6ae55c7fa6
[ Upstream commitcba786af84] On x86, the ordinary, position dependent small and kernel code models only support placement of the executable in 32-bit addressable memory, due to the use of 32-bit signed immediates to generate references to global variables. For the kernel, this implies that all global variables must reside in the top 2 GiB of the kernel virtual address space, where the implicit address bits 63:32 are equal to sign bit 31. This means the kernel code model is not suitable for other bare metal executables such as the kexec purgatory, which can be placed arbitrarily in the physical address space, where its address may no longer be representable as a sign extended 32-bit quantity. For this reason, commite16c2983fb("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors") switched to the large code model, which uses 64-bit immediates for all symbol references, including function calls, in order to avoid relying on any assumptions regarding proximity of symbols in the final executable. The large code model is rarely used, clunky and the least likely to operate in a similar fashion when comparing GCC and Clang, so it is best avoided. This is especially true now that Clang 18 has started to emit executable code in two separate sections (.text and .ltext), which triggers an issue in the kexec loading code at runtime. The SUSE bugzilla fixes tag points to gcc 13 having issues with the large model too and that perhaps the large model should simply not be used at all. Instead, use the position independent small code model, which makes no assumptions about placement but only about proximity, where all referenced symbols must be within -/+ 2 GiB, i.e., in range for a RIP-relative reference. Use hidden visibility to suppress the use of a GOT, which carries absolute addresses that are not covered by static ELF relocations, and is therefore incompatible with the kexec loader's relocation logic. [ bp: Massage commit message. ] Fixes:e16c2983fb("x86/purgatory: Change compiler flags from -mcmodel=kernel to -mcmodel=large to fix kexec relocation errors") Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1211853 Closes: https://github.com/ClangBuiltLinux/linux/issues/2016 Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Fangrui Song <maskray@google.com> Acked-by: Nick Desaulniers <ndesaulniers@google.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/all/20240417-x86-fix-kexec-with-llvm-18-v1-0-5383121e8fb7@kernel.org/ Signed-off-by: Sasha Levin <sashal@kernel.org>
93 lines
3.0 KiB
Makefile
93 lines
3.0 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
OBJECT_FILES_NON_STANDARD := y
|
|
|
|
purgatory-y := purgatory.o stack.o setup-x86_$(BITS).o sha256.o entry64.o string.o
|
|
|
|
targets += $(purgatory-y)
|
|
PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
|
|
|
|
$(obj)/string.o: $(srctree)/arch/x86/boot/compressed/string.c FORCE
|
|
$(call if_changed_rule,cc_o_c)
|
|
|
|
$(obj)/sha256.o: $(srctree)/lib/crypto/sha256.c FORCE
|
|
$(call if_changed_rule,cc_o_c)
|
|
|
|
CFLAGS_sha256.o := -D__DISABLE_EXPORTS -D__NO_FORTIFY
|
|
|
|
# When profile-guided optimization is enabled, llvm emits two different
|
|
# overlapping text sections, which is not supported by kexec. Remove profile
|
|
# optimization flags.
|
|
KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS))
|
|
|
|
# When LTO is enabled, llvm emits many text sections, which is not supported
|
|
# by kexec. Remove -flto=* flags.
|
|
KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_LTO),$(KBUILD_CFLAGS))
|
|
|
|
# When linking purgatory.ro with -r unresolved symbols are not checked,
|
|
# also link a purgatory.chk binary without -r to check for unresolved symbols.
|
|
PURGATORY_LDFLAGS := -e purgatory_start -z nodefaultlib
|
|
LDFLAGS_purgatory.ro := -r $(PURGATORY_LDFLAGS)
|
|
LDFLAGS_purgatory.chk := $(PURGATORY_LDFLAGS)
|
|
targets += purgatory.ro purgatory.chk
|
|
|
|
# Sanitizer, etc. runtimes are unavailable and cannot be linked here.
|
|
GCOV_PROFILE := n
|
|
KASAN_SANITIZE := n
|
|
UBSAN_SANITIZE := n
|
|
KCSAN_SANITIZE := n
|
|
KMSAN_SANITIZE := n
|
|
KCOV_INSTRUMENT := n
|
|
|
|
# These are adjustments to the compiler flags used for objects that
|
|
# make up the standalone purgatory.ro
|
|
|
|
PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
|
|
PURGATORY_CFLAGS := -mcmodel=small -ffreestanding -fno-zero-initialized-in-bss -g0
|
|
PURGATORY_CFLAGS += -fpic -fvisibility=hidden
|
|
PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING
|
|
PURGATORY_CFLAGS += -fno-stack-protector
|
|
|
|
# Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
|
|
# in turn leaves some undefined symbols like __fentry__ in purgatory and not
|
|
# sure how to relocate those.
|
|
ifdef CONFIG_FUNCTION_TRACER
|
|
PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_FTRACE)
|
|
endif
|
|
|
|
ifdef CONFIG_STACKPROTECTOR
|
|
PURGATORY_CFLAGS_REMOVE += -fstack-protector
|
|
endif
|
|
|
|
ifdef CONFIG_STACKPROTECTOR_STRONG
|
|
PURGATORY_CFLAGS_REMOVE += -fstack-protector-strong
|
|
endif
|
|
|
|
ifdef CONFIG_RETPOLINE
|
|
PURGATORY_CFLAGS_REMOVE += $(RETPOLINE_CFLAGS)
|
|
endif
|
|
|
|
ifdef CONFIG_CFI_CLANG
|
|
PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_CFI)
|
|
endif
|
|
|
|
CFLAGS_REMOVE_purgatory.o += $(PURGATORY_CFLAGS_REMOVE)
|
|
CFLAGS_purgatory.o += $(PURGATORY_CFLAGS)
|
|
|
|
CFLAGS_REMOVE_sha256.o += $(PURGATORY_CFLAGS_REMOVE)
|
|
CFLAGS_sha256.o += $(PURGATORY_CFLAGS)
|
|
|
|
CFLAGS_REMOVE_string.o += $(PURGATORY_CFLAGS_REMOVE)
|
|
CFLAGS_string.o += $(PURGATORY_CFLAGS)
|
|
|
|
asflags-remove-y += $(foreach x, -g -gdwarf-4 -gdwarf-5, $(x) -Wa,$(x))
|
|
|
|
$(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
|
|
$(call if_changed,ld)
|
|
|
|
$(obj)/purgatory.chk: $(obj)/purgatory.ro FORCE
|
|
$(call if_changed,ld)
|
|
|
|
$(obj)/kexec-purgatory.o: $(obj)/purgatory.ro $(obj)/purgatory.chk
|
|
|
|
obj-y += kexec-purgatory.o
|