diff mbox

[RFC] kbuild: add -fno-PIE

Message ID 874m41mz4h.fsf@turtle.gmx.de (mailing list archive)
State New, archived
Headers show

Commit Message

Sven Joachim Oct. 24, 2016, 5:32 p.m. UTC
On 2016-10-24 09:43 +0200, Sebastian Andrzej Siewior wrote:

> On 2016-10-24 09:38:49 [+0200], Sven Joachim wrote:
>> 
>> But make still fails with it. :-(
>
> try setting CONFIG_CC_STACKPROTECTOR_NONE=y and please let me know if
> the resulting kernel built with v3.2 gcc boots & works.

Sorry, I don't have gcc 3.2 around, and my gcc 3.3 environment produces
assembler errors in arch/x86/entry/entry_32.S.  Maybe binutils 2.15 is
not recent enough anymore?

Anyway, with CONFIG_CC_STACKPROTECTOR=y it is necessary to add -fno-pie
in scripts/gcc-x86_64-has-stack-protector.sh as well, because that
script invokes the compiler without KBUILD_CFLAGS.  That's probably not
a problem since -fstack-protector is newer than -fno-pie.  The attached
patch works for me with Debian's gcc-6 package.

Cheers,
       Sven

Comments

Joe Perches Oct. 24, 2016, 5:48 p.m. UTC | #1
On Mon, 2016-10-24 at 19:32 +0200, Sven Joachim wrote:

(in the attachment)
> +KBUILD_CFLAGS  += $(call cc-option,-fno-pie,)

trivia:

The trailing comma is not necessary though the Makefile
is a bit inconsistent about this.

$ git grep "KBUILD_CFLAGS.*call cc-option" Makefile
Makefile:KBUILD_CFLAGS  += $(call cc-option,-fno-delete-null-pointer-checks,)
Makefile:KBUILD_CFLAGS  += $(call cc-option,-ffunction-sections,)
Makefile:KBUILD_CFLAGS  += $(call cc-option,-fdata-sections,)
Makefile:KBUILD_CFLAGS  += $(call cc-option,--param=allow-store-data-races=0)
Makefile:KBUILD_CFLAGS += $(call cc-option,-fno-reorder-blocks,) \
Makefile:KBUILD_CFLAGS += $(call cc-option,-Wframe-larger-than=${CONFIG_FRAME_WARN})
Makefile:KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,)
Makefile:KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior)
Makefile:KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
Makefile:KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
Makefile:KBUILD_CFLAGS  += $(call cc-option, -gdwarf-4,)
Makefile:KBUILD_CFLAGS  += $(call cc-option, -femit-struct-debug-baseonly) \
Makefile:KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
Makefile:KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
Makefile:KBUILD_CFLAGS  += $(call cc-option,-fno-strict-overflow)
Makefile:KBUILD_CFLAGS   += $(call cc-option,-fconserve-stack)
Makefile:KBUILD_CFLAGS   += $(call cc-option,-Werror=implicit-int)
Makefile:KBUILD_CFLAGS   += $(call cc-option,-Werror=strict-prototypes)
Makefile:KBUILD_CFLAGS   += $(call cc-option,-Werror=date-time)
Makefile:KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Sebastian Andrzej Siewior Oct. 25, 2016, 7:30 a.m. UTC | #2
On 2016-10-24 19:32:30 [+0200], Sven Joachim wrote:
> On 2016-10-24 09:43 +0200, Sebastian Andrzej Siewior wrote:
> 
> > On 2016-10-24 09:38:49 [+0200], Sven Joachim wrote:
> >> 
> >> But make still fails with it. :-(
> >
> > try setting CONFIG_CC_STACKPROTECTOR_NONE=y and please let me know if
> > the resulting kernel built with v3.2 gcc boots & works.
> 
> Sorry, I don't have gcc 3.2 around, and my gcc 3.3 environment produces
> assembler errors in arch/x86/entry/entry_32.S.  Maybe binutils 2.15 is
> not recent enough anymore?

so we use stone age gcc but take latest binutils and kernel? What about
lifting the limit of gcc 3.2? Is there any use case in 2016 to use gcc
3.2 on a recent kernel except whether it still compiles or not?

Sebastian
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Sven Joachim Oct. 26, 2016, 5:51 p.m. UTC | #3
On 2016-10-25 09:30 +0200, Sebastian Andrzej Siewior wrote:

> On 2016-10-24 19:32:30 [+0200], Sven Joachim wrote:
>> On 2016-10-24 09:43 +0200, Sebastian Andrzej Siewior wrote:
>> 
>> > On 2016-10-24 09:38:49 [+0200], Sven Joachim wrote:
>> >> 
>> >> But make still fails with it. :-(
>> >
>> > try setting CONFIG_CC_STACKPROTECTOR_NONE=y and please let me know if
>> > the resulting kernel built with v3.2 gcc boots & works.
>> 
>> Sorry, I don't have gcc 3.2 around, and my gcc 3.3 environment produces
>> assembler errors in arch/x86/entry/entry_32.S.  Maybe binutils 2.15 is
>> not recent enough anymore?

