public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Gao, Liming" <liming.gao@intel.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: "edk2-devel@lists.01.org" <edk2-devel@lists.01.org>,
	"lersek@redhat.com" <lersek@redhat.com>,
	"Zhu, Yonghong" <yonghong.zhu@intel.com>
Subject: Re: [PATCH v2] BaseTools/tools_def IA32: disable PIE code generation explicitly
Date: Wed, 13 Jun 2018 10:16:29 +0000	[thread overview]
Message-ID: <4A89E2EF3DFEDB4C8BFDE51014F606A14E296D86@SHSMSX104.ccr.corp.intel.com> (raw)
In-Reply-To: <CAKv+Gu-GEFXHmFJ+i7rttm=yjs=RXy8UhmRQeu1tfpyiHUDkpQ@mail.gmail.com>

Ard:
  This patch causes GCC49 IA32 build failure with GCC compiler 4.9.2 in link phase. " gcc: error: unrecognized command line option -no-pie"
  Do you know any option to disable this error?

Thanks
Liming
>-----Original Message-----
>From: Ard Biesheuvel [mailto:ard.biesheuvel@linaro.org]
>Sent: Tuesday, June 12, 2018 2:19 PM
>To: Gao, Liming <liming.gao@intel.com>
>Cc: edk2-devel@lists.01.org; lersek@redhat.com; Zhu, Yonghong
><yonghong.zhu@intel.com>
>Subject: Re: [PATCH v2] BaseTools/tools_def IA32: disable PIE code
>generation explicitly
>
>On 12 June 2018 at 03:40, Gao, Liming <liming.gao@intel.com> wrote:
>> Reviewed-by: Liming Gao <liming.gao@intel.com>
>>
>
>Thanks
>
>Pushed as c25d3905523a
>
>>> -----Original Message-----
>>> From: Ard Biesheuvel [mailto:ard.biesheuvel@linaro.org]
>>> Sent: Tuesday, June 12, 2018 12:29 AM
>>> To: edk2-devel@lists.01.org
>>> Cc: lersek@redhat.com; Gao, Liming <liming.gao@intel.com>; Zhu,
>Yonghong <yonghong.zhu@intel.com>; Ard Biesheuvel
>>> <ard.biesheuvel@linaro.org>
>>> Subject: [PATCH v2] BaseTools/tools_def IA32: disable PIE code generation
>explicitly
>>>
>>> As a security measure, some distros now build their GCC toolchains with
>>> PIE code generation enabled by default, because it is a prerequisite
>>> for ASLR to be enabled when running the executable.
>>>
>>> This typically results in slightly larger code, but it also generates
>>> ELF relocations that our tooling cannot deal with, so let's disable it
>>> explicitly when using GCC49 or later for IA32. (Note that this does not
>>> apply to X64: it uses PIE code deliberately in some cases, and our
>>> tooling does deal with the resuling relocations)
>>>
>>> Contributed-under: TianoCore Contribution Agreement 1.1
>>> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>>> Acked-by: Laszlo Ersek <lersek@redhat.com>
>>> ---
>>>  BaseTools/Conf/tools_def.template | 10 +++++-----
>>>  1 file changed, 5 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/BaseTools/Conf/tools_def.template
>b/BaseTools/Conf/tools_def.template
>>> index 7e9c915755ed..733c6ec71709 100755
>>> --- a/BaseTools/Conf/tools_def.template
>>> +++ b/BaseTools/Conf/tools_def.template
>>> @@ -4648,7 +4648,7 @@ DEFINE GCC48_AARCH64_DLINK2_FLAGS    =
>DEF(GCC47_AARCH64_DLINK2_FLAGS)
>>>  DEFINE GCC48_ARM_ASLDLINK_FLAGS      =
>DEF(GCC47_ARM_ASLDLINK_FLAGS)
