mirror of
https://github.com/raspberrypi/linux.git
synced 2025-12-28 04:52:52 +00:00
94a855111e
Pull x86 core updates from Borislav Petkov:
- Add the call depth tracking mitigation for Retbleed which has been
long in the making. It is a lighterweight software-only fix for
Skylake-based cores where enabling IBRS is a big hammer and causes a
significant performance impact.
What it basically does is, it aligns all kernel functions to 16 bytes
boundary and adds a 16-byte padding before the function, objtool
collects all functions' locations and when the mitigation gets
applied, it patches a call accounting thunk which is used to track
the call depth of the stack at any time.
When that call depth reaches a magical, microarchitecture-specific
value for the Return Stack Buffer, the code stuffs that RSB and
avoids its underflow which could otherwise lead to the Intel variant
of Retbleed.
This software-only solution brings a lot of the lost performance
back, as benchmarks suggest:
https://lore.kernel.org/all/20220915111039.092790446@infradead.org/
That page above also contains a lot more detailed explanation of the
whole mechanism
- Implement a new control flow integrity scheme called FineIBT which is
based on the software kCFI implementation and uses hardware IBT
support where present to annotate and track indirect branches using a
hash to validate them
- Other misc fixes and cleanups
* tag 'x86_core_for_v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (80 commits)
x86/paravirt: Use common macro for creating simple asm paravirt functions
x86/paravirt: Remove clobber bitmask from .parainstructions
x86/debug: Include percpu.h in debugreg.h to get DECLARE_PER_CPU() et al
x86/cpufeatures: Move X86_FEATURE_CALL_DEPTH from bit 18 to bit 19 of word 11, to leave space for WIP X86_FEATURE_SGX_EDECCSSA bit
x86/Kconfig: Enable kernel IBT by default
x86,pm: Force out-of-line memcpy()
objtool: Fix weak hole vs prefix symbol
objtool: Optimize elf_dirty_reloc_sym()
x86/cfi: Add boot time hash randomization
x86/cfi: Boot time selection of CFI scheme
x86/ibt: Implement FineIBT
objtool: Add --cfi to generate the .cfi_sites section
x86: Add prefix symbols for function padding
objtool: Add option to generate prefix symbols
objtool: Avoid O(bloody terrible) behaviour -- an ode to libelf
objtool: Slice up elf_create_section_symbol()
kallsyms: Revert "Take callthunks into account"
x86: Unconfuse CONFIG_ and X86_FEATURE_ namespaces
x86/retpoline: Fix crash printing warning
x86/paravirt: Fix a !PARAVIRT build warning
...
158 lines
4.8 KiB
Makefile
158 lines
4.8 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for the linux kernel.
|
|
#
|
|
|
|
extra-y += vmlinux.lds
|
|
|
|
CPPFLAGS_vmlinux.lds += -U$(UTS_MACHINE)
|
|
|
|
ifdef CONFIG_FUNCTION_TRACER
|
|
# Do not profile debug and lowlevel utilities
|
|
CFLAGS_REMOVE_tsc.o = -pg
|
|
CFLAGS_REMOVE_paravirt-spinlocks.o = -pg
|
|
CFLAGS_REMOVE_pvclock.o = -pg
|
|
CFLAGS_REMOVE_kvmclock.o = -pg
|
|
CFLAGS_REMOVE_ftrace.o = -pg
|
|
CFLAGS_REMOVE_early_printk.o = -pg
|
|
CFLAGS_REMOVE_head64.o = -pg
|
|
CFLAGS_REMOVE_sev.o = -pg
|
|
endif
|
|
|
|
KASAN_SANITIZE_head$(BITS).o := n
|
|
KASAN_SANITIZE_dumpstack.o := n
|
|
KASAN_SANITIZE_dumpstack_$(BITS).o := n
|
|
KASAN_SANITIZE_stacktrace.o := n
|
|
KASAN_SANITIZE_paravirt.o := n
|
|
KASAN_SANITIZE_sev.o := n
|
|
|
|
# With some compiler versions the generated code results in boot hangs, caused
|
|
# by several compilation units. To be safe, disable all instrumentation.
|
|
KCSAN_SANITIZE := n
|
|
KMSAN_SANITIZE_head$(BITS).o := n
|
|
KMSAN_SANITIZE_nmi.o := n
|
|
|
|
# If instrumentation of this dir is enabled, boot hangs during first second.
|
|
# Probably could be more selective here, but note that files related to irqs,
|
|
# boot, dumpstack/stacktrace, etc are either non-interesting or can lead to
|
|
# non-deterministic coverage.
|
|
KCOV_INSTRUMENT := n
|
|
|
|
CFLAGS_irq.o := -I $(srctree)/$(src)/../include/asm/trace
|
|
|
|
obj-y += head_$(BITS).o
|
|
obj-y += head$(BITS).o
|
|
obj-y += ebda.o
|
|
obj-y += platform-quirks.o
|
|
obj-y += process_$(BITS).o signal.o signal_$(BITS).o
|
|
obj-$(CONFIG_COMPAT) += signal_compat.o
|
|
obj-y += traps.o idt.o irq.o irq_$(BITS).o dumpstack_$(BITS).o
|
|
obj-y += time.o ioport.o dumpstack.o nmi.o
|
|
obj-$(CONFIG_MODIFY_LDT_SYSCALL) += ldt.o
|
|
obj-y += setup.o x86_init.o i8259.o irqinit.o
|
|
obj-$(CONFIG_JUMP_LABEL) += jump_label.o
|
|
obj-$(CONFIG_IRQ_WORK) += irq_work.o
|
|
obj-y += probe_roms.o
|
|
obj-$(CONFIG_X86_32) += sys_ia32.o
|
|
obj-$(CONFIG_IA32_EMULATION) += sys_ia32.o signal_32.o
|
|
obj-$(CONFIG_X86_64) += sys_x86_64.o
|
|
obj-$(CONFIG_X86_ESPFIX64) += espfix_64.o
|
|
obj-$(CONFIG_SYSFS) += ksysfs.o
|
|
obj-y += bootflag.o e820.o
|
|
obj-y += pci-dma.o quirks.o topology.o kdebugfs.o
|
|
obj-y += alternative.o i8253.o hw_breakpoint.o
|
|
obj-y += tsc.o tsc_msr.o io_delay.o rtc.o
|
|
obj-y += resource.o
|
|
obj-y += irqflags.o
|
|
obj-y += static_call.o
|
|
|
|
obj-y += process.o
|
|
obj-y += fpu/
|
|
obj-y += ptrace.o
|
|
obj-$(CONFIG_X86_32) += tls.o
|
|
obj-$(CONFIG_IA32_EMULATION) += tls.o
|
|
obj-y += step.o
|
|
obj-$(CONFIG_INTEL_TXT) += tboot.o
|
|
obj-$(CONFIG_ISA_DMA_API) += i8237.o
|
|
obj-y += stacktrace.o
|
|
obj-y += cpu/
|
|
obj-y += acpi/
|
|
obj-y += reboot.o
|
|
obj-$(CONFIG_X86_MSR) += msr.o
|
|
obj-$(CONFIG_X86_CPUID) += cpuid.o
|
|
obj-$(CONFIG_PCI) += early-quirks.o
|
|
apm-y := apm_32.o
|
|
obj-$(CONFIG_APM) += apm.o
|
|
obj-$(CONFIG_SMP) += smp.o
|
|
obj-$(CONFIG_SMP) += smpboot.o
|
|
obj-$(CONFIG_X86_TSC) += tsc_sync.o
|
|
obj-$(CONFIG_SMP) += setup_percpu.o
|
|
obj-$(CONFIG_X86_MPPARSE) += mpparse.o
|
|
obj-y += apic/
|
|
obj-$(CONFIG_X86_REBOOTFIXUPS) += reboot_fixups_32.o
|
|
obj-$(CONFIG_DYNAMIC_FTRACE) += ftrace.o
|
|
obj-$(CONFIG_FUNCTION_TRACER) += ftrace_$(BITS).o
|
|
obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o
|
|
obj-$(CONFIG_FTRACE_SYSCALLS) += ftrace.o
|
|
obj-$(CONFIG_X86_TSC) += trace_clock.o
|
|
obj-$(CONFIG_TRACING) += trace.o
|
|
obj-$(CONFIG_RETHOOK) += rethook.o
|
|
obj-$(CONFIG_CRASH_CORE) += crash_core_$(BITS).o
|
|
obj-$(CONFIG_KEXEC_CORE) += machine_kexec_$(BITS).o
|
|
obj-$(CONFIG_KEXEC_CORE) += relocate_kernel_$(BITS).o crash.o
|
|
obj-$(CONFIG_KEXEC_FILE) += kexec-bzimage64.o
|
|
obj-$(CONFIG_CRASH_DUMP) += crash_dump_$(BITS).o
|
|
obj-y += kprobes/
|
|
obj-$(CONFIG_MODULES) += module.o
|
|
obj-$(CONFIG_X86_32) += doublefault_32.o
|
|
obj-$(CONFIG_KGDB) += kgdb.o
|
|
obj-$(CONFIG_VM86) += vm86_32.o
|
|
obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
|
|
|
|
obj-$(CONFIG_HPET_TIMER) += hpet.o
|
|
|
|
obj-$(CONFIG_AMD_NB) += amd_nb.o
|
|
obj-$(CONFIG_DEBUG_NMI_SELFTEST) += nmi_selftest.o
|
|
|
|
obj-$(CONFIG_KVM_GUEST) += kvm.o kvmclock.o
|
|
obj-$(CONFIG_PARAVIRT) += paravirt.o
|
|
obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= paravirt-spinlocks.o
|
|
obj-$(CONFIG_PARAVIRT_CLOCK) += pvclock.o
|
|
obj-$(CONFIG_X86_PMEM_LEGACY_DEVICE) += pmem.o
|
|
|
|
obj-$(CONFIG_JAILHOUSE_GUEST) += jailhouse.o
|
|
|
|
obj-$(CONFIG_EISA) += eisa.o
|
|
obj-$(CONFIG_PCSPKR_PLATFORM) += pcspeaker.o
|
|
|
|
obj-$(CONFIG_X86_CHECK_BIOS_CORRUPTION) += check.o
|
|
|
|
obj-$(CONFIG_OF) += devicetree.o
|
|
obj-$(CONFIG_UPROBES) += uprobes.o
|
|
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_regs.o
|
|
obj-$(CONFIG_TRACING) += tracepoint.o
|
|
obj-$(CONFIG_SCHED_MC_PRIO) += itmt.o
|
|
obj-$(CONFIG_X86_UMIP) += umip.o
|
|
|
|
obj-$(CONFIG_UNWINDER_ORC) += unwind_orc.o
|
|
obj-$(CONFIG_UNWINDER_FRAME_POINTER) += unwind_frame.o
|
|
obj-$(CONFIG_UNWINDER_GUESS) += unwind_guess.o
|
|
|
|
obj-$(CONFIG_AMD_MEM_ENCRYPT) += sev.o
|
|
|
|
obj-$(CONFIG_CFI_CLANG) += cfi.o
|
|
|
|
obj-$(CONFIG_CALL_THUNKS) += callthunks.o
|
|
|
|
###
|
|
# 64 bit specific files
|
|
ifeq ($(CONFIG_X86_64),y)
|
|
obj-$(CONFIG_AUDIT) += audit_64.o
|
|
|
|
obj-$(CONFIG_GART_IOMMU) += amd_gart_64.o aperture_64.o
|
|
|
|
obj-$(CONFIG_MMCONF_FAM10H) += mmconf-fam10h_64.o
|
|
obj-y += vsmp_64.o
|
|
endif
|