I have done a few more tests, and I can confirm that binutils 2.17 is
the oldest version that works.  Also, I have succeeded installing gcc
3.2 in a Debian 4.0 chroot now.

> so we use stone age gcc but take latest binutils and kernel? What about
> lifting the limit of gcc 3.2?

Would probably make sense, since gcc 3.2 cannot compile kernel/bounds.c,
at least not on x86.

,----
|   CC      kernel/bounds.s
| In file included from /tmp/linux/arch/x86/include/asm/bitops.h:512,
|                  from include/linux/bitops.h:22,
|                  from include/linux/kernel.h:10,
|                  from include/asm-generic/bug.h:13,
|                  from /tmp/linux/arch/x86/include/asm/bug.h:38,
|                  from include/linux/bug.h:4,
|                  from include/linux/page-flags.h:9,
|                  from kernel/bounds.c:9:
| /tmp/linux/arch/x86/include/asm/arch_hweight.h: In function `__arch_hweight32':
| /tmp/linux/arch/x86/include/asm/arch_hweight.h:29: syntax error before string constant
| make[1]: *** [kernel/bounds.s] Error 1
`----

Building with gcc 3.3 is apparently still possible, although it produces
tons of warnings and a modpost section mismatch.  Still, requiring gcc
4.1 or newer would not be unreasonable, I think (still released a few
months earlier than binutils 2.17).

Cheers,
       Sven
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Sebastian Andrzej Siewior Oct. 27, 2016, 7:28 a.m. UTC | #4
Hi Andrew,

On 2016-10-26 19:51:03 [+0200], Sven Joachim wrote:
> On 2016-10-25 09:30 +0200, Sebastian Andrzej Siewior wrote:
> 
> > On 2016-10-24 19:32:30 [+0200], Sven Joachim wrote:
> >> On 2016-10-24 09:43 +0200, Sebastian Andrzej Siewior wrote:
> >> 
> >> > On 2016-10-24 09:38:49 [+0200], Sven Joachim wrote:
> >> >> 
> >> >> But make still fails with it. :-(
> >> >
> >> > try setting CONFIG_CC_STACKPROTECTOR_NONE=y and please let me know if
> >> > the resulting kernel built with v3.2 gcc boots & works.
> >> 
> >> Sorry, I don't have gcc 3.2 around, and my gcc 3.3 environment produces
> >> assembler errors in arch/x86/entry/entry_32.S.  Maybe binutils 2.15 is
> >> not recent enough anymore?
> 
> I have done a few more tests, and I can confirm that binutils 2.17 is
> the oldest version that works.  Also, I have succeeded installing gcc
> 3.2 in a Debian 4.0 chroot now.
> 
> > so we use stone age gcc but take latest binutils and kernel? What about
> > lifting the limit of gcc 3.2?
> 
> Would probably make sense, since gcc 3.2 cannot compile kernel/bounds.c,
> at least not on x86.
> 
> ,----
> |   CC      kernel/bounds.s
> | In file included from /tmp/linux/arch/x86/include/asm/bitops.h:512,
> |                  from include/linux/bitops.h:22,
> |                  from include/linux/kernel.h:10,
> |                  from include/asm-generic/bug.h:13,
> |                  from /tmp/linux/arch/x86/include/asm/bug.h:38,
> |                  from include/linux/bug.h:4,
> |                  from include/linux/page-flags.h:9,
> |                  from kernel/bounds.c:9:
> | /tmp/linux/arch/x86/include/asm/arch_hweight.h: In function `__arch_hweight32':
> | /tmp/linux/arch/x86/include/asm/arch_hweight.h:29: syntax error before string constant
> | make[1]: *** [kernel/bounds.s] Error 1
> `----
> 
> Building with gcc 3.3 is apparently still possible, although it produces
> tons of warnings and a modpost section mismatch.  Still, requiring gcc
> 4.1 or newer would not be unreasonable, I think (still released a few
> months earlier than binutils 2.17).

I remember you had once a server box running some enterprise distro
which had an old gcc. Do you see any reason for not lifting the minimum
gcc version to v4.1 ?

