mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 07:16:21 +09:00
1ba26c2aed
commit b8fdef311a0bd9223f10754f94fdcf1a594a3457 upstream.
Compilers with branch protection support can be configured to enable it by
default, it is likely that distributions will do this as part of deploying
branch protection system wide. As well as the slight overhead from having
some extra NOPs for unused branch protection features this can cause more
serious problems when the kernel is providing pointer authentication to
userspace but not built for pointer authentication itself. In that case our
switching of keys for userspace can affect the kernel unexpectedly, causing
pointer authentication instructions in the kernel to corrupt addresses.
To ensure that we get consistent and reliable behaviour always explicitly
initialise the branch protection mode, ensuring that the kernel is built
the same way regardless of the compiler defaults.
[This is a reworked version of b8fdef311a0bd9223f1075 ("arm64: Always
force a branch protection mode when the compiler has one") for backport.
Kernels prior to 74afda4016a7 ("arm64: compile the kernel with ptrauth
return address signing") don't have any Makefile machinery for forcing
on pointer auth but still have issues if the compiler defaults it on so
need this reworked version. -- broonie]
Fixes: 7503197562 (arm64: add basic pointer authentication support)
Reported-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
[catalin.marinas@arm.com: remove Kconfig option in favour of Makefile check]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
178 lines
5.7 KiB
Makefile
178 lines
5.7 KiB
Makefile
#
|
|
# arch/arm64/Makefile
|
|
#
|
|
# This file is included by the global makefile so that you can add your own
|
|
# architecture-specific flags and dependencies.
|
|
#
|
|
# This file is subject to the terms and conditions of the GNU General Public
|
|
# License. See the file "COPYING" in the main directory of this archive
|
|
# for more details.
|
|
#
|
|
# Copyright (C) 1995-2001 by Russell King
|
|
|
|
LDFLAGS_vmlinux :=--no-undefined -X
|
|
CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET)
|
|
GZFLAGS :=-9
|
|
|
|
ifeq ($(CONFIG_RELOCATABLE), y)
|
|
# Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour
|
|
# for relative relocs, since this leads to better Image compression
|
|
# with the relocation offsets always being zero.
|
|
LDFLAGS_vmlinux += -shared -Bsymbolic -z notext -z norelro \
|
|
$(call ld-option, --no-apply-dynamic-relocs)
|
|
endif
|
|
|
|
ifeq ($(CONFIG_ARM64_ERRATUM_843419),y)
|
|
ifeq ($(call ld-option, --fix-cortex-a53-843419),)
|
|
$(warning ld does not support --fix-cortex-a53-843419; kernel may be susceptible to erratum)
|
|
else
|
|
LDFLAGS_vmlinux += --fix-cortex-a53-843419
|
|
endif
|
|
endif
|
|
|
|
# Check for binutils support for specific extensions
|
|
lseinstr := $(call as-instr,.arch_extension lse,-DCONFIG_AS_LSE=1)
|
|
|
|
ifeq ($(CONFIG_ARM64_LSE_ATOMICS), y)
|
|
ifeq ($(lseinstr),)
|
|
$(warning LSE atomics not supported by binutils)
|
|
endif
|
|
endif
|
|
|
|
cc_has_k_constraint := $(call try-run,echo \
|
|
'int main(void) { \
|
|
asm volatile("and w0, w0, %w0" :: "K" (4294967295)); \
|
|
return 0; \
|
|
}' | $(CC) -S -x c -o "$$TMP" -,,-DCONFIG_CC_HAS_K_CONSTRAINT=1)
|
|
|
|
ifeq ($(CONFIG_ARM64), y)
|
|
brokengasinst := $(call as-instr,1:\n.inst 0\n.rept . - 1b\n\nnop\n.endr\n,,-DCONFIG_BROKEN_GAS_INST=1)
|
|
|
|
ifneq ($(brokengasinst),)
|
|
$(warning Detected assembler with broken .inst; disassembly will be unreliable)
|
|
endif
|
|
endif
|
|
|
|
KBUILD_CFLAGS += -mgeneral-regs-only $(lseinstr) $(brokengasinst) \
|
|
$(compat_vdso) $(cc_has_k_constraint)
|
|
KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
|
|
KBUILD_CFLAGS += $(call cc-disable-warning, psabi)
|
|
KBUILD_AFLAGS += $(lseinstr) $(brokengasinst) $(compat_vdso)
|
|
|
|
KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
|
|
KBUILD_AFLAGS += $(call cc-option,-mabi=lp64)
|
|
|
|
ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y)
|
|
prepare: stack_protector_prepare
|
|
stack_protector_prepare: prepare0
|
|
$(eval KBUILD_CFLAGS += -mstack-protector-guard=sysreg \
|
|
-mstack-protector-guard-reg=sp_el0 \
|
|
-mstack-protector-guard-offset=$(shell \
|
|
awk '{if ($$2 == "TSK_STACK_CANARY") print $$3;}' \
|
|
include/generated/asm-offsets.h))
|
|
endif
|
|
|
|
# Ensure that if the compiler supports branch protection we default it
|
|
# off.
|
|
KBUILD_CFLAGS += $(call cc-option,-mbranch-protection=none)
|
|
|
|
ifeq ($(CONFIG_CPU_BIG_ENDIAN), y)
|
|
KBUILD_CPPFLAGS += -mbig-endian
|
|
CHECKFLAGS += -D__AARCH64EB__
|
|
AS += -EB
|
|
# Prefer the baremetal ELF build target, but not all toolchains include
|
|
# it so fall back to the standard linux version if needed.
|
|
KBUILD_LDFLAGS += -EB $(call ld-option, -maarch64elfb, -maarch64linuxb)
|
|
UTS_MACHINE := aarch64_be
|
|
else
|
|
KBUILD_CPPFLAGS += -mlittle-endian
|
|
CHECKFLAGS += -D__AARCH64EL__
|
|
AS += -EL
|
|
# Same as above, prefer ELF but fall back to linux target if needed.
|
|
KBUILD_LDFLAGS += -EL $(call ld-option, -maarch64elf, -maarch64linux)
|
|
UTS_MACHINE := aarch64
|
|
endif
|
|
|
|
CHECKFLAGS += -D__aarch64__
|
|
|
|
ifeq ($(CONFIG_ARM64_MODULE_PLTS),y)
|
|
KBUILD_LDS_MODULE += $(srctree)/arch/arm64/kernel/module.lds
|
|
endif
|
|
|
|
# Default value
|
|
head-y := arch/arm64/kernel/head.o
|
|
|
|
# The byte offset of the kernel image in RAM from the start of RAM.
|
|
ifeq ($(CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET), y)
|
|
TEXT_OFFSET := $(shell awk "BEGIN {srand(); printf \"0x%06x\n\", \
|
|
int(2 * 1024 * 1024 / (2 ^ $(CONFIG_ARM64_PAGE_SHIFT)) * \
|
|
rand()) * (2 ^ $(CONFIG_ARM64_PAGE_SHIFT))}")
|
|
else
|
|
TEXT_OFFSET := 0x00080000
|
|
endif
|
|
|
|
ifeq ($(CONFIG_KASAN_SW_TAGS), y)
|
|
KASAN_SHADOW_SCALE_SHIFT := 4
|
|
else
|
|
KASAN_SHADOW_SCALE_SHIFT := 3
|
|
endif
|
|
|
|
KBUILD_CFLAGS += -DKASAN_SHADOW_SCALE_SHIFT=$(KASAN_SHADOW_SCALE_SHIFT)
|
|
KBUILD_CPPFLAGS += -DKASAN_SHADOW_SCALE_SHIFT=$(KASAN_SHADOW_SCALE_SHIFT)
|
|
KBUILD_AFLAGS += -DKASAN_SHADOW_SCALE_SHIFT=$(KASAN_SHADOW_SCALE_SHIFT)
|
|
|
|
export TEXT_OFFSET GZFLAGS
|
|
|
|
core-y += arch/arm64/
|
|
libs-y := arch/arm64/lib/ $(libs-y)
|
|
core-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a
|
|
|
|
# Default target when executing plain make
|
|
boot := arch/arm64/boot
|
|
KBUILD_IMAGE := $(boot)/Image.gz
|
|
|
|
all: Image.gz
|
|
|
|
|
|
Image: vmlinux
|
|
$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
|
|
|
|
Image.%: Image
|
|
$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
|
|
|
|
zinstall install:
|
|
$(Q)$(MAKE) $(build)=$(boot) $@
|
|
|
|
PHONY += vdso_install
|
|
vdso_install:
|
|
$(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@
|
|
|
|
# We use MRPROPER_FILES and CLEAN_FILES now
|
|
archclean:
|
|
$(Q)$(MAKE) $(clean)=$(boot)
|
|
|
|
ifeq ($(KBUILD_EXTMOD),)
|
|
# We need to generate vdso-offsets.h before compiling certain files in kernel/.
|
|
# In order to do that, we should use the archprepare target, but we can't since
|
|
# asm-offsets.h is included in some files used to generate vdso-offsets.h, and
|
|
# asm-offsets.h is built in prepare0, for which archprepare is a dependency.
|
|
# Therefore we need to generate the header after prepare0 has been made, hence
|
|
# this hack.
|
|
prepare: vdso_prepare
|
|
vdso_prepare: prepare0
|
|
$(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso include/generated/vdso-offsets.h
|
|
$(if $(CONFIG_COMPAT_VDSO),$(Q)$(MAKE) \
|
|
$(build)=arch/arm64/kernel/vdso32 \
|
|
include/generated/vdso32-offsets.h)
|
|
endif
|
|
|
|
define archhelp
|
|
echo '* Image.gz - Compressed kernel image (arch/$(ARCH)/boot/Image.gz)'
|
|
echo ' Image - Uncompressed kernel image (arch/$(ARCH)/boot/Image)'
|
|
echo ' install - Install uncompressed kernel'
|
|
echo ' zinstall - Install compressed kernel'
|
|
echo ' Install using (your) ~/bin/installkernel or'
|
|
echo ' (distribution) /sbin/installkernel or'
|
|
echo ' install to $$(INSTALL_PATH) and run lilo'
|
|
endef
|