mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-03-08 18:26:12 +01:00
22bdd6e68b
Pull x86 SEV and apic updates from Borislav Petkov: - Add functionality to provide runtime firmware updates for the non-x86 parts of an AMD platform like the security processor (ASP) firmware, modules etc, for example. The intent being that these updates are interim, live fixups before a proper BIOS update can be attempted - Add guest support for AMD's Secure AVIC feature which gives encrypted guests the needed protection against a malicious hypervisor generating unexpected interrupts and injecting them into such guest, thus interfering with its operation in an unexpected and negative manner. The advantage of this scheme is that the guest determines which interrupts and when to accept them vs leaving that to the benevolence (or not) of the hypervisor - Strictly separate the startup code from the rest of the kernel where former is executed from the initial 1:1 mapping of memory. The problem was that the toolchain-generated version of the code was being executed from a different mapping of memory than what was "assumed" during code generation, needing an ever-growing pile of fixups for absolute memory references which are invalid in the early, 1:1 memory mapping during boot. The major advantage of this is that there's no need to check the 1:1 mapping portion of the code for absolute relocations anymore and get rid of the RIP_REL_REF() macro sprinkling all over the place. For more info, see Ard's very detailed writeup on this [1] - The usual cleanups and fixes Link: https://lore.kernel.org/r/CAMj1kXEzKEuePEiHB%2BHxvfQbFz0sTiHdn4B%2B%2BzVBJ2mhkPkQ4Q@mail.gmail.com [1] * tag 'x86_apic_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (49 commits) x86/boot: Drop erroneous __init annotation from early_set_pages_state() crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver crypto: ccp - Add new HV-Fixed page allocation/free API x86/sev: Add new dump_rmp parameter to snp_leak_pages() API x86/startup/sev: Document the CPUID flow in the boot #VC handler objtool: Ignore __pi___cfi_ prefixed symbols x86/sev: Zap snp_abort() x86/apic/savic: Do not use snp_abort() x86/boot: Get rid of the .head.text section x86/boot: Move startup code out of __head section efistub/x86: Remap inittext read-execute when needed x86/boot: Create a confined code area for startup code x86/kbuild: Incorporate boot/startup/ via Kbuild makefile x86/boot: Revert "Reject absolute references in .head.text" x86/boot: Check startup code for absence of absolute relocations objtool: Add action to check for absence of absolute relocations x86/sev: Export startup routines for later use x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object x86/sev: Provide PIC aliases for SEV related data objects x86/boot: Provide PIC aliases for 5-level paging related constants ...
365 lines
12 KiB
Makefile
365 lines
12 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
# Unified Makefile for i386 and x86_64
|
|
|
|
# select defconfig based on actual architecture
|
|
ifeq ($(ARCH),x86)
|
|
ifeq ($(shell uname -m | sed -e 's/i.86/i386/'),i386)
|
|
KBUILD_DEFCONFIG := i386_defconfig
|
|
else
|
|
KBUILD_DEFCONFIG := x86_64_defconfig
|
|
endif
|
|
else
|
|
KBUILD_DEFCONFIG := $(ARCH)_defconfig
|
|
endif
|
|
|
|
ifdef CONFIG_CC_IS_GCC
|
|
RETPOLINE_CFLAGS := -mindirect-branch=thunk-extern -mindirect-branch-register
|
|
RETPOLINE_VDSO_CFLAGS := -mindirect-branch=thunk-inline -mindirect-branch-register
|
|
endif
|
|
ifdef CONFIG_CC_IS_CLANG
|
|
RETPOLINE_CFLAGS := -mretpoline-external-thunk
|
|
RETPOLINE_VDSO_CFLAGS := -mretpoline
|
|
endif
|
|
RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch-cs-prefix)
|
|
|
|
ifdef CONFIG_MITIGATION_RETHUNK
|
|
RETHUNK_CFLAGS := -mfunction-return=thunk-extern
|
|
RETHUNK_RUSTFLAGS := -Zfunction-return=thunk-extern
|
|
RETPOLINE_CFLAGS += $(RETHUNK_CFLAGS)
|
|
RETPOLINE_RUSTFLAGS += $(RETHUNK_RUSTFLAGS)
