Re: [PATCH] x86: assemble with -Wa,--noexecstack to avoid BFD 2.39 warning

[Nick Desaulniers]

On Mon, Aug 8, 2022 at 12:31 PM Nathan Chancellor <nathan@xxxxxxxxxx> wrote:
>
> On Mon, Aug 08, 2022 at 12:23:05PM -0700, Nick Desaulniers wrote:
> > Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instance
> > of a new warning when linking kernels in the form:
> >
> >   ld: warning: arch/x86/realmode/rm/bioscall.o: missing .note.GNU-stack
> >   section implies executable stack
> >   ld: NOTE: This behaviour is deprecated and will be removed in a future
> >   version of the linker
> >
> > The object files producing these all happen to be out of line assembler
> > sources (*.S files).
> >
> > Generally, we would like to avoid the stack being executable. Because
> > there could be a need for the stack to be executable, assembler sources
> > have to opt-in to this security feature via explicit creation of the
> > .note.GNU-stack feature (which compilers create by default) or command
> > line flag --noexecstack.
> >
> > Boot tested defconfig and i386_defconfig in QEMU. If any assembler
> > sources do require executable stack, they can be built with
> > -Wa,--execstack, though the linker warning would have to be disabled. We
> > might need to extend this more generally to the top level Makefile for
> > all architectures, but I'm not equipped to test the result of such a
> > change.
> >
> > LLVM's LLD linker defaults to -z noexecstack, so this flag isn't
> > strictly necessary when linking with LLD, only BFD, but it doesn't hurt
> > to be explicit here for all linkers IMO.
> >
> > Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06f73@xxxxxxxxx/
> > Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
> > Link: https://github.com/llvm/llvm-project/issues/57009
> > Reported-by: Jens Axboe <axboe@xxxxxxxxx>
> > Signed-off-by: Nick Desaulniers <ndesaulniers@xxxxxxxxxx>
>
> FWIW, this warning appears for other architectures, as I have seen it
> with powerpc and s390 and there is also a patch for ARM:
>
> https://lore.kernel.org/20220721204709.445216-1-ben-linux@xxxxxxxxx/
>
> Perhaps this should be done for all architectures in the main Makefile?

Thanks for the link; I recall Ard mentioning the ELF segments are
ignored by the kernels loader in another thread.

Perhaps we should be adding
--no-warn-execstack
wrapped in an ld-option check to KBUILD_LDFLAGS at the top level?

>
> > ---
> >  arch/x86/Makefile                 | 2 ++
> >  arch/x86/boot/Makefile            | 2 +-
> >  arch/x86/boot/compressed/Makefile | 2 +-
> >  arch/x86/realmode/rm/Makefile     | 2 +-
> >  4 files changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> > index 7854685c5f25..571546775725 100644
> > --- a/arch/x86/Makefile
> > +++ b/arch/x86/Makefile
> > @@ -159,6 +159,8 @@ else
> >          KBUILD_CFLAGS += -mcmodel=kernel
> >  endif
> >
> > +KBUILD_AFLAGS        += -Wa,--noexecstack
> > +
> >  #
> >  # If the function graph tracer is used with mcount instead of fentry,
> >  # '-maccumulate-outgoing-args' is needed to prevent a GCC bug
> > diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
> > index b5aecb524a8a..d7f2130f2277 100644
> > --- a/arch/x86/boot/Makefile
> > +++ b/arch/x86/boot/Makefile
> > @@ -67,7 +67,7 @@ targets += cpustr.h
> >  # ---------------------------------------------------------------------------
> >
> >  KBUILD_CFLAGS        := $(REALMODE_CFLAGS) -D_SETUP
> > -KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__
> > +KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack
> >  KBUILD_CFLAGS        += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
> >  KBUILD_CFLAGS        += -fno-asynchronous-unwind-tables
> >  GCOV_PROFILE := n
> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
> > index 19e1905dcbf6..1587a21a132d 100644
> > --- a/arch/x86/boot/compressed/Makefile
> > +++ b/arch/x86/boot/compressed/Makefile
> > @@ -57,7 +57,7 @@ KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h
> >  # that the compiler finds it even with out-of-tree builds (make O=/some/path).
> >  CFLAGS_sev.o += -I$(objtree)/arch/x86/lib/
> >
> > -KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
> > +KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack
> >  GCOV_PROFILE := n
> >  UBSAN_SANITIZE :=n
> >
> > diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
> > index 83f1b6a56449..5f2fdafaa034 100644
> > --- a/arch/x86/realmode/rm/Makefile
> > +++ b/arch/x86/realmode/rm/Makefile
> > @@ -73,7 +73,7 @@ $(obj)/realmode.relocs: $(obj)/realmode.elf FORCE
> >
> >  KBUILD_CFLAGS        := $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \
> >                  -I$(srctree)/arch/x86/boot
> > -KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__
> > +KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack
> >  KBUILD_CFLAGS        += -fno-asynchronous-unwind-tables
> >  GCOV_PROFILE := n
> >  UBSAN_SANITIZE := n
> > --
> > 2.37.1.559.g78731f0fdb-goog
> >



-- 
Thanks,
~Nick Desaulniers