linux-kernel - Re: [PATCH v4 2/2] x86/purgatory: use CFLAGS_REMOVE rather than reset KBUILD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 7 Aug 2019 15:17:21 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Nick Desaulniers <ndesaulniers@...gle.com>
cc:     mingo@...hat.com, bp@...en8.de, peterz@...radead.org,
        clang-built-linux@...glegroups.com, linux-kernel@...r.kernel.org,
        yamada.masahiro@...ionext.com,
        Vaibhav Rustagi <vaibhavrustagi@...gle.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org
Subject: Re: [PATCH v4 2/2] x86/purgatory: use CFLAGS_REMOVE rather than
 reset KBUILD_CFLAGS

On Fri, 26 Jul 2019, Thomas Gleixner wrote:

Ping...

> On Thu, 25 Jul 2019, Nick Desaulniers wrote:
> 
> > KBUILD_CFLAGS is very carefully built up in the top level Makefile,
> > particularly when cross compiling or using different build tools.
> > Resetting KBUILD_CFLAGS via := assignment is an antipattern.
> > 
> > The comment above the reset mentions that -pg is problematic.  Other
> > Makefiles use `CFLAGS_REMOVE_file.o = $(CC_FLAGS_FTRACE)` when
> > CONFIG_FUNCTION_TRACER is set. Prefer that pattern to wiping out all of
> > the important KBUILD_CFLAGS then manually having to re-add them. Seems
> > also that __stack_chk_fail references are generated when using
> > CONFIG_STACKPROTECTOR or CONFIG_STACKPROTECTOR_STRONG.
> 
> Looking at the resulting build flags. Most stuff looks correct but there
> are a few which need to be looked at twice.
> 
> removes:
> 
>  -ffreestanding
>  -fno-builtin
>  -fno-zero-initialized-in-bss
> 
> changes:
> 
>  -mcmodel=large to -mcmodel=kernel
> 
> adds:
> 
>   -mindirect-branch-register
>   -mindirect-branch=thunk-extern
> 
> The latter makes me nervous. That probably wants to have retpoline disabled
> as well. It's not having an instance right now, but ...
> 
> Thanks,
> 
> 	tglx
>