linux-kernel - Re: [PATCH] kbuild: use -flive-patching when CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181219165428.5udrppedpdvf2u7k@treble>
Date:   Wed, 19 Dec 2018 10:54:28 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Miroslav Benes <mbenes@...e.cz>
Cc:     yamada.masahiro@...ionext.com, michal.lkml@...kovi.net,
        jeyu@...nel.org, jikos@...nel.org, pmladek@...e.com,
        linux-kbuild@...r.kernel.org, live-patching@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kbuild: use -flive-patching when CONFIG_LIVEPATCH is
 enabled

On Wed, Dec 19, 2018 at 03:17:44PM +0100, Miroslav Benes wrote:
> GCC 9 introduces a new option, -flive-patching. It disables certain
> optimizations which could make a compilation unsafe for later live
> patching of the running kernel.
> 
> The option is used only if CONFIG_LIVEPATCH is enabled and $(CC)
> supports it.
> 
> Signed-off-by: Miroslav Benes <mbenes@...e.cz>
> ---
>  Makefile | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/Makefile b/Makefile
> index a0650bf79606..53f5ab810efe 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -778,6 +778,10 @@ KBUILD_CFLAGS_KERNEL	+= $(call cc-option,-ffunction-sections,)
>  KBUILD_CFLAGS_KERNEL	+= $(call cc-option,-fdata-sections,)
>  endif
>  
> +ifdef CONFIG_LIVEPATCH
> +KBUILD_CFLAGS += $(call cc-option, -flive-patching=inline-clone)
> +endif
> +
>  # arch Makefile may override CC so keep this after arch Makefile is included
>  NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)


This option only makes sense for source-based patch generation, so isn't
it a bit premature to make this change without proper source-based patch
tooling?

Also the commit message needs an analysis of the performance impacts.

-- 
Josh