linux/scripts/Makefile.build, branch v5.17

x86: Add straight-line-speculation mitigation

2021-12-09T12:32:25Z

Make use of an upcoming GCC feature to mitigate straight-line-speculation for x86: https://gcc.gnu.org/g:53a643f8568067d7700a9f2facc8ba39974973d3 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102952 https://bugs.llvm.org/show_bug.cgi?id=52323 It's built tested on x86_64-allyesconfig using GCC-12 and GCC-11. Maintenance overhead of this should be fairly low due to objtool validation. Size overhead of all these additional int3 instructions comes to: text data bss dec hex filename 22267751 6933356 2011368 31212475 1dc43bb defconfig-build/vmlinux 22804126 6933356 1470696 31208178 1dc32f2 defconfig-build/vmlinux.sls Or roughly 2.4% additional text. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20211204134908.140103474@infradead.org

kbuild: reuse $(cmd_objtool) for cmd_cc_lto_link_modules

2021-09-22T00:26:25Z

For CONFIG_LTO_CLANG=y, the objtool processing is not possible at the compilation, hence postponed by the link time. Reuse $(cmd_objtool) for CONFIG_LTO_CLANG=y by defining objtool-enabled properly. For CONFIG_LTO_CLANG=y: objtool-enabled is off for %.o compilation objtool-enabled is on for %.lto link For CONFIG_LTO_CLANG=n: objtool-enabled is on for %.o compilation (but, it depends on OBJECT_FILE_NON_STANDARD) Set part-of-module := y for %.lto.o to avoid repeating --module. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook Acked-by: Josh Poimboeuf

kbuild: detect objtool update without using .SECONDEXPANSION

2021-09-22T00:26:25Z

Redo commit 8852c5524029 ("kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_ := n'") to add the objtool dependency in a cleaner way. Using .SECONDEXPANSION ends up with unreadable code due to escaped dollars. Also, it is not efficient because the second half of Makefile.build is parsed twice every time. Append the objtool dependency to the *.cmd files at the build time. This is what fixdep and gen_ksymdeps.sh already do. So, following the same pattern seems a natural solution. This allows us to drop $$(objtool_dep) entirely. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook Reviewed-by: Nick Desaulniers Acked-by: Josh Poimboeuf

kbuild: factor out OBJECT_FILES_NON_STANDARD check into a macro

2021-09-22T00:26:25Z

The OBJECT_FILES_NON_STANDARD check is quite long. Factor it out into a new macro, objtool-enabled, to not repeat it. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Reviewed-by: Kees Cook Acked-by: Josh Poimboeuf

kbuild: store the objtool command in *.cmd files

2021-09-22T00:26:25Z

objtool_dep includes include/config/{ORC_UNWINDER,STACK_VALIDATION} so that all the objects are rebuilt when CONFIG_ORC_UNWINDER or CONFIG_STACK_VALIDATION is toggled. BTW, the correct option name is not CONFIG_ORC_UNWINDER, but CONFIG_UNWINDER_ORC. Commit 11af847446ed ("x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*'") missed to adjust this part. So, this dependency has been broken for a long time. As you can see in 'objtool_args', there are more CONFIG options that affect the objtool command line. Adding more and more include/config/* is ugly and unmaintainable. Another issue is that non-standard objects are needlessly rebuilt. Objects specified as OBJECT_FILES_NON_STANDARD is not processed by objtool, but they are rebuilt anyway when CONFIG_STACK_VALIDATION is toggled. This is not a big deal, but better to fix. A cleaner and more precise fix is to include the objtool command in *.cmd files so any command change is naturally detected by if_change. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Reviewed-by: Kees Cook Acked-by: Josh Poimboeuf

kbuild: rename __objtool_obj and reuse it for cmd_cc_lto_link_modules

2021-09-22T00:26:25Z

Rename __objtool_obj to objtool, and move it out of the 'ifndef CONFIG_LTO_CLANG' conditional, so it can be used for cmd_cc_lto_link_modules as well. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Reviewed-by: Kees Cook Acked-by: Josh Poimboeuf

kbuild: move objtool_args back to scripts/Makefile.build

2021-09-22T00:26:25Z

Commit b1a1a1a09b46 ("kbuild: lto: postpone objtool") moved objtool_args to Makefile.lib, so the arguments can be used in Makefile.modfinal as well as Makefile.build. With commit 850ded46c642 ("kbuild: Fix TRIM_UNUSED_KSYMS with LTO_CLANG"), module LTO linking came back to scripts/Makefile.build again. So, there is no more reason to keep objtool_args in a separate file. Get it back to the original place, close to the objtool command. Remove the stale comment too. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook Acked-by: Josh Poimboeuf

kbuild: remove stale *.symversions

2021-09-02T23:17:20Z

cmd_update_lto_symversions merges all the existing *.symversions, but some of them might be stale. If the last EXPORT_SYMBOL is removed from a C file, the *.symversions file is not deleted or updated. It contains stale CRCs, but still they will be used for linking the vmlinux or modules. It is not a big deal when the EXPORT_SYMBOL is really removed. However, when the EXPORT_SYMBOL is moved to another file, the same __crc_ will appear twice in the merged *.symversions, possibly with different CRCs if the function argument is changed at the same time. It would confuse module versioning. If no EXPORT_SYMBOL is found, let's remove *.symversions explicitly. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook

kbuild: remove unused quiet_cmd_update_lto_symversions

2021-09-02T23:17:20Z

This is not used anywhere because the short log is displayed when it is used through a $(call cmd,...) invocation. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook

kbuild: Fix TRIM_UNUSED_KSYMS with LTO_CLANG

2021-09-02T23:12:39Z

With CONFIG_LTO_CLANG, we currently link modules into native code just before modpost, which means with TRIM_UNUSED_KSYMS enabled, we still look at the LLVM bitcode in the .o files when generating the list of used symbols. As the bitcode doesn't yet have calls to compiler intrinsics and llvm-nm doesn't see function references that only exist in function-level inline assembly, we currently need a whitelist for TRIM_UNUSED_KSYMS to work with LTO. This change moves module LTO linking to happen earlier, and thus avoids the issue with LLVM bitcode and TRIM_UNUSED_KSYMS entirely, allowing us to also drop the whitelist from gen_autoksyms.sh. Link: https://github.com/ClangBuiltLinux/linux/issues/1369 Signed-off-by: Sami Tolvanen Reviewed-by: Alexander Lobakin Tested-by: Alexander Lobakin Signed-off-by: Masahiro Yamada