kbuild: Steal gcc's pie from the very beginning

PATCH In review Borislav Petkov 3 participants 5 messages Nov 14, 2016 – Nov 15, 2016 Kbuild

lore

Share & tools

lore

Borislav Petkov

author

2016-11-14 18:51 UTC #0 lore raw

PATCH 1/1 kbuild: Steal gcc's pie from the very beginning

From: Borislav Petkov <[email protected]>

So Sebastian turned off the PIE for kernel builds but that was too late
- Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc options with, say cc-disable-warning, fails:

gcc -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs
...
-Wno-sign-compare -fno-asynchronous-unwind-tables -Wframe-address -c -x c /dev/null -o .31392.tmp /dev/null:1:0: error: code model kernel does not support PIC mode

because that returns an error and we can't disable the warning. For example in this case:

KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)

which leads to gcc issuing all those warnings again.

So let's turn off PIE/PIC at the earliest possible moment, when we declare KBUILD_CFLAGS so that cc-disable-warning picks it up too.

Signed-off-by Borislav Petkov <[email protected]>

Cc Ben Hutchings <[email protected]>

Cc Michal Marek <[email protected]>

Cc Sebastian Andrzej Siewior <[email protected]>

---
 Makefile | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

Makefile +3 -4

index 3ff1fb26d8b2..5558cc5b1505 100644
@@ -399,11 +399,12 @@ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
 		   -fno-strict-aliasing -fno-common \
 		   -Werror-implicit-function-declaration \
 		   -Wno-format-security \
-		   -std=gnu89
+		   -std=gnu89 -fno-PIE
+
 
 KBUILD_AFLAGS_KERNEL :=
 KBUILD_CFLAGS_KERNEL :=
-KBUILD_AFLAGS   := -D__ASSEMBLY__
+KBUILD_AFLAGS   := -D__ASSEMBLY__ -fno-PIE
 KBUILD_AFLAGS_MODULE  := -DMODULE
 KBUILD_CFLAGS_MODULE  := -DMODULE
 KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds

@@ -621,8 +622,6 @@ include arch/$(SRCARCH)/Makefile
 
 KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
 KBUILD_CFLAGS	+= $(call cc-disable-warning,frame-address,)
-KBUILD_CFLAGS	+= $(call cc-option,-fno-PIE)
-KBUILD_AFLAGS	+= $(call cc-option,-fno-PIE)
 
 ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
 KBUILD_CFLAGS	+= $(call cc-option,-ffunction-sections,)

Signature · 1 line

2.10.0

Sebastian Andrzej Siewior

Acked-by on v1 1/1

2016-11-14 20:15 UTC #1 lore raw

Quoted 11 lines · Borislav Petkov

From: Borislav Petkov <[email protected]>
So Sebastian turned off the PIE for kernel builds but that was too late
- Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc options with, say cc-disable-warning, fails:
gcc -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs
...
-Wno-sign-compare -fno-asynchronous-unwind-tables -Wframe-address -c -x c /dev/null -o .31392.tmp /dev/null:1:0: error: code model kernel does not support PIC mode

Quoted 6 lines

because that returns an error and we can't disable the warning. For example in this case:
KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)
which leads to gcc issuing all those warnings again.

This also means that all feature tests fail unless the -fno-PIE is there.

Acked-by Sebastian Andrzej Siewior <[email protected]>

This thing gcc v3.4 only but I intend to update the min requirement to alteast gcc v3.4 to cover this. As per hpa gcc v3.4 is the lowest version should be used for x86…

Sebastian

Borislav Petkov

author

2016-11-14 20:45 UTC #2 lore raw

PATCH 1/1 kbuild: Steal gcc's pie from the very beginning

Quoted 8 lines · Sebastian Andrzej Siewior

This also means that all feature tests fail unless the -fno-PIE is there.
Acked-by Sebastian Andrzej Siewior <[email protected]>
This thing gcc v3.4 only but I intend to update the min requirement to alteast gcc v3.4 to cover this. As per hpa gcc v3.4 is the lowest version should be used for x86…

Ah yes, here's a v1.1.

Let's leave the cc-option check until we sort out the min supported gcc version.

CC stable too.

Thanks!

---
From: Borislav Petkov <[email protected]>
Date: Mon, 14 Nov 2016 19:41:31 +0100
Subject: [PATCH] kbuild: Steal gcc's pie from the very beginning

So Sebastian turned off the PIE for kernel builds but that was too late
- Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc options with, say cc-disable-warning, fails:

because that returns an error and we can't disable the warning. For example in this case:

KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)

which leads to gcc issuing all those warnings again.

So let's turn off PIE/PIC at the earliest possible moment, when we declare KBUILD_CFLAGS so that cc-disable-warning picks it up too.

