Re: [PATCH] livepatch-build: Check compiler version matches

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 21/02/2023 2:14 pm, Ross Lagerwall wrote:
> For reliable live patch generation, the compiler version used should
> match the original binary. Check that this is the case and add a
> --skip-compiler-check option to override this.
>
> Signed-off-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
> ---
>  livepatch-build | 54 +++++++++++++++++++++++++++++++++++--------------
>  1 file changed, 39 insertions(+), 15 deletions(-)
>
> diff --git a/livepatch-build b/livepatch-build
> index 91d203b..e4b4dba 100755
> --- a/livepatch-build
> +++ b/livepatch-build
> @@ -33,6 +33,7 @@ DEPENDS=
>  XEN_DEPENDS=
>  PRELINK=
>  STRIP=0
> +SKIP_COMPILER_CHECK=0
>  XENSYMS=xen-syms
>  
>  warn() {
> @@ -266,27 +267,44 @@ function create_patch()
>      objcopy --set-section-flags .livepatch.xen_depends=alloc,readonly 
> "${PATCHNAME}.livepatch"
>  }
>  
> +check_compiler() {
> +    orig_ver=$(readelf -p .comment "$XENSYMS" | grep -o 'GCC.*')

This rather breaks Clang as a toolchain, but it doesn't seem to be the
only GCC-expectation in livepatch build tools.

$ readelf -p .comment xen-syms

String dump of section '.comment':
  [     0]  Debian clang version 11.0.1-2


Irritatingly, while clang* --version always reports itself as "clang
version ..." matching the .ident it writes out, gcc* substitutes argv[0]
into it's --version.  But the way the Xen build is invoked, I think Xen
will always substituent cc for gcc, so this may not be a problem.

A build of Xen should only use a single compiler, so I think you're
better off looking for s/[     0]  \(.*\)/\1/ rather than assuming that
GCC was used.

Also, I think you should error out if we can't identify a compiler,
because very little good will come from trying to proceed.

~Andrew