mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 02:44:41 +01:00
Shadow stack instructions are taken from the Zimop ISA extension, which is mandated on RVA23. Any userspace with shadow stack instructions in it will fault on hardware that doesn't have support for Zimop. Thus, a shadow stack-enabled userspace can't be run on hardware that doesn't support Zimop. It's not known how Linux userspace providers will respond to this kind of binary fragmentation. In order to keep kernel portable across different hardware, 'arch/riscv/kernel/vdso_cfi' is created which has Makefile logic to compile 'arch/riscv/kernel/vdso' sources with CFI flags, and 'arch/riscv/kernel/vdso.c' is modified to select the appropriate vdso depending on whether the underlying CPU implements the Zimop extension. Since the offset of vdso symbols will change due to having two different vdso binaries, there is added logic to include a new generated vdso offset header and dynamically select the offset (like for rt_sigreturn). Signed-off-by: Deepak Gupta <debug@rivosinc.com> Acked-by: Charles Mirabile <cmirabil@redhat.com> Tested-by: Andreas Korb <andreas.korb@aisec.fraunhofer.de> # QEMU, custom CVA6 Tested-by: Valentin Haudiquet <valentin.haudiquet@canonical.com> Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-24-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley <pjw@kernel.org>
130 lines
3.7 KiB
Makefile
130 lines
3.7 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0-only
|
|
#
|
|
# Makefile for the RISC-V Linux kernel
|
|
#
|
|
|
|
CFLAGS_syscall_table.o += $(call cc-disable-warning, override-init)
|
|
CFLAGS_compat_syscall_table.o += $(call cc-disable-warning, override-init)
|
|
|
|
ifdef CONFIG_KEXEC_CORE
|
|
AFLAGS_kexec_relocate.o := -mcmodel=medany $(call cc-option,-mno-relax)
|
|
endif
|
|
|
|
# cmodel=medany and notrace when patching early
|
|
ifdef CONFIG_RISCV_ALTERNATIVE_EARLY
|
|
CFLAGS_alternative.o := -mcmodel=medany
|
|
CFLAGS_cpufeature.o := -mcmodel=medany
|
|
CFLAGS_sbi_ecall.o := -mcmodel=medany
|
|
ifdef CONFIG_FTRACE
|
|
CFLAGS_REMOVE_alternative.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_cpufeature.o = $(CC_FLAGS_FTRACE)
|
|
endif
|
|
ifdef CONFIG_RELOCATABLE
|
|
CFLAGS_alternative.o += -fno-pie
|
|
CFLAGS_cpufeature.o += -fno-pie
|
|
CFLAGS_sbi_ecall.o += -fno-pie
|
|
endif
|
|
ifdef CONFIG_KASAN
|
|
KASAN_SANITIZE_alternative.o := n
|
|
KASAN_SANITIZE_cpufeature.o := n
|
|
KASAN_SANITIZE_sbi_ecall.o := n
|
|
endif
|
|
ifdef CONFIG_FORTIFY_SOURCE
|
|
CFLAGS_alternative.o += -D__NO_FORTIFY
|
|
CFLAGS_cpufeature.o += -D__NO_FORTIFY
|
|
CFLAGS_sbi_ecall.o += -D__NO_FORTIFY
|
|
endif
|
|
endif
|
|
|
|
ifdef CONFIG_FTRACE
|
|
CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_patch.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_sbi.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE)
|
|
