![Martin Schwidefsky](/assets/img/avatar_default.png)
Add CONFIG_EXPOLINE to enable the use of the new -mindirect-branch= and -mfunction_return= compiler options to create a kernel fortified against the specte v2 attack. With CONFIG_EXPOLINE=y all indirect branches will be issued with an execute type instruction. For z10 or newer the EXRL instruction will be used, for older machines the EX instruction. The typical indirect call basr %r14,%r1 is replaced with a PC relative call to a new thunk brasl %r14,__s390x_indirect_jump_r1 The thunk contains the EXRL/EX instruction to the indirect branch __s390x_indirect_jump_r1: exrl 0,0f j . 0: br %r1 The detour via the execute type instruction has a performance impact. To get rid of the detour the new kernel parameter "nospectre_v2" and "spectre_v2=[on,off,auto]" can be used. If the parameter is specified the kernel and module code will be patched at runtime. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
162 lines
4.7 KiB
Makefile
162 lines
4.7 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# s390/Makefile
|
|
#
|
|
# This file is included by the global makefile so that you can add your own
|
|
# architecture-specific flags and dependencies. Remember to do have actions
|
|
# for "archclean" and "archdep" for cleaning up and making dependencies for
|
|
# this architecture
|
|
#
|
|
# Copyright (C) 1994 by Linus Torvalds
|
|
#
|
|
|
|
LD_BFD := elf64-s390
|
|
LDFLAGS := -m elf64_s390
|
|
KBUILD_AFLAGS_MODULE += -fPIC
|
|
KBUILD_CFLAGS_MODULE += -fPIC
|
|
KBUILD_CFLAGS += -m64
|
|
KBUILD_AFLAGS += -m64
|
|
UTS_MACHINE := s390x
|
|
STACK_SIZE := 16384
|
|
CHECKFLAGS += -D__s390__ -D__s390x__ -mbig-endian
|
|
|
|
export LD_BFD
|
|
|
|
mflags-$(CONFIG_MARCH_Z900) := -march=z900
|
|
mflags-$(CONFIG_MARCH_Z990) := -march=z990
|
|
mflags-$(CONFIG_MARCH_Z9_109) := -march=z9-109
|
|
mflags-$(CONFIG_MARCH_Z10) := -march=z10
|
|
mflags-$(CONFIG_MARCH_Z196) := -march=z196
|
|
mflags-$(CONFIG_MARCH_ZEC12) := -march=zEC12
|
|
mflags-$(CONFIG_MARCH_Z13) := -march=z13
|
|
mflags-$(CONFIG_MARCH_Z14) := -march=z14
|
|
|
|
export CC_FLAGS_MARCH := $(mflags-y)
|
|
|
|
aflags-y += $(mflags-y)
|
|
cflags-y += $(mflags-y)
|
|
|
|
cflags-$(CONFIG_MARCH_Z900_TUNE) += -mtune=z900
|
|
cflags-$(CONFIG_MARCH_Z990_TUNE) += -mtune=z990
|
|
cflags-$(CONFIG_MARCH_Z9_109_TUNE) += -mtune=z9-109
|
|
cflags-$(CONFIG_MARCH_Z10_TUNE) += -mtune=z10
|
|
cflags-$(CONFIG_MARCH_Z196_TUNE) += -mtune=z196
|
|
cflags-$(CONFIG_MARCH_ZEC12_TUNE) += -mtune=zEC12
|
|
cflags-$(CONFIG_MARCH_Z13_TUNE) += -mtune=z13
|
|
cflags-$(CONFIG_MARCH_Z14_TUNE) += -mtune=z14
|
|
|
|
cflags-y += -Wa,-I$(srctree)/arch/$(ARCH)/include
|
|
|
|
#KBUILD_IMAGE is necessary for make rpm
|
|
KBUILD_IMAGE :=arch/s390/boot/image
|
|
|
|
#
|
|
# Prevent tail-call optimizations, to get clearer backtraces:
|
|
#
|
|
cflags-$(CONFIG_FRAME_POINTER) += -fno-optimize-sibling-calls
|
|
|
|
# old style option for packed stacks
|
|
ifeq ($(call cc-option-yn,-mkernel-backchain),y)
|
|
cflags-$(CONFIG_PACK_STACK) += -mkernel-backchain -D__PACK_STACK
|
|
aflags-$(CONFIG_PACK_STACK) += -D__PACK_STACK
|
|
endif
|
|
|
|
