From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5C42CA9EB6 for ; Wed, 23 Oct 2019 16:59:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 98EE221906 for ; Wed, 23 Oct 2019 16:59:25 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="NQgD49Nz" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726813AbfJWQ7Y (ORCPT ); Wed, 23 Oct 2019 12:59:24 -0400 Received: from mail-vk1-f195.google.com ([209.85.221.195]:42831 "EHLO mail-vk1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726795AbfJWQ7W (ORCPT ); Wed, 23 Oct 2019 12:59:22 -0400 Received: by mail-vk1-f195.google.com with SMTP id j22so1484114vki.9 for ; Wed, 23 Oct 2019 09:59:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oiXTugK+glDXdJjZWJtXYSMgUR2uLVi/MAVMaB3F35U=; b=NQgD49Nz1FMbQT18HMLMCXz8AgV0WCkf006/YUznJf+3Ipz7NMjqeC2D/k5EAlN0/t nJVzfXQMkmOEB0gib3vBf8erowFTJOm5qjJaOs1Eb/RW6pzbK2BDP79mM6rksf9Y8+aj BJ0DPjReMffW5qFqvs/6b+ugvel1yOtCyIGIh/ClbZONxGCVxVbdNSXeTSCweh3hL9cu Vz0voRu/R6+IY98n6jLUZeKwAjG1FEibO0VIHstd/fmjmeYU0EmyWqWiyBvrGV7Tdguu n+UiY/XMLvkLH23E9uESUscCmkQ47unt7KrZbMWIK40hjbUz+Z7oCm/X+x38XKXz8RBw +LyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oiXTugK+glDXdJjZWJtXYSMgUR2uLVi/MAVMaB3F35U=; b=LidBa9RV/DtD/stKGCOd3Y0lv2x8eyZhKDea05VzbzuKKLNfh40QDMe8YL6Nb8GC+3 03toA6T+Wl4SiVFUyZEKCKSGkPgefFwB8EyDDJUIIKI18Y+bmLwkzf3Ti693lvLeOaad IOdL7ScWIuO3Xslm3j+60oSegveHCuURIqt2vzqHV6n6bJD+ae706SQbbmRIKTTWT9SR jynKJ5WxUq/14Q18ofD0FuRYfMEVbgSYAxxEXegk+FvVpiQJQWS7s/fhS48T+8HW7VN6 lxYu4hoDserxSgLDBMXmjTWiaMGfB81yGd10XqvinWHqa1FZeL+cvdmSS11DCUt0ZZl+ fHZA== X-Gm-Message-State: APjAAAUFf+xORcDFgTh/QNn/5xdYh2n2gBdq+q6lPUPqPXBoV9Opriwi +s/9Jn6a4Bj2UZg4OO+l4nRXhAKXbzxWUNBVxMYjZw== X-Google-Smtp-Source: APXvYqwpR9GdHU5UA4nzyjfo+qvuhnpsktbqKSujsET0zjiSwqQ8iK3jjEiXPXLcBxBc59n7vUzXDYX4PbBLe56acZ4= X-Received: by 2002:a1f:b202:: with SMTP id b2mr6005570vkf.59.1571849961694; Wed, 23 Oct 2019 09:59:21 -0700 (PDT) MIME-Version: 1.0 References: <20191018161033.261971-1-samitolvanen@google.com> <20191018161033.261971-7-samitolvanen@google.com> <20191022162826.GC699@lakrids.cambridge.arm.com> In-Reply-To: <20191022162826.GC699@lakrids.cambridge.arm.com> From: Sami Tolvanen Date: Wed, 23 Oct 2019 09:59:09 -0700 Message-ID: Subject: Re: [PATCH 06/18] add support for Clang's Shadow Call Stack (SCS) To: Mark Rutland , Masahiro Yamada Cc: Will Deacon , Catalin Marinas , Steven Rostedt , Ard Biesheuvel , Dave Martin , Kees Cook , Laura Abbott , Nick Desaulniers , clang-built-linux , Kernel Hardening , linux-arm-kernel , LKML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Oct 22, 2019 at 9:28 AM Mark Rutland wrote: > I think it would be preferable to follow the example of CC_FLAGS_FTRACE > so that this can be filtered out, e.g. > > ifdef CONFIG_SHADOW_CALL_STACK > CFLAGS_SCS := -fsanitize=shadow-call-stack > KBUILD_CFLAGS += $(CFLAGS_SCS) > export CC_FLAGS_SCS > endif > > ... with removal being: > > CFLAGS_REMOVE := $(CC_FLAGS_SCS) > > ... or: > > CFLAGS_REMOVE_obj.o := $(CC_FLAGS_SCS) > > That way you only need to define the flags once, so the enable and > disable falgs remain in sync by construction. CFLAGS_REMOVE appears to be only implemented for objects, which means there's no convenient way to filter out flags for everything in arch/arm64/kvm/hyp, for example. I could add a CFLAGS_REMOVE separately for each object file, or we could add something like ccflags-remove-y to complement ccflags-y, which should be relatively simple. Masahiro, do you have any suggestions? Sami From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4863AC47E49 for ; Wed, 23 Oct 2019 16:59:34 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 17BA621906 for ; Wed, 23 Oct 2019 16:59:34 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="sdYtSKpj"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="NQgD49Nz" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 17BA621906 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:To:Subject:Message-ID:Date:From: In-Reply-To:References:MIME-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=r25ES4F6CsyDd3QUil7ar9fC/yOmh6ElQhu2z0f27U8=; b=sdYtSKpja2qWuh 5nN8nv0IF169g5NjpqSdjVzSSlrIMCeH53OcW2JP3sZynTPBmlde++8GkG0DuRaeTBcG8Aoe9HFmJ jE2emK1wwDIVRaF+GTY8rvk+ipEErIW/mwz4TqopH4TS1leowKodm8etJegjJ/o4I/1hPy3KGE2Xd Q50oM3Pg9Qz1oawwWKyGVyofi0UPWkhZ7oJDgALldmIrLbpfJyPske5NM8DPnFG4f9gvEvtKGeiMk A7i+To2Dbd0oyrs3wyWFWgsMpwAMBZtYYDNVicFYg+RZcPL/bwHL5SSWc+g2tRYJt4Z5IWhEMtiao Fcg7cTkE6MSMozRFfNyw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1iNJyr-0003Wl-4q; Wed, 23 Oct 2019 16:59:29 +0000 Received: from mail-vk1-xa43.google.com ([2607:f8b0:4864:20::a43]) by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1iNJym-0003Ux-3y for linux-arm-kernel@lists.infradead.org; Wed, 23 Oct 2019 16:59:26 +0000 Received: by mail-vk1-xa43.google.com with SMTP id n81so2999659vke.13 for ; Wed, 23 Oct 2019 09:59:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oiXTugK+glDXdJjZWJtXYSMgUR2uLVi/MAVMaB3F35U=; b=NQgD49Nz1FMbQT18HMLMCXz8AgV0WCkf006/YUznJf+3Ipz7NMjqeC2D/k5EAlN0/t nJVzfXQMkmOEB0gib3vBf8erowFTJOm5qjJaOs1Eb/RW6pzbK2BDP79mM6rksf9Y8+aj BJ0DPjReMffW5qFqvs/6b+ugvel1yOtCyIGIh/ClbZONxGCVxVbdNSXeTSCweh3hL9cu Vz0voRu/R6+IY98n6jLUZeKwAjG1FEibO0VIHstd/fmjmeYU0EmyWqWiyBvrGV7Tdguu n+UiY/XMLvkLH23E9uESUscCmkQ47unt7KrZbMWIK40hjbUz+Z7oCm/X+x38XKXz8RBw +LyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oiXTugK+glDXdJjZWJtXYSMgUR2uLVi/MAVMaB3F35U=; b=QX5XtsaxS9xlX2YyRu3GQEGRCERz2NX830nyrGUtvmIKp3qXOwh4wXxWmehXXxi0wV SU5JTB8AMYcVWXp1rk0/1oHurtIwh2lU+lyiWr8/Zc5YHf0tot0i5ytg2J/yk083hZXr Lxbo2b+Q1TnlbInNyXYLvU8Hw9qjpoCk0kn35dBAJPwK8zMjDkQ7vOdGiY3QGCbHxfWn JNzgsmYOO+rTRiJrR+MweZ/O8qZRWjm9rOMBZ3pMqSVf5vsiI7lmhyptTJ0qKbaBMjkO