> Cheers,
>        Sven

Sebastian
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Andrew Morton Oct. 28, 2016, 11 p.m. UTC | #5
On Thu, 27 Oct 2016 09:28:24 +0200 Sebastian Andrzej Siewior <bigeasy@linutronix.de> wrote:

> > Building with gcc 3.3 is apparently still possible, although it produces
> > tons of warnings and a modpost section mismatch.  Still, requiring gcc
> > 4.1 or newer would not be unreasonable, I think (still released a few
> > months earlier than binutils 2.17).
> 
> I remember you had once a server box running some enterprise distro
> which had an old gcc. Do you see any reason for not lifting the minimum
> gcc version to v4.1 ?

Seems OK to me.  I do have a gcc-3.4.5 for mips, sh and sparc64 sitting
around but I basically never use them and should update.

--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tomas Janousek Oct. 29, 2016, 10:10 a.m. UTC | #6
Hi Sven,

On Mon, Oct 24, 2016 at 07:32:30PM +0200, Sven Joachim wrote:
> The attached patch works for me with Debian's gcc-6 package.

I tried your patch when building 4.8.5 on an up-to-date Debian testing and
still got this:

  AS      arch/x86/entry/vdso/vdso32/note.o
arch/x86/entry/vdso/vdso32/note.S:1:0: sorry, unimplemented: -mfentry isn’t supported for 32-bit in combination with -fpic

Adding KBUILD_AFLAGS += $(call cc-option,-fno-pie,) helps.
(Maybe that should be as-option instead. Don't know. There are lots of
AFLAGS=$(call cc-option, ...) in the Makefiles, anyway.)
Sven Joachim Oct. 29, 2016, 5:03 p.m. UTC | #7
On 2016-10-29 12:10 +0200, Tomas Janousek wrote:

> On Mon, Oct 24, 2016 at 07:32:30PM +0200, Sven Joachim wrote:
>> The attached patch works for me with Debian's gcc-6 package.
>
> I tried your patch when building 4.8.5 on an up-to-date Debian testing and
> still got this:
>
>   AS      arch/x86/entry/vdso/vdso32/note.o
> arch/x86/entry/vdso/vdso32/note.S:1:0: sorry, unimplemented: -mfentry
> isn’t supported for 32-bit in combination with -fpic

I cannot reproduce that, FWIW.  Also, arch/x86/entry/vdso/Makefile seems
to explicitly filter out -mfentry from the compiler flags, but maybe I
misunderstand something.

Could you please show the exact command that's failing with "make V=1"?

> Adding KBUILD_AFLAGS += $(call cc-option,-fno-pie,) helps.
> (Maybe that should be as-option instead. Don't know. There are lots of
> AFLAGS=$(call cc-option, ...) in the Makefiles, anyway.)

This is what Ubuntu is doing, so it works at least for them, I suppose.

Cheers,
       Sven
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tomas Janousek Oct. 29, 2016, 7:21 p.m. UTC | #8
On Sat, Oct 29, 2016 at 07:03:30PM +0200, Sven Joachim wrote:
> I cannot reproduce that, FWIW.  Also, arch/x86/entry/vdso/Makefile seems
> to explicitly filter out -mfentry from the compiler flags, but maybe I
> misunderstand something.

Compiler flags, yes; assembler flags, no. Perhaps adding

    KBUILD_AFLAGS_32 := $(filter-out -mfentry,$(KBUILD_AFLAGS_32))

to arch/x86/entry/vdso/Makefile would fix the build as well. I have honestly
no idea which solution is better. :-)

> Could you please show the exact command that's failing with "make V=1"?

gcc -Wp,-MD,arch/x86/entry/vdso/vdso32/.note.o.d  -nostdinc -isystem /usr/lib/gcc/i686-linux-gnu/6/include -I./arch/x86/include -I./arch/x86/include/generated/uapi -I./arch/x86/include/generated  -I./include -I./arch/x86/include/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/kconfig.h -D__KERNEL__ -D__ASSEMBLY__ -DCONFIG_X86_X32_ABI -DCONFIG_AS_CFI=1 -DCONFIG_AS_CFI_SIGNAL_FRAME=1 -DCONFIG_AS_CFI_SECTIONS=1 -DCONFIG_AS_FXSAVEQ=1 -DCONFIG_AS_SSSE3=1 -DCONFIG_AS_CRC32=1 -DCONFIG_AS_AVX=1 -DCONFIG_AS_AVX2=1 -DCONFIG_AS_SHA1_NI=1 -DCONFIG_AS_SHA256_NI=1 -Wa,-gdwarf-2 -mfentry -DCC_USING_FENTRY -DCC_HAVE_ASM_GOTO -DBUILD_VDSO -m32   -c -o arch/x86/entry/vdso/vdso32/note.o arch/x86/entry/vdso/vdso32/note.S

