lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 19 Apr 2022 17:42:32 -0700 From: joao@...rdrivepizza.com To: linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Cc: joao@...rdrivepizza.com, peterz@...radead.org, jpoimboe@...hat.com, andrew.cooper3@...rix.com, keescook@...omium.org, samitolvanen@...gle.com, mark.rutland@....com, hjl.tools@...il.com, alyssa.milburn@...ux.intel.com, ndesaulniers@...gle.com, gabriel.gomes@...ux.intel.com, rick.p.edgecombe@...el.com Subject: [RFC PATCH 02/11] kbuild: Support FineIBT build From: Joao Moreira <joao@...rdrivepizza.com> Add FineIBT compilation flags to Makefiles, preserving translation units which should not get it. Signed-off-by: Joao Moreira <joao@...rdrivepizza.com> --- arch/x86/Kconfig | 10 ++++++++++ arch/x86/Makefile | 3 +++ arch/x86/entry/vdso/Makefile | 5 +++++ arch/x86/kernel/Makefile | 1 + arch/x86/purgatory/Makefile | 4 ++++ 5 files changed, 23 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index b0142e01002e..37e49e9187a0 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1872,6 +1872,16 @@ config X86_KERNEL_IBT does significantly reduce the number of ENDBR instructions in the kernel image. +config CC_HAS_FINEIBT + def_bool $(cc-option, -fcf-protection=branch -mfine-ibt) && $(as-instr,endbr64) + +config X86_KERNEL_FINEIBT + prompt "Fine-grain Indirect Branch Tracking" + bool + depends on X86_KERNEL_IBT && CC_HAS_FINEIBT + help + Build the kernel with Fine-grained IBT. + config X86_INTEL_MEMORY_PROTECTION_KEYS prompt "Memory Protection Keys" def_bool y diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 63d50f65b828..768e318eb78f 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -73,6 +73,9 @@ ifeq ($(CONFIG_X86_KERNEL_IBT),y) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104816 # KBUILD_CFLAGS += $(call cc-option,-fcf-protection=branch -fno-jump-tables) +ifeq ($(CONFIG_X86_KERNEL_FINEIBT),y) +KBUILD_CFLAGS += $(call cc-option, -mfine-ibt) +endif else KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) endif diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile index 693f8b9031fb..3dce5571460e 100644 --- a/arch/x86/entry/vdso/Makefile +++ b/arch/x86/entry/vdso/Makefile @@ -91,7 +91,11 @@ ifneq ($(RETPOLINE_VDSO_CFLAGS),) endif endif +ifdef CONFIG_X86_KERNEL_FINEIBT +$(vobjs): KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_LTO) $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS) -mfine-ibt,$(KBUILD_CFLAGS)) $(CFL) +else $(vobjs): KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_LTO) $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS),$(KBUILD_CFLAGS)) $(CFL) +endif # # vDSO code runs in userspace and -pg doesn't help with profiling anyway. @@ -151,6 +155,7 @@ KBUILD_CFLAGS_32 := $(filter-out -mfentry,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out $(RETPOLINE_CFLAGS),$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out $(CC_FLAGS_LTO),$(KBUILD_CFLAGS_32)) +KBUILD_CFLAGS_32 := $(filter-out -mfine-ibt,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 += -m32 -msoft-float -mregparm=0 -fpic KBUILD_CFLAGS_32 += -fno-stack-protector KBUILD_CFLAGS_32 += $(call cc-option, -foptimize-sibling-calls) diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index c41ef42adbe8..cb947569e9d8 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -148,6 +148,7 @@ obj-$(CONFIG_UNWINDER_FRAME_POINTER) += unwind_frame.o obj-$(CONFIG_UNWINDER_GUESS) += unwind_guess.o obj-$(CONFIG_AMD_MEM_ENCRYPT) += sev.o +obj-$(CONFIG_X86_KERNEL_FINEIBT) += fineibt.o ### # 64 bit specific files diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile index ae53d54d7959..e16b25a598ba 100644 --- a/arch/x86/purgatory/Makefile +++ b/arch/x86/purgatory/Makefile @@ -55,6 +55,10 @@ ifdef CONFIG_RETPOLINE PURGATORY_CFLAGS_REMOVE += $(RETPOLINE_CFLAGS) endif +ifdef CONFIG_X86_KERNEL_FINEIBT +PURGATORY_CFLAGS_REMOVE += -mfine-ibt +endif + CFLAGS_REMOVE_purgatory.o += $(PURGATORY_CFLAGS_REMOVE) CFLAGS_purgatory.o += $(PURGATORY_CFLAGS) -- 2.35.1
Powered by blists - more mailing lists