HTw4cMSVcRhh1Rvqu7R3VbXb9nq6W6KZg6AxEoRAK+VqbfIf3v7qstCAxWn/9R0SwztT Hfyg== X-Gm-Message-State: APjAAAXtqTXdXND3n1iFumcrsHrBWAl3DncokuaG+NWGSBe/k9fwqro7 kWkHzJcHd0mD3BJ34h1hsCVvdGyVxNQIksp0x06z0g== X-Google-Smtp-Source: APXvYqwpR9GdHU5UA4nzyjfo+qvuhnpsktbqKSujsET0zjiSwqQ8iK3jjEiXPXLcBxBc59n7vUzXDYX4PbBLe56acZ4= X-Received: by 2002:a1f:b202:: with SMTP id b2mr6005570vkf.59.1571849961694; Wed, 23 Oct 2019 09:59:21 -0700 (PDT) MIME-Version: 1.0 References: <20191018161033.261971-1-samitolvanen@google.com> <20191018161033.261971-7-samitolvanen@google.com> <20191022162826.GC699@lakrids.cambridge.arm.com> In-Reply-To: <20191022162826.GC699@lakrids.cambridge.arm.com> From: Sami Tolvanen Date: Wed, 23 Oct 2019 09:59:09 -0700 Message-ID: Subject: Re: [PATCH 06/18] add support for Clang's Shadow Call Stack (SCS) To: Mark Rutland , Masahiro Yamada X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20191023_095924_186007_E9392E60 X-CRM114-Status: GOOD ( 12.35 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kees Cook , Ard Biesheuvel , Catalin Marinas , Kernel Hardening , Nick Desaulniers , LKML , Steven Rostedt , clang-built-linux , Laura Abbott , Will Deacon , Dave Martin , linux-arm-kernel Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, Oct 22, 2019 at 9:28 AM Mark Rutland wrote: > I think it would be preferable to follow the example of CC_FLAGS_FTRACE > so that this can be filtered out, e.g. > > ifdef CONFIG_SHADOW_CALL_STACK > CFLAGS_SCS := -fsanitize=shadow-call-stack > KBUILD_CFLAGS += $(CFLAGS_SCS) > export CC_FLAGS_SCS > endif > > ... with removal being: > > CFLAGS_REMOVE := $(CC_FLAGS_SCS) > > ... or: > > CFLAGS_REMOVE_obj.o := $(CC_FLAGS_SCS) > > That way you only need to define the flags once, so the enable and > disable falgs remain in sync by construction. CFLAGS_REMOVE appears to be only implemented for objects, which means there's no convenient way to filter out flags for everything in arch/arm64/kvm/hyp, for example. I could add a CFLAGS_REMOVE separately for each object file, or we could add something like ccflags-remove-y to complement ccflags-y, which should be relatively simple. Masahiro, do you have any suggestions? Sami _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A076ECA9EB6 for ; Wed, 23 Oct 2019 16:59:42 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id E832021925 for ; Wed, 23 Oct 2019 16:59:41 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="NQgD49Nz" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E832021925 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-17096-kernel-hardening=archiver.kernel.org@lists.openwall.com Received: (qmail 9398 invoked by uid 550); 23 Oct 2019 16:59:34 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Received: (qmail 9377 invoked from network); 23 Oct 2019 16:59:34 