Is this file being built with your .config?
Sven Joachim Oct. 29, 2016, 9:18 p.m. UTC | #9
On 2016-10-29 21:21 +0200, Tomas Janousek wrote:

> On Sat, Oct 29, 2016 at 07:03:30PM +0200, Sven Joachim wrote:
>> I cannot reproduce that, FWIW.  Also, arch/x86/entry/vdso/Makefile seems
>> to explicitly filter out -mfentry from the compiler flags, but maybe I
>> misunderstand something.
>
> Compiler flags, yes; assembler flags, no. Perhaps adding
>
>     KBUILD_AFLAGS_32 := $(filter-out -mfentry,$(KBUILD_AFLAGS_32))
>
> to arch/x86/entry/vdso/Makefile would fix the build as well. I have honestly
> no idea which solution is better. :-)
>
>> Could you please show the exact command that's failing with "make V=1"?
>
> gcc -Wp,-MD,arch/x86/entry/vdso/vdso32/.note.o.d -nostdinc -isystem
> /usr/lib/gcc/i686-linux-gnu/6/include -I./arch/x86/include
> -I./arch/x86/include/generated/uapi -I./arch/x86/include/generated
> -I./include -I./arch/x86/include/uapi -I./include/uapi
> -I./include/generated/uapi -include ./include/linux/kconfig.h
> -D__KERNEL__ -D__ASSEMBLY__ -DCONFIG_X86_X32_ABI -DCONFIG_AS_CFI=1
> -DCONFIG_AS_CFI_SIGNAL_FRAME=1 -DCONFIG_AS_CFI_SECTIONS=1
> -DCONFIG_AS_FXSAVEQ=1 -DCONFIG_AS_SSSE3=1 -DCONFIG_AS_CRC32=1
> -DCONFIG_AS_AVX=1 -DCONFIG_AS_AVX2=1 -DCONFIG_AS_SHA1_NI=1
> -DCONFIG_AS_SHA256_NI=1 -Wa,-gdwarf-2 -mfentry -DCC_USING_FENTRY
> -DCC_HAVE_ASM_GOTO -DBUILD_VDSO -m32 -c -o
> arch/x86/entry/vdso/vdso32/note.o arch/x86/entry/vdso/vdso32/note.S
>
> Is this file being built with your .config?

Yes, and "-mfentry -DCC_USING_FENTRY" is missing from the gcc
commandline there.  And not only there, although I have
CONFIG_FUNCTION_TRACER=y and CONFIG_HAVE_FENTRY=y, which should cause it
to be added to KBUILD_CFLAGS and KBUILD_AFLAGS.

I don't understand that, but it's late in the evening here.

Cheers,
       Sven
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

From 2c72542688476168920c027cdc28c6764387ecac Mon Sep 17 00:00:00 2001
From: Sven Joachim <svenjoac@gmx.de>
Date: Mon, 24 Oct 2016 18:17:26 +0200
Subject: [PATCH] kbuild: add -fno-pie to KBUILD_CFLAGS

If GCC is configured with --enable-default-pie, the build fails early
because this default is incompatible with -mcmodel=kernel.

kernel/bounds.c:1:0: error: code model kernel does not support PIC mode

Avoid that by adding -fno-pie to KBUILD_CFLAGS, if supported by the
compiler.  This flag is also needed in the x86_64 stack-protector test
script which otherwise errors out.

Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong available but compiler is broken

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841420 and
https://bugs.launchpad.net/ubuntu/+source/gcc-defaults/+bug/1574982.

Signed-off-by: Sven Joachim <svenjoac@gmx.de>
---
 Makefile                                  | 1 +
 scripts/gcc-x86_64-has-stack-protector.sh | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 93beca4..81ef816 100644
--- a/Makefile
+++ b/Makefile
@@ -619,6 +619,7 @@  ARCH_AFLAGS :=
 ARCH_CFLAGS :=
 include arch/$(SRCARCH)/Makefile
 
+KBUILD_CFLAGS	+= $(call cc-option,-fno-pie,)
 KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
 KBUILD_CFLAGS	+= $(call cc-disable-warning,maybe-uninitialized,)
 KBUILD_CFLAGS	+= $(call cc-disable-warning,frame-address,)
diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
index 973e8c1..274cba1 100755
--- a/scripts/gcc-x86_64-has-stack-protector.sh
+++ b/scripts/gcc-x86_64-has-stack-protector.sh
@@ -1,6 +1,6 @@ 
 #!/bin/sh
 
-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-pie -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
 if [ "$?" -eq "0" ] ; then
 	echo y
 else
-- 
2.10.1