CFLAGS_REMOVE_sbi_ecall.o = $(CC_FLAGS_FTRACE)
|
|
endif
|
|
|
|
always-$(KBUILD_BUILTIN) += vmlinux.lds
|
|
|
|
obj-y += head.o
|
|
obj-y += soc.o
|
|
obj-$(CONFIG_RISCV_ALTERNATIVE) += alternative.o
|
|
obj-y += cpu.o
|
|
obj-y += cpufeature.o
|
|
obj-y += entry.o
|
|
obj-y += irq.o
|
|
obj-y += process.o
|
|
obj-y += ptrace.o
|
|
obj-y += reset.o
|
|
obj-y += return_address.o
|
|
obj-y += setup.o
|
|
obj-y += signal.o
|
|
obj-y += syscall_table.o
|
|
obj-y += sys_riscv.o
|
|
obj-y += sys_hwprobe.o
|
|
obj-y += time.o
|
|
obj-y += traps.o
|
|
obj-y += riscv_ksyms.o
|
|
obj-y += stacktrace.o
|
|
obj-y += cacheinfo.o
|
|
obj-y += patch.o
|
|
obj-y += vendor_extensions.o
|
|
obj-y += vendor_extensions/
|
|
obj-y += probes/
|
|
obj-y += tests/
|
|
obj-$(CONFIG_MMU) += vdso.o vdso/
|
|
obj-$(CONFIG_RISCV_USER_CFI) += vdso_cfi/
|
|
|
|
obj-$(CONFIG_RISCV_MISALIGNED) += traps_misaligned.o
|
|
obj-$(CONFIG_RISCV_MISALIGNED) += unaligned_access_speed.o
|
|
obj-$(CONFIG_RISCV_PROBE_UNALIGNED_ACCESS) += copy-unaligned.o
|
|
obj-$(CONFIG_RISCV_PROBE_VECTOR_UNALIGNED_ACCESS) += vec-copy-unaligned.o
|
|
|
|
obj-$(CONFIG_FPU) += fpu.o
|
|
obj-$(CONFIG_FPU) += kernel_mode_fpu.o
|
|
obj-$(CONFIG_RISCV_ISA_V) += vector.o
|
|
obj-$(CONFIG_RISCV_ISA_V) += kernel_mode_vector.o
|
|
obj-$(CONFIG_SMP) += smpboot.o
|
|
obj-$(CONFIG_SMP) += smp.o
|
|
obj-$(CONFIG_SMP) += cpu_ops.o
|
|
|
|
obj-$(CONFIG_RISCV_BOOT_SPINWAIT) += cpu_ops_spinwait.o
|
|
obj-$(CONFIG_MODULES) += module.o
|
|
obj-$(CONFIG_MODULE_SECTIONS) += module-sections.o
|
|
|
|
obj-$(CONFIG_CPU_PM) += suspend_entry.o suspend.o
|
|
obj-$(CONFIG_HIBERNATION) += hibernate.o hibernate-asm.o
|
|
|
|
obj-$(CONFIG_FUNCTION_TRACER) += mcount.o ftrace.o
|
|
obj-$(CONFIG_DYNAMIC_FTRACE) += mcount-dyn.o
|
|
|
|
obj-$(CONFIG_PERF_EVENTS) += perf_callchain.o
|
|
obj-$(CONFIG_HAVE_PERF_REGS) += perf_regs.o
|
|
obj-$(CONFIG_RISCV_SBI) += sbi.o sbi_ecall.o
|
|
ifeq ($(CONFIG_RISCV_SBI), y)
|
|
obj-$(CONFIG_SMP) += sbi-ipi.o
|
|
obj-$(CONFIG_SMP) += cpu_ops_sbi.o
|
|
endif
|
|
obj-$(CONFIG_HOTPLUG_CPU) += cpu-hotplug.o
|
|
obj-$(CONFIG_PARAVIRT) += paravirt.o
|
|
obj-$(CONFIG_KGDB) += kgdb.o
|
|
obj-$(CONFIG_KEXEC_CORE) += kexec_relocate.o crash_save_regs.o machine_kexec.o
|
|
obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o kexec_image.o machine_kexec_file.o
|
|
obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
|
|
obj-$(CONFIG_VMCORE_INFO) += vmcore_info.o
|
|
|
|
obj-$(CONFIG_JUMP_LABEL) += jump_label.o
|
|
|
|
obj-$(CONFIG_CFI) += cfi.o
|
|
|
|
obj-$(CONFIG_EFI) += efi.o
|
|
obj-$(CONFIG_COMPAT) += compat_syscall_table.o
|
|
obj-$(CONFIG_COMPAT) += compat_signal.o
|
|
obj-$(CONFIG_COMPAT) += compat_vdso/
|
|
|
|
obj-$(CONFIG_64BIT) += pi/
|
|
obj-$(CONFIG_ACPI) += acpi.o
|
|
obj-$(CONFIG_ACPI_NUMA) += acpi_numa.o
|
|
|
|
obj-$(CONFIG_GENERIC_CPU_VULNERABILITIES) += bugs.o
|
|
obj-$(CONFIG_RISCV_USER_CFI) += usercfi.o
|