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oiXTugK+glDXdJjZWJtXYSMgUR2uLVi/MAVMaB3F35U=; b=NQgD49Nz1FMbQT18HMLMCXz8AgV0WCkf006/YUznJf+3Ipz7NMjqeC2D/k5EAlN0/t nJVzfXQMkmOEB0gib3vBf8erowFTJOm5qjJaOs1Eb/RW6pzbK2BDP79mM6rksf9Y8+aj BJ0DPjReMffW5qFqvs/6b+ugvel1yOtCyIGIh/ClbZONxGCVxVbdNSXeTSCweh3hL9cu Vz0voRu/R6+IY98n6jLUZeKwAjG1FEibO0VIHstd/fmjmeYU0EmyWqWiyBvrGV7Tdguu n+UiY/XMLvkLH23E9uESUscCmkQ47unt7KrZbMWIK40hjbUz+Z7oCm/X+x38XKXz8RBw +LyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oiXTugK+glDXdJjZWJtXYSMgUR2uLVi/MAVMaB3F35U=; b=NsQGsTJa5LVmIpLfYmBgyjgQvpbHuTj3kOGeYEr0nRNdu/hZz7JT/WHbW/DCqm0YBV XmfxnBGsGFwvi0qhrrdVP18eRY6vJurD6oQgpPH4i/povkO1VgXnaGnRcT5YSB0BjGpc RyBEUUPyziN5hZ1UwkCglwZONVzuJOHMinugtQGLLecos39gbwqmFeeKZThz9W4pmvaQ zJahdb/74P8zAVjA5mV5sf4tiMPg7b8jVmI2fWdzfU6Nag1LumOUs2kRqDMLW7wLgLX4 plGl0Geohy9wyx+54zNzH1Q6US/FNh9OvWDh2Ip2atNSq1iSx/cRDfxj4Em0t2yD1XNf 7M4g== X-Gm-Message-State: APjAAAUWy2pdRODQc8401Sn4ad3YE/akFgJpN5gGV9TicBlQxV4gSEXi RoywP3wQ6/Di7vNpJlUFr6kWCX04OHHuopQBinzwOA== X-Google-Smtp-Source: APXvYqwpR9GdHU5UA4nzyjfo+qvuhnpsktbqKSujsET0zjiSwqQ8iK3jjEiXPXLcBxBc59n7vUzXDYX4PbBLe56acZ4= X-Received: by 2002:a1f:b202:: with SMTP id b2mr6005570vkf.59.1571849961694; Wed, 23 Oct 2019 09:59:21 -0700 (PDT) MIME-Version: 1.0 References: <20191018161033.261971-1-samitolvanen@google.com> <20191018161033.261971-7-samitolvanen@google.com> <20191022162826.GC699@lakrids.cambridge.arm.com> In-Reply-To: <20191022162826.GC699@lakrids.cambridge.arm.com> From: Sami Tolvanen Date: Wed, 23 Oct 2019 09:59:09 -0700 Message-ID: Subject: Re: [PATCH 06/18] add support for Clang's Shadow Call Stack (SCS) To: Mark Rutland , Masahiro Yamada Cc: Will Deacon , Catalin Marinas , Steven Rostedt , Ard Biesheuvel , Dave Martin , Kees Cook , Laura Abbott , Nick Desaulniers , clang-built-linux , Kernel Hardening , linux-arm-kernel , LKML Content-Type: text/plain; charset="UTF-8" On Tue, Oct 22, 2019 at 9:28 AM Mark Rutland wrote: > I think it would be preferable to follow the example of CC_FLAGS_FTRACE > so that this can be filtered out, e.g. > > ifdef CONFIG_SHADOW_CALL_STACK > CFLAGS_SCS := -fsanitize=shadow-call-stack > KBUILD_CFLAGS += $(CFLAGS_SCS) > export CC_FLAGS_SCS > endif > > ... with removal being: > > CFLAGS_REMOVE := $(CC_FLAGS_SCS) > > ... or: > > CFLAGS_REMOVE_obj.o := $(CC_FLAGS_SCS) > > That way you only need to define the flags once, so the enable and > disable falgs remain in sync by construction. CFLAGS_REMOVE appears to be only implemented for objects, which means there's no convenient way to filter out flags for everything in arch/arm64/kvm/hyp, for example. I could add a CFLAGS_REMOVE separately for each object file, or we could add something like ccflags-remove-y to complement ccflags-y, which should be relatively simple. Masahiro, do you have any suggestions? Sami