mirror of
https://github.com/raspberrypi/linux.git
synced 2025-12-15 22:41:38 +00:00
4da9f33026
Pull x86 fsgsbase from Thomas Gleixner: "Support for FSGSBASE. Almost 5 years after the first RFC to support it, this has been brought into a shape which is maintainable and actually works. This final version was done by Sasha Levin who took it up after Intel dropped the ball. Sasha discovered that the SGX (sic!) offerings out there ship rogue kernel modules enabling FSGSBASE behind the kernels back which opens an instantanious unpriviledged root hole. The FSGSBASE instructions provide a considerable speedup of the context switch path and enable user space to write GSBASE without kernel interaction. This enablement requires careful handling of the exception entries which go through the paranoid entry path as they can no longer rely on the assumption that user GSBASE is positive (as enforced via prctl() on non FSGSBASE enabled systemn). All other entries (syscalls, interrupts and exceptions) can still just utilize SWAPGS unconditionally when the entry comes from user space. Converting these entries to use FSGSBASE has no benefit as SWAPGS is only marginally slower than WRGSBASE and locating and retrieving the kernel GSBASE value is not a free operation either. The real benefit of RD/WRGSBASE is the avoidance of the MSR reads and writes. The changes come with appropriate selftests and have held up in field testing against the (sanitized) Graphene-SGX driver" * tag 'x86-fsgsbase-2020-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits) x86/fsgsbase: Fix Xen PV support x86/ptrace: Fix 32-bit PTRACE_SETREGS vs fsbase and gsbase selftests/x86/fsgsbase: Add a missing memory constraint selftests/x86/fsgsbase: Fix a comment in the ptrace_write_gsbase test selftests/x86: Add a syscall_arg_fault_64 test for negative GSBASE selftests/x86/fsgsbase: Test ptracer-induced GS base write with FSGSBASE selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base write Documentation/x86/64: Add documentation for GS/FS addressing mode x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 x86/cpu: Enable FSGSBASE on 64bit by default and add a chicken bit x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit x86/entry/64: Introduce the FIND_PERCPU_BASE macro x86/entry/64: Switch CR3 before SWAPGS in paranoid entry x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation x86/process/64: Use FSGSBASE instructions on thread copy and ptrace x86/process/64: Use FSBSBASE in switch_to() if available x86/process/64: Make save_fsgs_for_kvm() ready for FSGSBASE x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE ...
107 lines
3.4 KiB
Makefile
107 lines
3.4 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
all:
|
|
|
|
include ../lib.mk
|
|
|
|
.PHONY: all all_32 all_64 warn_32bit_failure clean
|
|
|
|
UNAME_M := $(shell uname -m)
|
|
CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
|
|
CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
|
|
CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh $(CC) trivial_program.c -no-pie)
|
|
|
|
TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
|
|
check_initial_reg_state sigreturn iopl ioperm \
|
|
test_vdso test_vsyscall mov_ss_trap \
|
|
syscall_arg_fault fsgsbase_restore
|
|
TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso unwind_vdso \
|
|
test_FCMOV test_FCOMI test_FISTTP \
|
|
vdso_restorer
|
|
TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip syscall_numbering
|
|
# Some selftests require 32bit support enabled also on 64bit systems
|
|
TARGETS_C_32BIT_NEEDED := ldt_gdt ptrace_syscall
|
|
|
|
TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY) $(TARGETS_C_32BIT_NEEDED)
|
|
TARGETS_C_64BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_64BIT_ONLY)
|
|
ifeq ($(CAN_BUILD_I386)$(CAN_BUILD_X86_64),11)
|
|
TARGETS_C_64BIT_ALL += $(TARGETS_C_32BIT_NEEDED)
|
|
endif
|
|
|
|
BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
|
|
BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
|
|
|
|
BINARIES_32 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_32))
|
|
BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
|
|
|
|
CFLAGS := -O2 -g -std=gnu99 -pthread -Wall
|
|
|
|
# call32_from_64 in thunks.S uses absolute addresses.
|
|
ifeq ($(CAN_BUILD_WITH_NOPIE),1)
|
|
CFLAGS += -no-pie
|
|
endif
|
|
|
|
define gen-target-rule-32
|
|
$(1) $(1)_32: $(OUTPUT)/$(1)_32
|
|
.PHONY: $(1) $(1)_32
|
|
endef
|
|
|
|
define gen-target-rule-64
|
|
$(1) $(1)_64: $(OUTPUT)/$(1)_64
|
|
.PHONY: $(1) $(1)_64
|
|
endef
|
|
|
|
ifeq ($(CAN_BUILD_I386),1)
|
|
all: all_32
|
|
TEST_PROGS += $(BINARIES_32)
|
|
EXTRA_CFLAGS += -DCAN_BUILD_32
|
|
$(foreach t,$(TARGETS_C_32BIT_ALL),$(eval $(call gen-target-rule-32,$(t))))
|
|
endif
|
|
|
|
ifeq ($(CAN_BUILD_X86_64),1)
|
|
all: all_64
|
|
TEST_PROGS += $(BINARIES_64)
|
|
EXTRA_CFLAGS += -DCAN_BUILD_64
|
|
$(foreach t,$(TARGETS_C_64BIT_ALL),$(eval $(call gen-target-rule-64,$(t))))
|
|
endif
|
|
|
|
all_32: $(BINARIES_32)
|
|
|
|
all_64: $(BINARIES_64)
|
|
|
|
EXTRA_CLEAN := $(BINARIES_32) $(BINARIES_64)
|
|
|
|
$(BINARIES_32): $(OUTPUT)/%_32: %.c helpers.h
|
|
$(CC) -m32 -o $@ $(CFLAGS) $(EXTRA_CFLAGS) $^ -lrt -ldl -lm
|
|
|
|
$(BINARIES_64): $(OUTPUT)/%_64: %.c helpers.h
|
|
$(CC) -m64 -o $@ $(CFLAGS) $(EXTRA_CFLAGS) $^ -lrt -ldl
|
|
|
|
# x86_64 users should be encouraged to install 32-bit libraries
|
|
ifeq ($(CAN_BUILD_I386)$(CAN_BUILD_X86_64),01)
|
|
all: warn_32bit_failure
|
|
|
|
warn_32bit_failure:
|
|
@echo "Warning: you seem to have a broken 32-bit build" 2>&1; \
|
|
echo "environment. This will reduce test coverage of 64-bit" 2>&1; \
|
|
echo "kernels. If you are using a Debian-like distribution," 2>&1; \
|
|
echo "try:"; 2>&1; \
|
|
echo ""; \
|
|
echo " apt-get install gcc-multilib libc6-i386 libc6-dev-i386"; \
|
|
echo ""; \
|
|
echo "If you are using a Fedora-like distribution, try:"; \
|
|
echo ""; \
|
|
echo " yum install glibc-devel.*i686"; \
|
|
exit 0;
|
|
endif
|
|
|
|
# Some tests have additional dependencies.
|
|
$(OUTPUT)/sysret_ss_attrs_64: thunks.S
|
|
$(OUTPUT)/ptrace_syscall_32: raw_syscall_helper_32.S
|
|
$(OUTPUT)/test_syscall_vdso_32: thunks_32.S
|
|
|
|
# check_initial_reg_state is special: it needs a custom entry, and it
|
|
# needs to be static so that its interpreter doesn't destroy its initial
|
|
# state.
|
|
$(OUTPUT)/check_initial_reg_state_32: CFLAGS += -Wl,-ereal_start -static
|
|
$(OUTPUT)/check_initial_reg_state_64: CFLAGS += -Wl,-ereal_start -static
|