>>>  DEFINE GCC48_AARCH64_ASLDLINK_FLAGS  =
>DEF(GCC47_AARCH64_ASLDLINK_FLAGS)
>>>
>>> -DEFINE GCC49_IA32_CC_FLAGS           = DEF(GCC48_IA32_CC_FLAGS)
>>> +DEFINE GCC49_IA32_CC_FLAGS           = DEF(GCC48_IA32_CC_FLAGS) -
>fno-pic -fno-pie
>>>  DEFINE GCC49_X64_CC_FLAGS            = DEF(GCC48_X64_CC_FLAGS)
>>>  DEFINE GCC49_IA32_X64_DLINK_COMMON   = -nostdlib -Wl,-n,-q,--gc-
>sections -z common-page-size=0x40
>>>  DEFINE GCC49_IA32_X64_ASLDLINK_FLAGS =
>DEF(GCC49_IA32_X64_DLINK_COMMON) -Wl,--entry,ReferenceAcpiTable -u
>>> ReferenceAcpiTable
>>> @@ -5357,10 +5357,10 @@ RELEASE_GCC48_AARCH64_CC_FLAGS   =
>DEF(GCC48_AARCH64_CC_FLAGS) -Wno-unused-but-s
>>>  *_GCC49_IA32_RC_PATH              = DEF(GCC49_IA32_PREFIX)objcopy
>>>
>>>  *_GCC49_IA32_ASLCC_FLAGS          = DEF(GCC_ASLCC_FLAGS) -m32
>>> -*_GCC49_IA32_ASLDLINK_FLAGS       =
>DEF(GCC49_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_i386
>>> +*_GCC49_IA32_ASLDLINK_FLAGS       =
>DEF(GCC49_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_i386 -no-pie
>>>  *_GCC49_IA32_ASM_FLAGS            = DEF(GCC49_ASM_FLAGS) -m32 -
>march=i386
>>>  *_GCC49_IA32_DLINK_FLAGS          = DEF(GCC49_IA32_X64_DLINK_FLAGS)
>-Wl,-m,elf_i386,--oformat=elf32-i386
>>> -*_GCC49_IA32_DLINK2_FLAGS         = DEF(GCC49_IA32_DLINK2_FLAGS)
>>> +*_GCC49_IA32_DLINK2_FLAGS         = DEF(GCC49_IA32_DLINK2_FLAGS) -
>no-pie
>>>  *_GCC49_IA32_RC_FLAGS             = DEF(GCC_IA32_RC_FLAGS)
>>>  *_GCC49_IA32_OBJCOPY_FLAGS        =
>>>  *_GCC49_IA32_NASM_FLAGS           = -f elf32
>>> @@ -5502,9 +5502,9 @@ RELEASE_GCC49_AARCH64_DLINK_FLAGS  =
>DEF(GCC49_AARCH64_DLINK_FLAGS)
>>>  *_GCC5_IA32_RC_PATH              = DEF(GCC5_IA32_PREFIX)objcopy
>>>
>>>  *_GCC5_IA32_ASLCC_FLAGS          = DEF(GCC_ASLCC_FLAGS) -m32 -fno-lto
>>> -*_GCC5_IA32_ASLDLINK_FLAGS       =
>DEF(GCC5_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_i386
>>> +*_GCC5_IA32_ASLDLINK_FLAGS       =
>DEF(GCC5_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_i386 -no-pie
>>>  *_GCC5_IA32_ASM_FLAGS            = DEF(GCC5_ASM_FLAGS) -m32 -
>march=i386
>>> -*_GCC5_IA32_DLINK2_FLAGS         = DEF(GCC5_IA32_DLINK2_FLAGS)
>>> +*_GCC5_IA32_DLINK2_FLAGS         = DEF(GCC5_IA32_DLINK2_FLAGS) -
>no-pie
>>>  *_GCC5_IA32_RC_FLAGS             = DEF(GCC_IA32_RC_FLAGS)
>>>  *_GCC5_IA32_OBJCOPY_FLAGS        =
>>>  *_GCC5_IA32_NASM_FLAGS           = -f elf32
>>> --
>>> 2.17.1
>>

  reply	other threads:[~2018-06-13 10:16 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-11 16:29 [PATCH v2] BaseTools/tools_def IA32: disable PIE code generation explicitly Ard Biesheuvel
2018-06-11 17:31 ` Laszlo Ersek
2018-06-12  1:40 ` Gao, Liming
2018-06-12  6:18   ` Ard Biesheuvel
2018-06-13 10:16     ` Gao, Liming [this message]
2018-06-13 10:19       ` Ard Biesheuvel
2018-06-14  4:04         ` Gao, Liming

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4A89E2EF3DFEDB4C8BFDE51014F606A14E296D86@SHSMSX104.ccr.corp.intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox