On Thu, Mar 19, 2026 at 10:06 AM Fangrui Song <i@maskray.me> wrote:
> For x86, --no-rosegment -z noseparate-code -z max-page-size=2097152 is
> the most compact layout that works with transparent hugepages.
> Google and ChromeOS have been using such a layout for a long time.
--no-rosegment -z noseparate-code -z max-page-size=2097152 is somewhat
more compact than --no-rosegment -z separate-code -z
max-page-size=2097152. However, due to alignment, there is still a
sizable gap between the RE and RW segments, which significantly
increases the file size (e.g. hello world: 6K -> 2.1M). This is almost
impractical with 32M huge pages.
LOAD 0x0000000000000000 0x0000000000000000
0x0000000000000000
0x0000000000000738 0x0000000000000738 R E
0x200000
LOAD 0x00000000001ffe10 0x00000000003ffe10 0x00000000003ffe10
0x0000000000000200 0x0000000000000208 RW 0x200000
> If you use --rosegment to separate R and RX segments, there is a trade-off
>
> * With -z separate-code , THP works well for the code segment. The
> cost is massive file size inflation due to 2MiB padding between the R
> and R+X segments.
> * With -z noseparate-code, the RX segment starts at a non-aligned
> address. Last time I checked, Linux kernel's THP requires both the
> file offset and the VMA start to be huge-page-aligned, so the code
> segment cannot use THP.
It doesn’t seem to be the case anymore. With -z noseparate-code, the
RX segment now starts at offset 0, which works for alignment with any
huge page size. That’s also why I suggested putting the RX segment
first.
LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000738 0x0000000000000738 R E 0x1000
LOAD 0x0000000000000e10 0x0000000000001e10 0x0000000000001e10
0x0000000000000200 0x0000000000000208 RW 0x1000
> "In -z noseparate-code layouts, the file content starts somewhere at
> the first page, potentially wasting half a huge page on unrelated
> content." However, the file size saving advantage outweighs this THP
> concern.
> (https://maskray.me/blog/2023-12-17-exploring-the-section-layout-in-linker-output)
>
>
> Gadget avoidance has always been more security theater than substance.
Agreed.
Thanks,
Rui