linux-kernel - Re: [PATCH v7 1/3] arm64: replace -pg with CC_FLAGS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Jan 2019 17:24:56 +0000
From:   Mark Rutland <mark.rutland@....com>
To:     Torsten Duwe <duwe@....de>
Cc:     Will Deacon <will.deacon@....com>,
        Catalin Marinas <catalin.marinas@....com>,
        Julien Thierry <julien.thierry@....com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Ingo Molnar <mingo@...hat.com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Arnd Bergmann <arnd@...db.de>,
        AKASHI Takahiro <takahiro.akashi@...aro.org>,
        Amit Daniel Kachhap <amit.kachhap@....com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        live-patching@...r.kernel.org
Subject: Re: [PATCH v7 1/3] arm64: replace -pg with CC_FLAGS_FTRACE in
 Makefiles

Hi Torsten,

On Fri, Jan 18, 2019 at 05:39:04PM +0100, Torsten Duwe wrote:
> Ftrace instrumentation might also be introduced by
> -fpatchable-function-entry, not only -pg. Ensure the Makefiles are
> flexible to filter out the respective flags in "notrace" directories.

I think this is a cleanup regardless of whether we use
-fpatchable-function-entry.

Can we please give this a more complete description, e.g.

| Currently arm64 makefiles assume that ftrace will use '-pg', and remove
| this flag specifically, rather than the contents of $(CC_FLAGS_FTRACE).
| 
| In preparation for arm64 supporting ftrace built on other compiler
| options, let's have the arm64 makefiles remove the $(CC_FLAGS_FTRACE)
| flags, whatever these may be, rather than assuming '-pg'. 
|
| There should be no functional change as a result of this patch.

> 
> Signed-off-by: Torsten Duwe <duwe@...e.de>
> 
> ---
>  arch/arm64/kernel/Makefile            |    6 +++---
>  drivers/firmware/efi/libstub/Makefile |    3 ++-

This misses arch/arm64/lib/Makefile and mm/kasan/makefile.

Could we please split this into three patches, addressing:

* arm64
* efistub
* kasan

... since those have distinct maintainers. All those patches can be part
of this series, but having them as separate patches is a bit nicer for
review.

>  2 files changed, 5 insertions(+), 4 deletions(-)
> --- a/arch/arm64/kernel/Makefile
> +++ b/arch/arm64/kernel/Makefile
> @@ -7,9 +7,9 @@ CPPFLAGS_vmlinux.lds	:= -DTEXT_OFFSET=$(
>  AFLAGS_head.o		:= -DTEXT_OFFSET=$(TEXT_OFFSET)
>  CFLAGS_armv8_deprecated.o := -I$(src)
>  
> -CFLAGS_REMOVE_ftrace.o = -pg
> -CFLAGS_REMOVE_insn.o = -pg
> -CFLAGS_REMOVE_return_address.o = -pg
> +CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
> +CFLAGS_REMOVE_insn.o = $(CC_FLAGS_FTRACE)
> +CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE)
>  
>  # Object file lists.
>  obj-y			:= debug-monitors.o entry.o irq.o fpsimd.o		\
> --- a/drivers/firmware/efi/libstub/Makefile
> +++ b/drivers/firmware/efi/libstub/Makefile
> @@ -16,7 +16,8 @@ cflags-$(CONFIG_X86)		+= -m$(BITS) -D__K
>  
>  # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
>  # disable the stackleak plugin
> -cflags-$(CONFIG_ARM64)		:= $(subst -pg,,$(KBUILD_CFLAGS)) -fpie \
> +cflags-$(CONFIG_ARM64)		:= $(filter-out $(CC_FLAGS_FTRACE)\
> +				  ,$(KBUILD_CFLAGS)) -fpie \
>  				   $(DISABLE_STACKLEAK_PLUGIN)

Why do we need to swtich to using filter-out. AFAICT, subst works just fine.

To keepthis legible, it would be nicer to split it like:

cflags-$(CONFIG_ARM64)			:= $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
					   -fpie $(DISABLE_STACKLEAK_PLUGIN)

>  cflags-$(CONFIG_ARM)		:= $(subst -pg,,$(KBUILD_CFLAGS)) \
>  				   -fno-builtin -fpic \

Please clean up this instance too, at least for consistency.

Thanks,
Mark.