|
|
endif
|
|
|
|
export RETHUNK_CFLAGS
|
|
export RETHUNK_RUSTFLAGS
|
|
export RETPOLINE_CFLAGS
|
|
export RETPOLINE_RUSTFLAGS
|
|
export RETPOLINE_VDSO_CFLAGS
|
|
|
|
# For gcc stack alignment is specified with -mpreferred-stack-boundary,
|
|
# clang has the option -mstack-alignment for that purpose.
|
|
ifdef CONFIG_CC_IS_GCC
|
|
cc_stack_align4 := -mpreferred-stack-boundary=2
|
|
cc_stack_align8 := -mpreferred-stack-boundary=3
|
|
endif
|
|
ifdef CONFIG_CC_IS_CLANG
|
|
cc_stack_align4 := -mstack-alignment=4
|
|
cc_stack_align8 := -mstack-alignment=8
|
|
endif
|
|
|
|
# How to compile the 16-bit code. Note we always compile for -march=i386;
|
|
# that way we can complain to the user if the CPU is insufficient.
|
|
REALMODE_CFLAGS := -std=gnu11 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
|
|
-Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
|
|
-fno-strict-aliasing -fomit-frame-pointer -fno-pic \
|
|
-mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
|
|
|
|
REALMODE_CFLAGS += -ffreestanding
|
|
REALMODE_CFLAGS += -fno-stack-protector
|
|
REALMODE_CFLAGS += -Wno-address-of-packed-member
|
|
REALMODE_CFLAGS += $(cc_stack_align4)
|
|
REALMODE_CFLAGS += $(CLANG_FLAGS)
|
|
ifdef CONFIG_CC_IS_CLANG
|
|
REALMODE_CFLAGS += -Wno-gnu
|
|
endif
|
|
export REALMODE_CFLAGS
|
|
|
|
# BITS is used as extension for files which are available in a 32 bit
|
|
# and a 64 bit version to simplify shared Makefiles.
|
|
# e.g.: obj-y += foo_$(BITS).o
|
|
export BITS
|
|
|
|
#
|
|
# Prevent GCC from generating any FP code by mistake.
|
|
#
|
|
# This must happen before we try the -mpreferred-stack-boundary, see:
|
|
#
|
|
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53383
|
|
#
|
|
KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx
|
|
KBUILD_RUSTFLAGS += --target=$(objtree)/scripts/target.json
|
|
KBUILD_RUSTFLAGS += -Ctarget-feature=-sse,-sse2,-sse3,-ssse3,-sse4.1,-sse4.2,-avx,-avx2
|
|
|
|
#
|
|
# CFLAGS for compiling floating point code inside the kernel.
|
|
#
|
|
CC_FLAGS_FPU := -msse -msse2
|
|
ifdef CONFIG_CC_IS_GCC
|
|
CC_FLAGS_FPU += -mhard-float
|
|
endif
|
|
|
|
ifeq ($(CONFIG_X86_KERNEL_IBT),y)
|
|
#
|
|
# Kernel IBT has S_CET.NOTRACK_EN=0, as such the compilers must not generate
|
|
# NOTRACK prefixes. Current generation compilers unconditionally employ NOTRACK
|
|
# for jump-tables, as such, disable jump-tables for now.
|
|
#
|
|
# (jump-tables are implicitly disabled by RETPOLINE)
|
|
#
|
|
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104816
|
|
#
|
|
KBUILD_CFLAGS += $(call cc-option,-fcf-protection=branch -fno-jump-tables)
|
|
KBUILD_RUSTFLAGS += -Zcf-protection=branch -Zno-jump-tables
|
|
else
|
|
KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
|
|
endif
|
|
|
|
ifeq ($(CONFIG_X86_32),y)
