| Message ID | 20200219000817.195049-13-samitolvanen@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v8,01/12] add support for Clang's Shadow Call Stack (SCS) | expand |
On Tue, Feb 18, 2020 at 04:08:17PM -0800, Sami Tolvanen wrote: > Disable SCS for the EFI stub and allow x18 to be used. > > Suggested-by: James Morse <james.morse@arm.com> > Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> -Kees > --- > drivers/firmware/efi/libstub/Makefile | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile > index 98a81576213d..dff9fa5a3f1c 100644 > --- a/drivers/firmware/efi/libstub/Makefile > +++ b/drivers/firmware/efi/libstub/Makefile > @@ -30,6 +30,9 @@ KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \ > $(call cc-option,-fno-stack-protector) \ > -D__DISABLE_EXPORTS > > +# remove SCS flags from all objects in this directory > +KBUILD_CFLAGS := $(filter-out -ffixed-x18 $(CC_FLAGS_SCS), $(KBUILD_CFLAGS)) > + > GCOV_PROFILE := n > KASAN_SANITIZE := n > UBSAN_SANITIZE := n > -- > 2.25.0.265.gbab2e86ba0-goog >
On Wed, 19 Feb 2020 at 01:09, Sami Tolvanen <samitolvanen@google.com> wrote: > > Disable SCS for the EFI stub and allow x18 to be used. > > Suggested-by: James Morse <james.morse@arm.com> > Signed-off-by: Sami Tolvanen <samitolvanen@google.com> > --- > drivers/firmware/efi/libstub/Makefile | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile > index 98a81576213d..dff9fa5a3f1c 100644 > --- a/drivers/firmware/efi/libstub/Makefile > +++ b/drivers/firmware/efi/libstub/Makefile > @@ -30,6 +30,9 @@ KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \ > $(call cc-option,-fno-stack-protector) \ > -D__DISABLE_EXPORTS > > +# remove SCS flags from all objects in this directory > +KBUILD_CFLAGS := $(filter-out -ffixed-x18 $(CC_FLAGS_SCS), $(KBUILD_CFLAGS)) > + I don't see why you'd need to remove -ffixed-x18 again here. Not using x18 anywhere in the kernel is a much more maintainable approach. In fact, now that I think of it, the EFI AArch64 platform binding forbids the use of x18, so it would be better to add the -ffixed-x18 unconditionally for arm64 (even though the reason it forbids it is to ensure compatibility with an OS using it as a platform register, and so nothing is actually broken atm). > GCOV_PROFILE := n > KASAN_SANITIZE := n > UBSAN_SANITIZE := n > -- > 2.25.0.265.gbab2e86ba0-goog >
On Tue, Feb 18, 2020 at 11:41 PM Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote: > > On Wed, 19 Feb 2020 at 01:09, Sami Tolvanen <samitolvanen@google.com> wrote: > > > > +# remove SCS flags from all objects in this directory > > +KBUILD_CFLAGS := $(filter-out -ffixed-x18 $(CC_FLAGS_SCS), $(KBUILD_CFLAGS)) > > + > > I don't see why you'd need to remove -ffixed-x18 again here. Not using > x18 anywhere in the kernel is a much more maintainable approach. Sure, I will drop -ffixed-x18 from here in v9. Thanks, Sami
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index 98a81576213d..dff9fa5a3f1c 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -30,6 +30,9 @@ KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \ $(call cc-option,-fno-stack-protector) \ -D__DISABLE_EXPORTS +# remove SCS flags from all objects in this directory +KBUILD_CFLAGS := $(filter-out -ffixed-x18 $(CC_FLAGS_SCS), $(KBUILD_CFLAGS)) + GCOV_PROFILE := n KASAN_SANITIZE := n UBSAN_SANITIZE := n
Disable SCS for the EFI stub and allow x18 to be used. Suggested-by: James Morse <james.morse@arm.com> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> --- drivers/firmware/efi/libstub/Makefile | 3 +++ 1 file changed, 3 insertions(+)