linux-kernel - Re: [PATCH v4 2/2] x86/purgatory: use CFLAGS_REMOVE rather than reset KBUILD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Jul 2019 10:54:36 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Nick Desaulniers <ndesaulniers@...gle.com>
cc:     mingo@...hat.com, bp@...en8.de, peterz@...radead.org,
        clang-built-linux@...glegroups.com, linux-kernel@...r.kernel.org,
        yamada.masahiro@...ionext.com,
        Vaibhav Rustagi <vaibhavrustagi@...gle.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org
Subject: Re: [PATCH v4 2/2] x86/purgatory: use CFLAGS_REMOVE rather than
 reset KBUILD_CFLAGS

On Thu, 25 Jul 2019, Nick Desaulniers wrote:

> KBUILD_CFLAGS is very carefully built up in the top level Makefile,
> particularly when cross compiling or using different build tools.
> Resetting KBUILD_CFLAGS via := assignment is an antipattern.
> 
> The comment above the reset mentions that -pg is problematic.  Other
> Makefiles use `CFLAGS_REMOVE_file.o = $(CC_FLAGS_FTRACE)` when
> CONFIG_FUNCTION_TRACER is set. Prefer that pattern to wiping out all of
> the important KBUILD_CFLAGS then manually having to re-add them. Seems
> also that __stack_chk_fail references are generated when using
> CONFIG_STACKPROTECTOR or CONFIG_STACKPROTECTOR_STRONG.

Looking at the resulting build flags. Most stuff looks correct but there
are a few which need to be looked at twice.

removes:

 -ffreestanding
 -fno-builtin
 -fno-zero-initialized-in-bss

changes:

 -mcmodel=large to -mcmodel=kernel

adds:

  -mindirect-branch-register
  -mindirect-branch=thunk-extern

The latter makes me nervous. That probably wants to have retpoline disabled
as well. It's not having an instance right now, but ...

Thanks,

	tglx