|
|
BITS := 32
|
|
UTS_MACHINE := i386
|
|
CHECKFLAGS += -D__i386__
|
|
|
|
KBUILD_AFLAGS += -m32
|
|
KBUILD_CFLAGS += -m32
|
|
|
|
KBUILD_CFLAGS += -msoft-float -mregparm=3 -freg-struct-return
|
|
|
|
# Never want PIC in a 32-bit kernel, prevent breakage with GCC built
|
|
# with nonstandard options
|
|
KBUILD_CFLAGS += -fno-pic
|
|
|
|
# Align the stack to the register width instead of using the default
|
|
# alignment of 16 bytes. This reduces stack usage and the number of
|
|
# alignment instructions.
|
|
KBUILD_CFLAGS += $(cc_stack_align4)
|
|
|
|
# CPU-specific tuning. Anything which can be shared with UML should go here.
|
|
include $(srctree)/arch/x86/Makefile_32.cpu
|
|
KBUILD_CFLAGS += $(cflags-y)
|
|
|
|
ifneq ($(call clang-min-version, 160000),y)
|
|
# https://github.com/llvm/llvm-project/issues/53645
|
|
KBUILD_CFLAGS += -ffreestanding
|
|
endif
|
|
|
|
percpu_seg := fs
|
|
else
|
|
BITS := 64
|
|
UTS_MACHINE := x86_64
|
|
CHECKFLAGS += -D__x86_64__
|
|
|
|
KBUILD_AFLAGS += -m64
|
|
KBUILD_CFLAGS += -m64
|
|
|
|
# Align jump targets to 1 byte, not the default 16 bytes:
|
|
KBUILD_CFLAGS += $(call cc-option,-falign-jumps=1)
|
|
|
|
# Pack loops tightly as well:
|
|
KBUILD_CFLAGS += $(call cc-option,-falign-loops=1)
|
|
|
|
# Don't autogenerate traditional x87 instructions
|
|
KBUILD_CFLAGS += -mno-80387
|
|
KBUILD_CFLAGS += -mno-fp-ret-in-387
|
|
|
|
# By default gcc and clang use a stack alignment of 16 bytes for x86.
|
|
# However the standard kernel entry on x86-64 leaves the stack on an
|
|
# 8-byte boundary. If the compiler isn't informed about the actual
|
|
# alignment it will generate extra alignment instructions for the
|
|
# default alignment which keep the stack *mis*aligned.
|
|
# Furthermore an alignment to the register width reduces stack usage
|
|
# and the number of alignment instructions.
|
|
KBUILD_CFLAGS += $(cc_stack_align8)
|
|
|
|
# Use -mskip-rax-setup if supported.
|
|
KBUILD_CFLAGS += -mskip-rax-setup
|
|
|
|
ifdef CONFIG_X86_NATIVE_CPU
|
|
KBUILD_CFLAGS += -march=native
|
|
KBUILD_RUSTFLAGS += -Ctarget-cpu=native
|
|
else
|
|
KBUILD_CFLAGS += -march=x86-64 -mtune=generic
|
|
KBUILD_RUSTFLAGS += -Ctarget-cpu=x86-64 -Ztune-cpu=generic
|
|
endif
|
|
|
|
KBUILD_CFLAGS += -mno-red-zone
|
|
KBUILD_CFLAGS += -mcmodel=kernel
|
|
KBUILD_RUSTFLAGS += -Cno-redzone=y
|
|
KBUILD_RUSTFLAGS += -Ccode-model=kernel
|
|
|
|
percpu_seg := gs
|
|
endif
|
|
|
|
ifeq ($(CONFIG_STACKPROTECTOR),y)
|
|
ifeq ($(CONFIG_SMP),y)
|
|
KBUILD_CFLAGS += -mstack-protector-guard-reg=$(percpu_seg)
|
|
KBUILD_CFLAGS += -mstack-protector-guard-symbol=__ref_stack_chk_guard
|
|
else
|
|
KBUILD_CFLAGS += -mstack-protector-guard=global
|
|
endif
|
|
endif
|
|
|
|
#
|
|
# If the function graph tracer is used with mcount instead of fentry,
|
|
# '-maccumulate-outgoing-args' is needed to prevent a GCC bug
|
|
# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=42109)
|
|
#
|
|
ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
|
ifndef CONFIG_HAVE_FENTRY
|
|
ACCUMULATE_OUTGOING_ARGS := 1
|
|
endif
|
|
endif
|
|
|
|
ifeq ($(ACCUMULATE_OUTGOING_ARGS), 1)
|
|
# This compiler flag is not supported by Clang:
|
|
KBUILD_CFLAGS += $(call cc-option,-maccumulate-outgoing-args,)
|
|
endif
|
|
|
|
# Workaround for a gcc prelease that unfortunately was shipped in a suse release
|
|
KBUILD_CFLAGS += -Wno-sign-compare
|
|
#
|
|
KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
|
|
|
|
# Avoid indirect branches in kernel to deal with Spectre
|
|
ifdef CONFIG_MITIGATION_RETPOLINE
|
|
KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
|
|
KBUILD_RUSTFLAGS += $(RETPOLINE_RUSTFLAGS)
