Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4cd24de3 authored by Zhenzhong Duan's avatar Zhenzhong Duan Committed by Thomas Gleixner
Browse files

x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support 



Since retpoline capable compilers are widely available, make
CONFIG_RETPOLINE hard depend on the compiler capability.

Break the build when CONFIG_RETPOLINE is enabled and the compiler does not
support it. Emit an error message in that case:

 "arch/x86/Makefile:226: *** You are building kernel with non-retpoline
  compiler, please update your compiler..  Stop."

[dwmw: Fail the build with non-retpoline compiler]

Suggested-by: default avatarPeter Zijlstra <peterz@infradead.org>
Signed-off-by: default avatarZhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Borislav Petkov <bp@suse.de>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Michal Marek <michal.lkml@markovi.net>
Cc: <srinivas.eeda@oracle.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/cca0cb20-f9e2-4094-840b-fb0f8810cd34@default
parent 2e6e902d

arch/x86/Kconfig

+0 −4
Original line number Diff line number Diff line
@@ -444,10 +444,6 @@ config RETPOLINE 
	  branches. Requires a compiler with -mindirect-branch=thunk-extern

	  support for full protection. The kernel may run slower.



	  Without compiler support, at least indirect branches in assembler

	  code are eliminated. Since this includes the syscall entry path,

	  it is not entirely pointless.



config INTEL_RDT

	bool "Intel Resource Director Technology support"

	depends on X86 && CPU_SUP_INTEL

arch/x86/Makefile

+3 −2
Original line number Diff line number Diff line
@@ -220,9 +220,10 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables 


# Avoid indirect branches in kernel to deal with Spectre

ifdef CONFIG_RETPOLINE

ifneq ($(RETPOLINE_CFLAGS),)

  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE

ifeq ($(RETPOLINE_CFLAGS),)

  $(error You are building kernel with non-retpoline compiler, please update your compiler.)

endif

  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)

endif



archscripts: scripts_basic

arch/x86/include/asm/nospec-branch.h

+6 −4
Original line number Diff line number Diff line
@@ -162,11 +162,12 @@ 
	_ASM_PTR " 999b\n\t"					\

	".popsection\n\t"



#if defined(CONFIG_X86_64) && defined(RETPOLINE)

#ifdef CONFIG_RETPOLINE

#ifdef CONFIG_X86_64



/*

 * Since the inline asm uses the %V modifier which is only in newer GCC,

 * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE.

 * Inline asm uses the %V modifier which is only in newer GCC

 * which is ensured when CONFIG_RETPOLINE is defined.

 */

# define CALL_NOSPEC						\

	ANNOTATE_NOSPEC_ALTERNATIVE				\
@@ -181,7 +182,7 @@ 
	X86_FEATURE_RETPOLINE_AMD)

# define THUNK_TARGET(addr) [thunk_target] "r" (addr)



#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE)

#else /* CONFIG_X86_32 */

/*

 * For i386 we use the original ret-equivalent retpoline, because

 * otherwise we'll run out of registers. We don't care about CET
@@ -211,6 +212,7 @@ 
	X86_FEATURE_RETPOLINE_AMD)



# define THUNK_TARGET(addr) [thunk_target] "rm" (addr)

#endif

#else /* No retpoline for C / inline asm */

# define CALL_NOSPEC "call *%[thunk_target]\n"

# define THUNK_TARGET(addr) [thunk_target] "rm" (addr)

arch/x86/kernel/cpu/bugs.c

+1 −1
Original line number Diff line number Diff line
@@ -252,7 +252,7 @@ static void __init spec2_print_if_secure(const char *reason) 


static inline bool retp_compiler(void)

{

	return __is_defined(RETPOLINE);

	return __is_defined(CONFIG_RETPOLINE);

}



static inline bool match_option(const char *arg, int arglen, const char *opt)

scripts/Makefile.build

+0 −2
Original line number Diff line number Diff line
@@ -236,10 +236,8 @@ ifdef CONFIG_GCOV_KERNEL 
objtool_args += --no-unreachable

endif

ifdef CONFIG_RETPOLINE

ifneq ($(RETPOLINE_CFLAGS),)

  objtool_args += --retpoline

endif

endif





ifdef CONFIG_MODVERSIONS