Re: [PATCH v2 3/6] x86/cpu: Remove CONFIG_X86_SMAP and "nosmap"

Borislav Petkov
2022-02-09T12:01:36Z

On Tue, Feb 08, 2022 at 06:56:40PM -0800, Kees Cook wrote:
> Cool; yeah, that's kind of what I was expecting. I have a knee-jerk "I
> don't want to touch this again later" reaction to seeing it always
> applied instead of gated by CONFIG_X86 or something, but then, I doubt
> that'll be hard to change when/if objtool becomes multi-architecture.

Yah, what I had doesn't build with 32-bit allnoconfig etc because of
CONFIG_STACK_VALIDATION=n or so. So I ended up doing, see end.

In this case, it gets set only when the earlier LTO_CLANG/STACK/VMLINUX
validation options are enabled.

We could do an is_enabled check around it but what would be the correct
criterium to enable uaccess validation?

> Consider the update as:
>
> Reviewed-by: Kees Cook <keescook@chromium.org>

Thx.

---
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index a4b89b757287..404ea669ecca 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -233,7 +233,7 @@ objtool_args = \
$(if $(CONFIG_FRAME_POINTER),, --no-fp) \
$(if $(CONFIG_GCOV_KERNEL)$(CONFIG_LTO_CLANG), --no-unreachable)\
$(if $(CONFIG_RETPOLINE), --retpoline) \
- $(if $(CONFIG_X86_SMAP), --uaccess) \
+ --uaccess \
$(if $(CONFIG_FTRACE_MCOUNT_USE_OBJTOOL), --mcount) \
$(if $(CONFIG_SLS), --sls)

diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 666f7bbc13eb..fbdb531cca18 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -140,9 +140,9 @@ objtool_link()
if is_enabled CONFIG_RETPOLINE; then
objtoolopt="${objtoolopt} --retpoline"
fi
- if is_enabled CONFIG_X86_SMAP; then
- objtoolopt="${objtoolopt} --uaccess"
- fi
+
+ objtoolopt="${objtoolopt} --uaccess"
+
if is_enabled CONFIG_SLS; then
objtoolopt="${objtoolopt} --sls"
fi
--
Regards/Gruss,
Boris.