|
|
# Additionally, avoid generating expensive indirect jumps which
|
|
# are subject to retpolines for small number of switch cases.
|
|
# LLVM turns off jump table generation by default when under
|
|
# retpoline builds, however, gcc does not for x86. This has
|
|
# only been fixed starting from gcc stable version 8.4.0 and
|
|
# onwards, but not for older ones. See gcc bug #86952.
|
|
ifndef CONFIG_CC_IS_CLANG
|
|
KBUILD_CFLAGS += -fno-jump-tables
|
|
endif
|
|
endif
|
|
|
|
ifdef CONFIG_MITIGATION_SLS
|
|
KBUILD_CFLAGS += -mharden-sls=all
|
|
endif
|
|
|
|
ifdef CONFIG_CALL_PADDING
|
|
PADDING_CFLAGS := -fpatchable-function-entry=$(CONFIG_FUNCTION_PADDING_BYTES),$(CONFIG_FUNCTION_PADDING_BYTES)
|
|
KBUILD_CFLAGS += $(PADDING_CFLAGS)
|
|
export PADDING_CFLAGS
|
|
|
|
PADDING_RUSTFLAGS := -Zpatchable-function-entry=$(CONFIG_FUNCTION_PADDING_BYTES),$(CONFIG_FUNCTION_PADDING_BYTES)
|
|
KBUILD_RUSTFLAGS += $(PADDING_RUSTFLAGS)
|
|
export PADDING_RUSTFLAGS
|
|
endif
|
|
|
|
KBUILD_LDFLAGS += -m elf_$(UTS_MACHINE)
|
|
|
|
#
|
|
# The 64-bit kernel must be aligned to 2MB. Pass -z max-page-size=0x200000 to
|
|
# the linker to force 2MB page size regardless of the default page size used
|
|
# by the linker.
|
|
#
|
|
ifdef CONFIG_X86_64
|
|
LDFLAGS_vmlinux += -z max-page-size=0x200000
|
|
endif
|
|
|
|
|
|
archscripts: scripts_basic
|
|
$(Q)$(MAKE) $(build)=arch/x86/tools relocs
|
|
|
|
###
|
|
# Syscall table generation
|
|
|
|
archheaders:
|
|
$(Q)$(MAKE) $(build)=arch/x86/entry/syscalls all
|
|
|
|
###
|
|
# <asm/cpufeaturemasks.h> header generation
|
|
|
|
cpufeaturemasks.hdr := arch/x86/include/generated/asm/cpufeaturemasks.h
|
|
cpufeaturemasks.awk := $(srctree)/arch/x86/tools/cpufeaturemasks.awk
|
|
cpufeatures_hdr := $(srctree)/arch/x86/include/asm/cpufeatures.h
|
|
targets += $(cpufeaturemasks.hdr)
|
|
filechk_gen_featuremasks = $(AWK) -f $(cpufeaturemasks.awk) $(cpufeatures_hdr) $(KCONFIG_CONFIG)
|
|
|
|
$(cpufeaturemasks.hdr): $(cpufeaturemasks.awk) $(cpufeatures_hdr) $(KCONFIG_CONFIG) FORCE
|
|
$(shell mkdir -p $(dir $@))
|
|
$(call filechk,gen_featuremasks)
|
|
archprepare: $(cpufeaturemasks.hdr)
|
|
|
|
###
|
|
# Kernel objects
|
|
|
|
libs-y += arch/x86/lib/
|
|
|
|
# drivers-y are linked after core-y
|
|
drivers-$(CONFIG_MATH_EMULATION) += arch/x86/math-emu/
|
|
drivers-$(CONFIG_PCI) += arch/x86/pci/
|
|
|
|
# suspend and hibernation support
|
|
drivers-$(CONFIG_PM) += arch/x86/power/
|
|
|
|
drivers-$(CONFIG_VIDEO) += arch/x86/video/
|
|
|
|
####
|
|
# boot loader support. Several targets are kept for legacy purposes
|
|
|
|
boot := arch/x86/boot
