From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755716AbcFQPmu (ORCPT ); Fri, 17 Jun 2016 11:42:50 -0400 Received: from mail-wm0-f43.google.com ([74.125.82.43]:38351 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755672AbcFQPma (ORCPT ); Fri, 17 Jun 2016 11:42:30 -0400 MIME-Version: 1.0 In-Reply-To: <1466156354-21609-1-git-send-email-mark.rutland@arm.com> References: <1466156354-21609-1-git-send-email-mark.rutland@arm.com> From: Kees Cook Date: Fri, 17 Jun 2016 08:42:28 -0700 X-Google-Sender-Auth: YBoTrGpXjg-lNyv7ch6R_LvsvhA Message-ID: Subject: Re: [PATCHv3] kcov: reject open when kernel not instrumented To: Mark Rutland Cc: LKML , Alexander Potapenko , Andrew Morton , Dmitry Vyukov , James Morse , Michal Marek Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jun 17, 2016 at 2:39 AM, Mark Rutland wrote: > If the toolchain does not support -fsanitize-coverage=trace-pc, we blat > this option from CFLAGS_KCOV, and build the kernel without > instrumentation, even if CONFIG_KCOV was selected. However, we still > build the rest of the kcov infrastructure, and expose a kcov file under > debugfs. This can be confusing, as the kernel will appear to support > kcov, yet will never manage to sample any trace PC values. While we do > note this fact at build time, this may be missed, and a user may not > have access to build logs. Do you want to refuse to build if the compiler doesn't support the flag? I finally figured out how to do this, I think, for -fstack-protector: http://git.kernel.org/cgit/linux/kernel/git/kees/linux.git/commit/?h=kbuild/stackprotector&id=600c1bd5f8647a8470dc2fc5a8697e3eafb5fd52 If you wanted, the CONFIG_KCOV test could live under the same prepare-compiler-check target. -Kees > > This patch ensures that CC_HAVE_SANCOV_TRACE_PC is defined when the > toolchain supports -fsanitize-coverage=trace-pc, and is not defined > otherwise. When CC_HAVE_SANCOV_TRACE_PC is not defined, the kernel will > return -ENOTSUPP if userspace attempts to open the kcov debugfs file, > indicating that kcov functionality is unavailable. > > As uninstrumented files (e.g. kernel/kcov.c) need to know when this > compiler feature is in use, wee pass the define via KBUILD_CFLAGS rather > than CFLAGS_KCOV. > > Signed-off-by: Mark Rutland > Cc: Alexander Potapenko > Cc: Andrew Morton > Cc: Dmitry Vyukov > Cc: James Morse > Cc: Kees Cook > Cc: Michal Marek > Cc: linux-kernel@vger.kernel.org > --- > Makefile | 2 ++ > kernel/kcov.c | 9 +++++++++ > 2 files changed, 11 insertions(+) > > Since v1 [1]: > * Use CC_HAVE_SANCOV_TRACE_PC rather than CONFIG_KCOV_CC > Since v2 [2]: > * Use KBUILD_CFLAGS so kernel/kcov.c gets the flag > > [1] http://lkml.kernel.org/r/1466005756-15626-1-git-send-email-mark.rutland@arm.com > [2] http://lkml.kernel.org/r/1466010285-2772-1-git-send-email-mark.rutland@arm.com > > diff --git a/Makefile b/Makefile > index b409076..699d363 100644 > --- a/Makefile > +++ b/Makefile > @@ -687,6 +687,8 @@ ifdef CONFIG_KCOV > $(warning Cannot use CONFIG_KCOV: \ > -fsanitize-coverage=trace-pc is not supported by compiler) > CFLAGS_KCOV = > + else > + KBUILD_CFLAGS += -DCC_HAVE_SANCOV_TRACE_PC > endif > endif > > diff --git a/kernel/kcov.c b/kernel/kcov.c > index a02f2dd..0a0b164 100644 > --- a/kernel/kcov.c > +++ b/kernel/kcov.c > @@ -3,6 +3,7 @@ > #define DISABLE_BRANCH_PROFILING > #include > #include > +#include > #include > #include > #include > @@ -160,6 +161,14 @@ static int kcov_open(struct inode *inode, struct file *filep) > { > struct kcov *kcov; > > +#ifndef CC_HAVE_SANCOV_TRACE_PC > + /* > + * CONFIG_KCOV was selected, but the compiler does not support the > + * options KCOV requires. > + */ > + return -ENOTSUPP; > +#endif /* CC_HAVE_SANCOV_TRACE_PC */ > + > kcov = kzalloc(sizeof(*kcov), GFP_KERNEL); > if (!kcov) > return -ENOMEM; > -- > 1.9.1 > -- Kees Cook Chrome OS & Brillo Security