[patch] Upstream patch

kernel-fno-pie.patch (text/plain), 6.18 KB, created by Magnus Granberg on 2016-11-16 20:41:38 UTC

Patches from https://git.kernel.org/cgit/linux/kernel/git/mmarek/kbuild.git/?h=rc-fixes

From 8ae94224c9d72fc4d9aaac93b2d7833cf46d7141 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <[e-mail]>
Date: Fri, 4 Nov 2016 19:39:38 +0100
Subject: kbuild: add -fno-PIE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Debian started to build the gcc with -fPIE by default so the kernel
build ends before it starts properly with:
|kernel/bounds.c:1:0: error: code model kernel does not support PIC mode

Also add to KBUILD_AFLAGS due to:

|gcc -Wp,-MD,arch/x86/entry/vdso/vdso32/.note.o.d … -mfentry -DCC_USING_FENTRY … vdso/vdso32/note.S
|arch/x86/entry/vdso/vdso32/note.S:1:0: sorry, unimplemented: -mfentry isn’t supported for 32-bit in combination with -fpic

Tagging it stable so it is possible to compile recent stable kernels as
well.

Cc: [e-mail]
Signed-off-by: Sebastian Andrzej Siewior <[e-mail]>
Signed-off-by: Michal Marek <[e-mail]>
---
 Makefile | 2 ++
 1 file changed, 2 insertions(+)

#diff --git a/Makefile b/Makefile
#index 512e47a..58fc5d9 100644
#--- a/Makefile
#+++ b/Makefile
#@@ -622,6 +622,8 @@ include arch/$(SRCARCH)/Makefile
# KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
# KBUILD_CFLAGS	+= $(call cc-disable-warning,maybe-uninitialized,)
# KBUILD_CFLAGS	+= $(call cc-disable-warning,frame-address,)
#+KBUILD_CFLAGS	+= $(call cc-option,-fno-PIE)
#+KBUILD_AFLAGS	+= $(call cc-option,-fno-PIE)
# 
# ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
# KBUILD_CFLAGS	+= $(call cc-option,-ffunction-sections,)

From 82031ea29e454b574bc6f49a33683a693ca5d907 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <[e-mail]>
Date: Fri, 4 Nov 2016 19:39:39 +0100
Subject: scripts/has-stack-protector: add -fno-PIE

Adding -no-PIE to the fstack protector check. -no-PIE was introduced
before -fstack-protector so there is no need for a runtime check.

Without it the build stops:
|Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong available but compiler is broken

due to -mcmodel=kernel + -fPIE if -fPIE is enabled by default.

Tagging it stable so it is possible to compile recent stable kernels as
well.

Cc: [e-mail]
Signed-off-by: Sebastian Andrzej Siewior <[e-mail]>
Signed-off-by: Michal Marek <[e-mail]>
---
 scripts/gcc-x86_64-has-stack-protector.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
index 973e8c1..17867e7 100755
--- a/scripts/gcc-x86_64-has-stack-protector.sh
+++ b/scripts/gcc-x86_64-has-stack-protector.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
 if [ "$?" -eq "0" ] ; then
 	echo y
 else
-- 
cgit v0.12
From 90944e40ba1838de4b2a9290cf273f9d76bd3bdd Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <[e-mail]>
Date: Fri, 4 Nov 2016 19:39:40 +0100
Subject: x86/kexec: add -fno-PIE

If the gcc is configured to do -fPIE by default then the build aborts
later with:
| Unsupported relocation type: unknown type rel type name (29)

Tagging it stable so it is possible to compile recent stable kernels as
well.

Cc: [e-mail]
Signed-off-by: Sebastian Andrzej Siewior <[e-mail]>
Signed-off-by: Michal Marek <[e-mail]>
---
 arch/x86/purgatory/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index ac58c16..555b9fa 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -16,6 +16,7 @@ KCOV_INSTRUMENT := n
 
 KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large
 KBUILD_CFLAGS += -m$(BITS)
+KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
 
 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
 		$(call if_changed,ld)
-- 
cgit v0.12
From c6a385539175ebc603da53aafb7753d39089f32e Mon Sep 17 00:00:00 2001
From: Borislav Petkov <[e-mail]>
Date: Mon, 14 Nov 2016 19:41:31 +0100
Subject: kbuild: Steal gcc's pie from the very beginning

So Sebastian turned off the PIE for kernel builds but that was too late
- Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc
options with, say cc-disable-warning, fails:

  gcc -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs
  ...
  -Wno-sign-compare -fno-asynchronous-unwind-tables -Wframe-address -c -x c /dev/null -o .31392.tmp
  /dev/null:1:0: error: code model kernel does not support PIC mode

because that returns an error and we can't disable the warning. For
example in this case:

KBUILD_CFLAGS   += $(call cc-disable-warning,frame-address,)

which leads to gcc issuing all those warnings again.

So let's turn off PIE/PIC at the earliest possible moment, when we
declare KBUILD_CFLAGS so that cc-disable-warning picks it up too.

Also, we need the $(call cc-option ...) because -fno-PIE is supported
since gcc v3.4 and our lowest supported gcc version is 3.2 right now.

Signed-off-by: Borislav Petkov <[e-mail]>
Cc: [e-mail]
Cc: Ben Hutchings <[e-mail]>
Cc: Sebastian Andrzej Siewior <[e-mail]>
Signed-off-by: Michal Marek <[e-mail]>
---
 Makefile | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 58fc5d9..77ac3f8 100644
--- a/Makefile
+++ b/Makefile
@@ -399,11 +399,12 @@ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
 		   -fno-strict-aliasing -fno-common \
 		   -Werror-implicit-function-declaration \
 		   -Wno-format-security \
-		   -std=gnu89
+		   -std=gnu89 $(call cc-option,-fno-PIE)
+
 
 KBUILD_AFLAGS_KERNEL :=
 KBUILD_CFLAGS_KERNEL :=
-KBUILD_AFLAGS   := -D__ASSEMBLY__
+KBUILD_AFLAGS   := -D__ASSEMBLY__ $(call cc-option,-fno-PIE)
 KBUILD_AFLAGS_MODULE  := -DMODULE
 KBUILD_CFLAGS_MODULE  := -DMODULE
 KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
-- 
cgit v0.12