|
|
|
|
BOOT_TARGETS = bzdisk fdimage fdimage144 fdimage288 hdimage isoimage
|
|
|
|
PHONY += bzImage $(BOOT_TARGETS)
|
|
|
|
# Default kernel to build
|
|
all: bzImage
|
|
|
|
# KBUILD_IMAGE specify target image being built
|
|
KBUILD_IMAGE := $(boot)/bzImage
|
|
|
|
bzImage: vmlinux
|
|
ifeq ($(CONFIG_X86_DECODER_SELFTEST),y)
|
|
$(Q)$(MAKE) $(build)=arch/x86/tools posttest
|
|
endif
|
|
$(Q)$(MAKE) $(build)=$(boot) $(KBUILD_IMAGE)
|
|
$(Q)mkdir -p $(objtree)/arch/$(UTS_MACHINE)/boot
|
|
$(Q)ln -fsn ../../x86/boot/bzImage $(objtree)/arch/$(UTS_MACHINE)/boot/$@
|
|
|
|
$(BOOT_TARGETS): vmlinux
|
|
$(Q)$(MAKE) $(build)=$(boot) $@
|
|
|
|
PHONY += install
|
|
install:
|
|
$(call cmd,install)
|
|
|
|
vdso-install-$(CONFIG_X86_64) += arch/x86/entry/vdso/vdso64.so.dbg
|
|
vdso-install-$(CONFIG_X86_X32_ABI) += arch/x86/entry/vdso/vdsox32.so.dbg
|
|
vdso-install-$(CONFIG_COMPAT_32) += arch/x86/entry/vdso/vdso32.so.dbg
|
|
|
|
archprepare: checkbin
|
|
checkbin:
|
|
ifdef CONFIG_MITIGATION_RETPOLINE
|
|
ifeq ($(RETPOLINE_CFLAGS),)
|
|
@echo "You are building kernel with non-retpoline compiler." >&2
|
|
@echo "Please update your compiler." >&2
|
|
@false
|
|
endif
|
|
endif
|
|
|
|
ifdef CONFIG_UNWINDER_ORC
|
|
orc_hash_h := arch/$(SRCARCH)/include/generated/asm/orc_hash.h
|
|
orc_hash_sh := $(srctree)/scripts/orc_hash.sh
|
|
targets += $(orc_hash_h)
|
|
quiet_cmd_orc_hash = GEN $@
|
|
cmd_orc_hash = mkdir -p $(dir $@); \
|
|
$(CONFIG_SHELL) $(orc_hash_sh) < $< > $@
|
|
$(orc_hash_h): $(srctree)/arch/x86/include/asm/orc_types.h $(orc_hash_sh) FORCE
|
|
$(call if_changed,orc_hash)
|
|
archprepare: $(orc_hash_h)
|
|
endif
|
|
|
|
archclean:
|
|
$(Q)rm -rf $(objtree)/arch/i386
|
|
$(Q)rm -rf $(objtree)/arch/x86_64
|
|
|
|
define archhelp
|
|
echo '* bzImage - Compressed kernel image (arch/x86/boot/bzImage)'
|
|
echo ' install - Install kernel using (your) ~/bin/$(INSTALLKERNEL) or'
|
|
echo ' (distribution) /sbin/$(INSTALLKERNEL) or install to '
|
|
echo ' $$(INSTALL_PATH) and run lilo'
|
|
echo ''
|
|
echo ' fdimage - Create 1.4MB boot floppy image (arch/x86/boot/fdimage)'
|
|
echo ' fdimage144 - Create 1.4MB boot floppy image (arch/x86/boot/fdimage)'
|
|
echo ' fdimage288 - Create 2.8MB boot floppy image (arch/x86/boot/fdimage)'
|
|
echo ' hdimage - Create a BIOS/EFI hard disk image (arch/x86/boot/hdimage)'
|
|
echo ' isoimage - Create a boot CD-ROM image (arch/x86/boot/image.iso)'
|
|
echo ' bzdisk/fdimage*/hdimage/isoimage also accept:'
|
|
echo ' FDARGS="..." arguments for the booted kernel'
|
|
echo ' FDINITRD=file initrd for the booted kernel'
|
|
|
|
endef
|