# new style option for packed stacks
|
|
ifeq ($(call cc-option-yn,-mpacked-stack),y)
|
|
cflags-$(CONFIG_PACK_STACK) += -mpacked-stack -D__PACK_STACK
|
|
aflags-$(CONFIG_PACK_STACK) += -D__PACK_STACK
|
|
endif
|
|
|
|
ifeq ($(call cc-option-yn,-mstack-size=8192 -mstack-guard=128),y)
|
|
cflags-$(CONFIG_CHECK_STACK) += -mstack-size=$(STACK_SIZE)
|
|
ifneq ($(call cc-option-yn,-mstack-size=8192),y)
|
|
cflags-$(CONFIG_CHECK_STACK) += -mstack-guard=$(CONFIG_STACK_GUARD)
|
|
endif
|
|
endif
|
|
|
|
ifeq ($(call cc-option-yn,-mwarn-dynamicstack),y)
|
|
cflags-$(CONFIG_WARN_DYNAMIC_STACK) += -mwarn-dynamicstack
|
|
endif
|
|
|
|
ifdef CONFIG_EXPOLINE
|
|
ifeq ($(call cc-option-yn,$(CC_FLAGS_MARCH) -mindirect-branch=thunk),y)
|
|
CC_FLAGS_EXPOLINE := -mindirect-branch=thunk
|
|
CC_FLAGS_EXPOLINE += -mfunction-return=thunk
|
|
CC_FLAGS_EXPOLINE += -mindirect-branch-table
|
|
export CC_FLAGS_EXPOLINE
|
|
cflags-y += $(CC_FLAGS_EXPOLINE)
|
|
endif
|
|
endif
|
|
|
|
ifdef CONFIG_FUNCTION_TRACER
|
|
# make use of hotpatch feature if the compiler supports it
|
|
cc_hotpatch := -mhotpatch=0,3
|
|
ifeq ($(call cc-option-yn,$(cc_hotpatch)),y)
|
|
CC_FLAGS_FTRACE := $(cc_hotpatch)
|
|
KBUILD_AFLAGS += -DCC_USING_HOTPATCH
|
|
KBUILD_CFLAGS += -DCC_USING_HOTPATCH
|
|
endif
|
|
endif
|
|
|
|
# Test CFI features of binutils
|
|
cfi := $(call as-instr,.cfi_startproc\n.cfi_val_offset 15$(comma)-160\n.cfi_endproc,-DCONFIG_AS_CFI_VAL_OFFSET=1)
|
|
|
|
KBUILD_CFLAGS += -mbackchain -msoft-float $(cflags-y)
|
|
KBUILD_CFLAGS += -pipe -fno-strength-reduce -Wno-sign-compare
|
|
KBUILD_CFLAGS += -fno-asynchronous-unwind-tables $(cfi)
|
|
KBUILD_AFLAGS += $(aflags-y) $(cfi)
|
|
|
|
OBJCOPYFLAGS := -O binary
|
|
|
|
head-y := arch/s390/kernel/head.o
|
|
head-y += arch/s390/kernel/head64.o
|
|
|
|
# See arch/s390/Kbuild for content of core part of the kernel
|
|
core-y += arch/s390/
|
|
|
|
libs-y += arch/s390/lib/
|
|
drivers-y += drivers/s390/
|
|
|
|
# must be linked after kernel
|
|
drivers-$(CONFIG_OPROFILE) += arch/s390/oprofile/
|
|
|
|
boot := arch/s390/boot
|
|
syscalls := arch/s390/kernel/syscalls
|
|
tools := arch/s390/tools
|
|
|
|
all: image bzImage
|
|
|
|
install: vmlinux
|
|
$(Q)$(MAKE) $(build)=$(boot) $@
|
|
|
|
image bzImage: vmlinux
|
|
$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
|
|
|
|
zfcpdump:
|
|
$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
|
|
|
|
vdso_install:
|
|
$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
|
|
$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
|
|
|
|
archclean:
|
|
$(Q)$(MAKE) $(clean)=$(boot)
|
|
$(Q)$(MAKE) $(clean)=$(tools)
|
|
|
|
archheaders:
|
|
$(Q)$(MAKE) $(build)=$(syscalls) uapi
|
|
|
|
archprepare:
|
|
$(Q)$(MAKE) $(build)=$(syscalls) kapi
|
|
$(Q)$(MAKE) $(build)=$(tools) kapi
|
|
|
|
# Don't use tabs in echo arguments
|
|
define archhelp
|
|
echo '* image - Kernel image for IPL ($(boot)/image)'
|
|
echo '* bzImage - Compressed kernel image for IPL ($(boot)/bzImage)'
|
|
echo ' install - Install kernel using'
|
|
echo ' (your) ~/bin/$(INSTALLKERNEL) or'
|
|
echo ' (distribution) /sbin/$(INSTALLKERNEL) or'
|
|
echo ' install to $$(INSTALL_PATH)'
|
|
endef
|