-2001 by Russell King
 
-LDFLAGS_vmlinux	:=--no-undefined -X -z norelro
+LDFLAGS_vmlinux	:=--no-undefined -X
 CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET)
 GZFLAGS		:=-9
 
@@ -82,17 +82,21 @@ CHECKFLAGS	+= -D__AARCH64EB__
 AS		+= -EB
 # Prefer the baremetal ELF build target, but not all toolchains include
 # it so fall back to the standard linux version if needed.
-KBUILD_LDFLAGS	+= -EB $(call ld-option, -maarch64elfb, -maarch64linuxb)
+KBUILD_LDFLAGS	+= -EB $(call ld-option, -maarch64elfb, -maarch64linuxb -z norelro)
 UTS_MACHINE	:= aarch64_be
 else
 KBUILD_CPPFLAGS	+= -mlittle-endian
 CHECKFLAGS	+= -D__AARCH64EL__
 AS		+= -EL
 # Same as above, prefer ELF but fall back to linux target if needed.
-KBUILD_LDFLAGS	+= -EL $(call ld-option, -maarch64elf, -maarch64linux)
+KBUILD_LDFLAGS	+= -EL $(call ld-option, -maarch64elf, -maarch64linux -z norelro)
 UTS_MACHINE	:= aarch64
 endif
 
+ifeq ($(CONFIG_LD_IS_LLD), y)
+KBUILD_LDFLAGS	+= -z norelro
+endif
+
 CHECKFLAGS	+= -D__aarch64__
 
 ifeq ($(CONFIG_ARM64_MODULE_PLTS),y)
-- 
2.32.0

Re: [PATCH stable v5.4] arm64: link with -z norelro for LLD or aarch64-elf

[Nick Desaulniers]

On Thu, Jun 24, 2021 at 2:09 AM Jisheng Zhang
<Jisheng.Zhang@synaptics.com> wrote:
>
> From: Nick Desaulniers <ndesaulniers@google.com>
>
> commit 311bea3cb9ee20ef150ca76fc60a592bf6b159f5 upstream.
>
> With GNU binutils 2.35+, linking with BFD produces warnings for vmlinux:
> aarch64-linux-gnu-ld: warning: -z norelro ignored
>
> BFD can produce this warning when the target emulation mode does not
> support RELRO program headers, and -z relro or -z norelro is passed.
>
> Alan Modra clarifies:
>   The default linker emulation for an aarch64-linux ld.bfd is
>   -maarch64linux, the default for an aarch64-elf linker is
>   -maarch64elf.  They are not equivalent.  If you choose -maarch64elf
>   you get an emulation that doesn't support -z relro.
>
> The ARCH=arm64 kernel prefers -maarch64elf, but may fall back to
> -maarch64linux based on the toolchain configuration.
>
> LLD will always create RELRO program header regardless of target
> emulation.
>
> To avoid the above warning when linking with BFD, pass -z norelro only
> when linking with LLD or with -maarch64linux.
>
> Fixes: 3b92fa7485eb ("arm64: link with -z norelro thank you regardless of CONFIG_RELOCATABLE")

^ exists in 5.4 as 57a88e44b512

> Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options")

^ landed in v5.0-rc1

> Cc: <stable@vger.kernel.org> # 5.0.x-
> Reported-by: kernelci.org bot <bot@kernelci.org>
> Reported-by: Quentin Perret <qperret@google.com>
> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
> Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
> Acked-by: Ard Biesheuvel <ardb@kernel.org>
> Cc: Alan Modra <amodra@gmail.com>
> Cc: Fāng-ruì Sòng <maskray@google.com>
> Link: https://lore.kernel.org/r/20201218002432.788499-1-ndesaulniers@google.com
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> ---
>  arch/arm64/Makefile | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
> index cd8f3cdabfd0..d227cf87c48f 100644
> --- a/arch/arm64/Makefile
> +++ b/arch/arm64/Makefile
> @@ -10,7 +10,7 @@
>  #
>  # Copyright (C) 1995-2001 by Russell King
>
> -LDFLAGS_vmlinux        :=--no-undefined -X -z norelro
> +LDFLAGS_vmlinux        :=--no-undefined -X
>  CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET)
>  GZFLAGS                :=-9
>
> @@ -82,17 +82,21 @@ CHECKFLAGS  += -D__AARCH64EB__
>  AS             += -EB
>  # Prefer the baremetal ELF build target, but not all toolchains include
>  # it so fall back to the standard linux version if needed.
> -KBUILD_LDFLAGS += -EB $(call ld-option, -maarch64elfb, -maarch64linuxb)
> +KBUILD_LDFLAGS += -EB $(call ld-option, -maarch64elfb, -maarch64linuxb -z norelro)
>  UTS_MACHINE    := aarch64_be
>  else
>  KBUILD_CPPFLAGS        += -mlittle-endian
>  CHECKFLAGS     += -D__AARCH64EL__
>  AS             += -EL
>  # Same as above, prefer ELF but fall back to linux target if needed.
> -KBUILD_LDFLAGS += -EL $(call ld-option, -maarch64elf, -maarch64linux)
> +KBUILD_LDFLAGS += -EL $(call ld-option, -maarch64elf, -maarch64linux -z norelro)
>  UTS_MACHINE    := aarch64
>  endif
>
> +ifeq ($(CONFIG_LD_IS_LLD), y)
> +KBUILD_LDFLAGS += -z norelro
> +endif

