summaryrefslogtreecommitdiffstats
path: root/Makefile
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2021-04-27 10:16:46 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2021-04-27 10:16:46 -0700
commit57fa2369ab17d67e6232f85b868652fbf4407206 (patch)
treeec828e9ff3059efb1a8cae8940cf62b9161d8d26 /Makefile
parent2fbc66c7838a7fbfb91bf8e119e51e73b4a8a0bc (diff)
parent9186ad8e66bab6a1edc66a939dd56c4638cda948 (diff)
downloadlinux-57fa2369ab17d67e6232f85b868652fbf4407206.tar.gz
linux-57fa2369ab17d67e6232f85b868652fbf4407206.tar.bz2
linux-57fa2369ab17d67e6232f85b868652fbf4407206.zip
Merge tag 'cfi-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull CFI on arm64 support from Kees Cook: "This builds on last cycle's LTO work, and allows the arm64 kernels to be built with Clang's Control Flow Integrity feature. This feature has happily lived in Android kernels for almost 3 years[1], so I'm excited to have it ready for upstream. The wide diffstat is mainly due to the treewide fixing of mismatched list_sort prototypes. Other things in core kernel are to address various CFI corner cases. The largest code portion is the CFI runtime implementation itself (which will be shared by all architectures implementing support for CFI). The arm64 pieces are Acked by arm64 maintainers rather than coming through the arm64 tree since carrying this tree over there was going to be awkward. CFI support for x86 is still under development, but is pretty close. There are a handful of corner cases on x86 that need some improvements to Clang and objtool, but otherwise works well. Summary: - Clean up list_sort prototypes (Sami Tolvanen) - Introduce CONFIG_CFI_CLANG for arm64 (Sami Tolvanen)" * tag 'cfi-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: arm64: allow CONFIG_CFI_CLANG to be selected KVM: arm64: Disable CFI for nVHE arm64: ftrace: use function_nocfi for ftrace_call arm64: add __nocfi to __apply_alternatives arm64: add __nocfi to functions that jump to a physical address arm64: use function_nocfi with __pa_symbol arm64: implement function_nocfi psci: use function_nocfi for cpu_resume lkdtm: use function_nocfi treewide: Change list_sort to use const pointers bpf: disable CFI in dispatcher functions kallsyms: strip ThinLTO hashes from static functions kthread: use WARN_ON_FUNCTION_MISMATCH workqueue: use WARN_ON_FUNCTION_MISMATCH module: ensure __cfi_check alignment mm: add generic function_nocfi macro cfi: add __cficanonical add support for Clang CFI
Diffstat (limited to 'Makefile')
-rw-r--r--Makefile17
1 files changed, 17 insertions, 0 deletions
diff --git a/Makefile b/Makefile
index 70bfa5067c87..f03888cdba4e 100644
--- a/Makefile
+++ b/Makefile
@@ -924,6 +924,23 @@ KBUILD_AFLAGS += -fno-lto
export CC_FLAGS_LTO
endif
+ifdef CONFIG_CFI_CLANG
+CC_FLAGS_CFI := -fsanitize=cfi \
+ -fsanitize-cfi-cross-dso \
+ -fno-sanitize-cfi-canonical-jump-tables \
+ -fno-sanitize-trap=cfi \
+ -fno-sanitize-blacklist
+
+ifdef CONFIG_CFI_PERMISSIVE
+CC_FLAGS_CFI += -fsanitize-recover=cfi
+endif
+
+# If LTO flags are filtered out, we must also filter out CFI.
+CC_FLAGS_LTO += $(CC_FLAGS_CFI)
+KBUILD_CFLAGS += $(CC_FLAGS_CFI)
+export CC_FLAGS_CFI
+endif
+
ifdef CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_32B
KBUILD_CFLAGS += -falign-functions=32
endif