On 06 Apr 09:28, Jeff Law wrote: > On 04/06/2015 09:17 AM, Ilya Enkovich wrote: > >> > >>To tell the truth, I can't figure out what this means from a user > >>perspective. How does a user know whether the linker option is > >>being ignored, or if they have a new enough linker? If the linker > >>available at configuration time doesn't support the option, does > >>that mean the option will never be passed and users will never know > >>that there are gaping holes in the pointer bounds checking? > >> > >>My suggestion would be to pass the option unconditionally and make > >>the documentation say something like > > > >This option was rejected. > Right. There really isn't a good option here because we don't have > the infrastructure to query the linker's capabilities at link time. > > Though I do wonder if we could issue a warning in the case where the > configure test indicated -z bndplt was not supported. > > It'd obviously mean a link warning every time an end user tried to > use that toolchain to create a DSO or executable with MPX > protection. But that may be better than silently leaving some code > unprotected. > > > Jeff >
Hi, Here is a patch to add a note in case we build dynamic MPX codes and don't pass '-z bndplt'. Does it look OK? Thanks, Ilya -- gcc/ 2015-05-26 Ilya Enkovich <enkovich....@gmail.com> * config/i386/linux-common.h (MPX_SPEC): Add link warning. libmpx/ 2015-05-26 Ilya Enkovich <enkovich....@gmail.com> * configure.ac: Add link_mpx_warning. * libmpx.spec.in: Likewise. * configure: Regenerate. diff --git a/gcc/config/i386/linux-common.h b/gcc/config/i386/linux-common.h index dd79ec6..fcaab81 100644 --- a/gcc/config/i386/linux-common.h +++ b/gcc/config/i386/linux-common.h @@ -61,7 +61,8 @@ along with GCC; see the file COPYING3. If not see #ifndef MPX_SPEC #define MPX_SPEC "\ - %{mmpx:%{fcheck-pointer-bounds:%{!static:%:include(libmpx.spec)%(link_mpx)}}}" + %{mmpx:%{fcheck-pointer-bounds:%{!static:%:include(libmpx.spec)%(link_mpx) \ + %(link_mpx_warning)}}}" #endif #ifndef LIBMPX_SPEC diff --git a/libmpx/configure.ac b/libmpx/configure.ac index 463e855..7e9ef86 100644 --- a/libmpx/configure.ac +++ b/libmpx/configure.ac @@ -40,17 +40,22 @@ AM_CONDITIONAL(LIBMPX_SUPPORTED, [test "x$LIBMPX_SUPPORTED" = "xyes"]) link_libmpx="-lpthread" link_mpx="" +link_mpx_warning="" AC_MSG_CHECKING([whether ld accepts -z bndplt]) echo "int main() {};" > conftest.c if AC_TRY_COMMAND([${CC} ${CFLAGS} -Wl,-z,bndplt -o conftest conftest.c 1>&AS_MESSAGE_LOG_FD]) then AC_MSG_RESULT([yes]) link_mpx="$link_mpx -z bndplt" + link_mpx_warning="%{mmpx:}" else AC_MSG_RESULT([no]) + link_mpx="%{mmpx:}" + link_mpx_warning="%nGCC was configured with a linker with no '-z bndplt' support. It significantly reduces MPX coverage for dynamic codes. It is strongly recommended to use GCC properly configured for MPX." fi AC_SUBST(link_libmpx) AC_SUBST(link_mpx) +AC_SUBST(link_mpx_warning) AM_INIT_AUTOMAKE(foreign no-dist no-dependencies) AM_ENABLE_MULTILIB(, ..) diff --git a/libmpx/libmpx.spec.in b/libmpx/libmpx.spec.in index 34d0bdf..854f13d 100644 --- a/libmpx/libmpx.spec.in +++ b/libmpx/libmpx.spec.in @@ -3,3 +3,5 @@ *link_libmpx: @link_libmpx@ *link_mpx: @link_mpx@ + +*link_mpx_warning: @link_mpx_warning@