mirror of
https://github.com/torvalds/linux.git
synced 2026-04-18 06:44:00 -04:00
54ac9ff8f1
Implement arm64 support for the 'unoptimized' static call variety, which routes all calls through a trampoline that performs a tail call to the chosen function, and wire it up for use when kCFI is enabled. This works around an issue with kCFI and generic static calls, where the prototypes of default handlers such as __static_call_nop() and __static_call_ret0() don't match the expected prototype of the call site, resulting in kCFI false positives [0]. Since static call targets may be located in modules loaded out of direct branching range, this needs an ADRP/LDR pair to load the branch target into R16 and a branch-to-register (BR) instruction to perform an indirect call. Unlike on x86, there is no pressing need on arm64 to avoid indirect calls at all cost, but hiding it from the compiler as is done here does have some benefits: - the literal is located in .rodata, which gives us the same robustness advantage that code patching does; - no D-cache pollution from fetching hash values from .text sections. From an execution speed PoV, this is unlikely to make any difference at all. Cc: Sami Tolvanen <samitolvanen@google.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Kees Cook <kees@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Will McVicker <willmcvicker@google.com> Reported-by: Carlos Llamas <cmllamas@google.com> Closes: https://lore.kernel.org/all/20260311225822.1565895-1-cmllamas@google.com/ [0] Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
89 lines
3.4 KiB
Makefile
89 lines
3.4 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for the linux kernel.
|
|
#
|
|
|
|
CFLAGS_armv8_deprecated.o := -I$(src)
|
|
|
|
CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_insn.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE)
|
|
|
|
# Remove stack protector to avoid triggering unneeded stack canary
|
|
# checks due to randomize_kstack_offset.
|
|
CFLAGS_REMOVE_syscall.o = -fstack-protector -fstack-protector-strong
|
|
CFLAGS_syscall.o += -fno-stack-protector
|
|
|
|
# When KASAN is enabled, a stack trace is recorded for every alloc/free, which
|
|
# can significantly impact performance. Avoid instrumenting the stack trace
|
|
# collection code to minimize this impact.
|
|
KASAN_SANITIZE_stacktrace.o := n
|
|
|
|
# It's not safe to invoke KCOV when portions of the kernel environment aren't
|
|
# available or are out-of-sync with HW state. Since `noinstr` doesn't always
|
|
# inhibit KCOV instrumentation, disable it for the entire compilation unit.
|
|
KCOV_INSTRUMENT_entry-common.o := n
|
|
KCOV_INSTRUMENT_idle.o := n
|
|
|
|
# Object file lists.
|
|
obj-y := debug-monitors.o entry.o irq.o fpsimd.o \
|
|
entry-common.o entry-fpsimd.o process.o ptrace.o \
|
|
setup.o signal.o sys.o stacktrace.o time.o traps.o \
|
|
io.o vdso.o hyp-stub.o psci.o cpu_ops.o \
|
|
return_address.o cpuinfo.o cpu_errata.o \
|
|
cpufeature.o alternative.o cacheinfo.o \
|
|
smp.o smp_spin_table.o topology.o smccc-call.o \
|
|
syscall.o proton-pack.o idle.o patching.o pi/ \
|
|
rsi.o jump_label.o
|
|
|
|
obj-$(CONFIG_COMPAT) += sys32.o signal32.o \
|
|
sys_compat.o
|
|
obj-$(CONFIG_COMPAT) += sigreturn32.o
|
|
obj-$(CONFIG_COMPAT_ALIGNMENT_FIXUPS) += compat_alignment.o
|
|
obj-$(CONFIG_KUSER_HELPERS) += kuser32.o
|
|
obj-$(CONFIG_FUNCTION_TRACER) += ftrace.o entry-ftrace.o
|
|
obj-$(CONFIG_MODULES) += module.o module-plts.o
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_regs.o perf_callchain.o
|
|
obj-$(CONFIG_HARDLOCKUP_DETECTOR_PERF) += watchdog_hld.o
|
|
obj-$(CONFIG_HAVE_HW_BREAKPOINT) += hw_breakpoint.o
|
|
obj-$(CONFIG_HAVE_STATIC_CALL) += static_call.o
|
|
obj-$(CONFIG_CPU_PM) += sleep.o suspend.o
|
|
obj-$(CONFIG_KGDB) += kgdb.o
|
|
obj-$(CONFIG_EFI) += efi.o efi-rt-wrapper.o
|
|
obj-$(CONFIG_PCI) += pci.o
|
|
obj-$(CONFIG_ARMV8_DEPRECATED) += armv8_deprecated.o
|
|
obj-$(CONFIG_ACPI) += acpi.o
|
|
obj-$(CONFIG_ACPI_NUMA) += acpi_numa.o
|
|
obj-$(CONFIG_ARM64_ACPI_PARKING_PROTOCOL) += acpi_parking_protocol.o
|
|
obj-$(CONFIG_PARAVIRT) += paravirt.o
|
|
obj-$(CONFIG_RANDOMIZE_BASE) += kaslr.o
|
|
obj-$(CONFIG_HIBERNATION) += hibernate.o hibernate-asm.o
|
|
obj-$(CONFIG_ELF_CORE) += elfcore.o
|
|
obj-$(CONFIG_KEXEC_CORE) += machine_kexec.o relocate_kernel.o \
|
|
cpu-reset.o
|
|
obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o
|
|
obj-$(CONFIG_ARM64_RELOC_TEST) += arm64-reloc-test.o
|
|
arm64-reloc-test-y := reloc_test_core.o reloc_test_syms.o
|
|
obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
|
|
obj-$(CONFIG_VMCORE_INFO) += vmcore_info.o
|
|
obj-$(CONFIG_ARM_SDE_INTERFACE) += sdei.o
|
|
obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o
|
|
obj-$(CONFIG_ARM64_MTE) += mte.o
|
|
obj-y += vdso-wrap.o
|
|
obj-$(CONFIG_COMPAT_VDSO) += vdso32-wrap.o
|
|
|
|
# Force dependency (vdso*-wrap.S includes vdso.so through incbin)
|
|
$(obj)/vdso-wrap.o: $(obj)/vdso/vdso.so
|
|
$(obj)/vdso32-wrap.o: $(obj)/vdso32/vdso.so
|
|
|
|
obj-y += probes/
|
|
obj-y += head.o
|
|
always-$(KBUILD_BUILTIN) += vmlinux.lds
|
|
|
|
ifeq ($(CONFIG_DEBUG_EFI),y)
|
|
AFLAGS_head.o += -DVMLINUX_PATH="\"$(abspath vmlinux)\""
|
|
endif
|
|
|
|
# for cleaning
|
|
subdir- += vdso vdso32
|