^ ah but 5.4 doesn't have
commit b744b43f79cc ("kbuild: add CONFIG_LD_IS_LLD")
which landed in v5.8-rc1. So this patch will break LLD on 5.4. That
should be trivial to backport, but would you please send that first,
then this?

> +
>  CHECKFLAGS     += -D__aarch64__
>
>  ifeq ($(CONFIG_ARM64_MODULE_PLTS),y)
> --
> 2.32.0
>


--
Thanks,
~Nick Desaulniers

Re: [PATCH stable v5.4] arm64: link with -z norelro for LLD or aarch64-elf

[Greg Kroah-Hartman]

On Thu, Jun 24, 2021 at 05:09:19PM +0800, Jisheng Zhang wrote:
> From: Nick Desaulniers <ndesaulniers@google.com>
> 
> commit 311bea3cb9ee20ef150ca76fc60a592bf6b159f5 upstream.
> 
> With GNU binutils 2.35+, linking with BFD produces warnings for vmlinux:
> aarch64-linux-gnu-ld: warning: -z norelro ignored
> 
> BFD can produce this warning when the target emulation mode does not
> support RELRO program headers, and -z relro or -z norelro is passed.
> 
> Alan Modra clarifies:
>   The default linker emulation for an aarch64-linux ld.bfd is
>   -maarch64linux, the default for an aarch64-elf linker is
>   -maarch64elf.  They are not equivalent.  If you choose -maarch64elf
>   you get an emulation that doesn't support -z relro.
> 
> The ARCH=arm64 kernel prefers -maarch64elf, but may fall back to
> -maarch64linux based on the toolchain configuration.
> 
> LLD will always create RELRO program header regardless of target
> emulation.
> 
> To avoid the above warning when linking with BFD, pass -z norelro only
> when linking with LLD or with -maarch64linux.
> 
> Fixes: 3b92fa7485eb ("arm64: link with -z norelro regardless of CONFIG_RELOCATABLE")
> Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options")
> Cc: <stable@vger.kernel.org> # 5.0.x-
> Reported-by: kernelci.org bot <bot@kernelci.org>
> Reported-by: Quentin Perret <qperret@google.com>
> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
> Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
> Acked-by: Ard Biesheuvel <ardb@kernel.org>
> Cc: Alan Modra <amodra@gmail.com>
> Cc: Fāng-ruì Sòng <maskray@google.com>
> Link: https://lore.kernel.org/r/20201218002432.788499-1-ndesaulniers@google.com
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> ---
>  arch/arm64/Makefile | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)

Now queued up, thanks.

greg k-h

Re: [PATCH stable v5.4] arm64: link with -z norelro for LLD or aarch64-elf

[Jisheng Zhang]

Hi Greg,

On Fri, 25 Jun 2021 12:09:33 +0200
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:


> 
> On Thu, Jun 24, 2021 at 05:09:19PM +0800, Jisheng Zhang wrote:
> > From: Nick Desaulniers <ndesaulniers@google.com>
> >
> > commit 311bea3cb9ee20ef150ca76fc60a592bf6b159f5 upstream.
> >
> > With GNU binutils 2.35+, linking with BFD produces warnings for vmlinux:
> > aarch64-linux-gnu-ld: warning: -z norelro ignored
> >
> > BFD can produce this warning when the target emulation mode does not
> > support RELRO program headers, and -z relro or -z norelro is passed.
> >
> > Alan Modra clarifies:
> >   The default linker emulation for an aarch64-linux ld.bfd is
> >   -maarch64linux, the default for an aarch64-elf linker is
> >   -maarch64elf.  They are not equivalent.  If you choose -maarch64elf
> >   you get an emulation that doesn't support -z relro.
> >
> > The ARCH=arm64 kernel prefers -maarch64elf, but may fall back to
> > -maarch64linux based on the toolchain configuration.
> >
> > LLD will always create RELRO program header regardless of target
> > emulation.
> >
> > To avoid the above warning when linking with BFD, pass -z norelro only
> > when linking with LLD or with -maarch64linux.
> >
> > Fixes: 3b92fa7485eb ("arm64: link with -z norelro regardless of CONFIG_RELOCATABLE")
> > Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options")
> > Cc: <stable@vger.kernel.org> # 5.0.x-
> > Reported-by: kernelci.org bot <bot@kernelci.org>
> > Reported-by: Quentin Perret <qperret@google.com>
> > Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
> > Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
> > Acked-by: Ard Biesheuvel <ardb@kernel.org>
> > Cc: Alan Modra <amodra@gmail.com>
> > Cc: Fāng-ruì Sòng <maskray@google.com>

> > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> > ---
> >  arch/arm64/Makefile | 10 +++++++---
> >  1 file changed, 7 insertions(+), 3 deletions(-)  
> 
> Now queued up, thanks.
> 

I assume the two patches in v2 series are queued up. Nick pointed out
applying only this patch can break kernel building with lld.

Thanks

Re: [PATCH stable v5.4] arm64: link with -z norelro for LLD or aarch64-elf

[Greg Kroah-Hartman]

On Fri, Jun 25, 2021 at 06:12:30PM +0800, Jisheng Zhang wrote:
> Hi Greg,
> 
> On Fri, 25 Jun 2021 12:09:33 +0200
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
> 
> > 
> > On Thu, Jun 24, 2021 at 05:09:19PM +0800, Jisheng Zhang wrote:
> > > From: Nick Desaulniers <ndesaulniers@google.com>
> > >
> > > commit 311bea3cb9ee20ef150ca76fc60a592bf6b159f5 upstream.
> > >
> > > With GNU binutils 2.35+, linking with BFD produces warnings for vmlinux:
> > > aarch64-linux-gnu-ld: warning: -z norelro ignored
> > >
> > > BFD can produce this warning when the target emulation mode does not
> > > support RELRO program headers, and -z relro or -z norelro is passed.
> > >
> > > Alan Modra clarifies:
> > >   The default linker emulation for an aarch64-linux ld.bfd is
> > >   -maarch64linux, the default for an aarch64-elf linker is
> > >   -maarch64elf.  They are not equivalent.  If you choose -maarch64elf
> > >   you get an emulation that doesn't support -z relro.
> > >
> > > The ARCH=arm64 kernel prefers -maarch64elf, but may fall back to
> > > -maarch64linux based on the toolchain configuration.
> > >
> > > LLD will always create RELRO program header regardless of target
> > > emulation.
> > >
> > > To avoid the above warning when linking with BFD, pass -z norelro only
> > > when linking with LLD or with -maarch64linux.
> > >
> > > Fixes: 3b92fa7485eb ("arm64: link with -z norelro regardless of CONFIG_RELOCATABLE")
> > > Fixes: 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker script and options")
> > > Cc: <stable@vger.kernel.org> # 5.0.x-
> > > Reported-by: kernelci.org bot <bot@kernelci.org>
> > > Reported-by: Quentin Perret <qperret@google.com>
> > > Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
> > > Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
> > > Acked-by: Ard Biesheuvel <ardb@kernel.org>
> > > Cc: Alan Modra <amodra@gmail.com>
> > > Cc: Fāng-ruì Sòng <maskray@google.com>
> 
> > > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> > > ---
> > >  arch/arm64/Makefile | 10 +++++++---
> > >  1 file changed, 7 insertions(+), 3 deletions(-)  
> > 
> > Now queued up, thanks.
> > 
> 
> I assume the two patches in v2 series are queued up. Nick pointed out
> applying only this patch can break kernel building with lld.

Yes, I now took those instead, thanks.

greg k-h