Also, we need the $(call cc-option ...) because -fno-PIE is supported since gcc v3.4 and our lowest supported gcc version is 3.2 right now.

Signed-off-by Borislav Petkov <[email protected]>

Cc [email protected]

Cc Ben Hutchings <[email protected]>

Cc Michal Marek <[email protected]>

Cc Sebastian Andrzej Siewior <[email protected]>

---
 Makefile | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

Makefile +3 -4

index 3ff1fb26d8b2..9bc877d073d7 100644
@@ -399,11 +399,12 @@ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
 		   -fno-strict-aliasing -fno-common \
 		   -Werror-implicit-function-declaration \
 		   -Wno-format-security \
-		   -std=gnu89
+		   -std=gnu89 $(call cc-option,-fno-PIE)
+
 
 KBUILD_AFLAGS_KERNEL :=
 KBUILD_CFLAGS_KERNEL :=
-KBUILD_AFLAGS   := -D__ASSEMBLY__
+KBUILD_AFLAGS   := -D__ASSEMBLY__ $(call cc-option,-fno-PIE)
 KBUILD_AFLAGS_MODULE  := -DMODULE
 KBUILD_CFLAGS_MODULE  := -DMODULE
 KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds

@@ -621,8 +622,6 @@ include arch/$(SRCARCH)/Makefile
 
 KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
 KBUILD_CFLAGS	+= $(call cc-disable-warning,frame-address,)
-KBUILD_CFLAGS	+= $(call cc-option,-fno-PIE)
-KBUILD_AFLAGS	+= $(call cc-option,-fno-PIE)
 
 ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
 KBUILD_CFLAGS	+= $(call cc-option,-ffunction-sections,)

Signature · 7 lines

2.10.0

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.

Michal Marek

2016-11-15 16:08 UTC #3 lore raw

Quoted 23 lines · Borislav Petkov

From: Borislav Petkov <[email protected]>
Date: Mon, 14 Nov 2016 19:41:31 +0100
Subject: [PATCH] kbuild: Steal gcc's pie from the very beginning
So Sebastian turned off the PIE for kernel builds but that was too late
- Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc options with, say cc-disable-warning, fails:
gcc -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs
...
-Wno-sign-compare -fno-asynchronous-unwind-tables -Wframe-address -c -x c /dev/null -o .31392.tmp /dev/null:1:0: error: code model kernel does not support PIC mode
because that returns an error and we can't disable the warning. For example in this case:
KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)
which leads to gcc issuing all those warnings again.
So let's turn off PIE/PIC at the earliest possible moment, when we declare KBUILD_CFLAGS so that cc-disable-warning picks it up too.

Quoted 8 lines

Also, we need the $(call cc-option ...) because -fno-PIE is supported since gcc v3.4 and our lowest supported gcc version is 3.2 right now.
Signed-off-by Borislav Petkov <[email protected]>
Cc [email protected]
Cc Ben Hutchings <[email protected]>
Cc Michal Marek <[email protected]>
Cc Sebastian Andrzej Siewior <[email protected]>

Thanks, applied to kbuild.git#rc-fixes.

Michal

Michal Marek

2016-11-14 20:45 UTC #4 lore raw

In reply to Borislav Petkov

Dne 14.11.2016 v 19:51 Borislav Petkov napsal(a):

Quoted 34 lines

From: Borislav Petkov <[email protected]>
So Sebastian turned off the PIE for kernel builds but that was too late
- Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc options with, say cc-disable-warning, fails:
gcc -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs
...
-Wno-sign-compare -fno-asynchronous-unwind-tables -Wframe-address -c -x c /dev/null -o .31392.tmp /dev/null:1:0: error: code model kernel does not support PIC mode
because that returns an error and we can't disable the warning. For example in this case:
KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)
which leads to gcc issuing all those warnings again.
So let's turn off PIE/PIC at the earliest possible moment, when we declare KBUILD_CFLAGS so that cc-disable-warning picks it up too.
Signed-off-by Borislav Petkov <[email protected]>
Cc Ben Hutchings <[email protected]>
Cc Michal Marek <[email protected]>
Cc Sebastian Andrzej Siewior <[email protected]>
---
 Makefile | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
Makefile +0 -0
index 3ff1fb26d8b2..5558cc5b1505 100644

Makefile KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ · line 402

Quoted 5 lines

Makefile +1 -1

@@ -399,11 +399,12 @@ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
 		   -fno-strict-aliasing -fno-common \
 		   -Werror-implicit-function-declaration \
 		   -Wno-format-security \
-		   -std=gnu89
+		   -std=gnu89 -fno-PIE

Please use the cc-option variant, otherwise good catch.

Michal