From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Nikolay Borisov <nborisov@suse.com>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Borislav Petkov <bp@suse.de>,
Seth Forshee <seth.forshee@canonical.com>,
Masahiro Yamada <yamada.masahiro@socionext.com>
Subject: [PATCH 4.4 34/38] x86/build: Disable CET instrumentation in the kernel
Date: Mon, 8 Feb 2021 16:00:56 +0100 [thread overview]
Message-ID: <20210208145806.593263839@linuxfoundation.org> (raw)
In-Reply-To: <20210208145805.279815326@linuxfoundation.org>
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit 20bf2b378729c4a0366a53e2018a0b70ace94bcd upstream.
With retpolines disabled, some configurations of GCC, and specifically
the GCC versions 9 and 10 in Ubuntu will add Intel CET instrumentation
to the kernel by default. That breaks certain tracing scenarios by
adding a superfluous ENDBR64 instruction before the fentry call, for
functions which can be called indirectly.
CET instrumentation isn't currently necessary in the kernel, as CET is
only supported in user space. Disable it unconditionally and move it
into the x86's Makefile as CET/CFI... enablement should be a per-arch
decision anyway.
[ bp: Massage and extend commit message. ]
Fixes: 29be86d7f9cb ("kbuild: add -fcf-protection=none when using retpoline flags")
Reported-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Tested-by: Nikolay Borisov <nborisov@suse.com>
Cc: <stable@vger.kernel.org>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Link: https://lkml.kernel.org/r/20210128215219.6kct3h2eiustncws@treble
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Makefile | 6 ------
arch/x86/Makefile | 3 +++
2 files changed, 3 insertions(+), 6 deletions(-)
--- a/Makefile
+++ b/Makefile
@@ -830,12 +830,6 @@ KBUILD_CFLAGS += $(call cc-option,-Wer
# Prohibit date/time macros, which would make the build non-deterministic
KBUILD_CFLAGS += $(call cc-option,-Werror=date-time)
-# ensure -fcf-protection is disabled when using retpoline as it is
-# incompatible with -mindirect-branch=thunk-extern
-ifdef CONFIG_RETPOLINE
-KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
-endif
-
# use the deterministic mode of AR if available
KBUILD_ARFLAGS := $(call ar-option,D)
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -137,6 +137,9 @@ else
KBUILD_CFLAGS += -mno-red-zone
KBUILD_CFLAGS += -mcmodel=kernel
+ # Intel CET isn't enabled in the kernel
+ KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+
# -funit-at-a-time shrinks the kernel .text considerably
# unfortunately it makes reading oopses harder.
KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)
next prev parent reply other threads:[~2021-02-08 15:24 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-08 15:00 [PATCH 4.4 00/38] 4.4.257-rc1 review Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 01/38] net_sched: reject silly cell_log in qdisc_get_rtab() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 02/38] futex,rt_mutex: Provide futex specific rt_mutex API Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 03/38] futex: Remove rt_mutex_deadlock_account_*() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 04/38] futex: Rework inconsistent rt_mutex/futex_q state Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 05/38] futex: Avoid violating the 10th rule of futex Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 06/38] futex: Replace pointless printk in fixup_owner() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 07/38] futex: Provide and use pi_state_update_owner() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 08/38] rtmutex: Remove unused argument from rt_mutex_proxy_unlock() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 09/38] futex: Use pi_state_update_owner() in put_pi_state() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 10/38] futex: Simplify fixup_pi_state_owner() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 11/38] futex: Handle faults correctly for PI futexes Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 12/38] usb: udc: core: Use lock when write to soft_connect Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 13/38] scsi: libfc: Avoid invoking response handler twice if ep is already completed Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 14/38] scsi: ibmvfc: Set default timeout to avoid crash during migration Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 15/38] stable: clamp SUBLEVEL in 4.4 and 4.9 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 16/38] USB: serial: cp210x: add pid/vid for WSDA-200-USB Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 17/38] USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 18/38] USB: serial: option: Adding support for Cinterion MV31 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 19/38] Input: i8042 - unbreak Pegatron C15B Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 20/38] net: lapb: Copy the skb before sending a packet Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 21/38] ELF/MIPS build fix Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 22/38] elfcore: fix building with clang Greg Kroah-Hartman
2021-02-09 12:52 ` Pavel Machek
2021-02-09 13:01 ` Greg Kroah-Hartman
2021-02-09 19:10 ` Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 23/38] USB: gadget: legacy: fix an error code in eth_bind() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 24/38] USB: usblp: dont call usb_set_interface if theres a single alt Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 25/38] usb: dwc2: Fix endpoint direction check in ep_from_windex Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 26/38] mac80211: fix station rate table updates on assoc Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 27/38] kretprobe: Avoid re-registration of the same kretprobe earlier Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 28/38] cifs: report error instead of invalid when revalidating a dentry fails Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 29/38] mmc: core: Limit retries when analyse of SDIO tuples fails Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 30/38] ARM: footbridge: fix dc21285 PCI configuration accessors Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 31/38] mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 32/38] mm: hugetlb: fix a race between isolating and freeing page Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 33/38] mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active Greg Kroah-Hartman
2021-02-08 15:00 ` Greg Kroah-Hartman [this message]
2021-02-08 15:00 ` [PATCH 4.4 35/38] x86/apic: Add extra serialization for non-serializing MSRs Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 36/38] Input: xpad - sync supported devices with fork on GitHub Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 4.4 37/38] ACPI: thermal: Do not call acpi_thermal_check() directly Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 4.4 38/38] ALSA: hda/realtek - Fix typo of pincfg for Dell quirk Greg Kroah-Hartman
2021-02-08 18:36 ` [PATCH 4.4 00/38] 4.4.257-rc1 review Pavel Machek
2021-02-08 20:43 ` Shuah Khan
2021-02-09 18:09 ` Guenter Roeck
2021-02-10 5:04 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210208145806.593263839@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bp@suse.de \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nborisov@suse.com \
--cc=seth.forshee@canonical.com \
--cc=stable@vger.kernel.org \
--cc=yamada.masahiro@socionext.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).