Changeset 100341 in vbox for trunk/Config.kmk

Timestamp:

Jul 2, 2023 10:54:41 PM (20 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

158059

Message:

/Config.kmk: Enable cf-protection for branches in the ring-0 modules (.r0) on linux so we can work with kernels that enables IBT. bugref:10406 ticketref:21435

File:

• trunk/Config.kmk (modified) (4 diffs)

trunk/Config.kmk

@@ -540 +540 @@
 if1of ($(KBUILD_TARGET).$(KBUILD_TARGET_ARCH), darwin.arm64)
  VBOX_WITH_VIRT_ARMV8 = 1
+endif
+if1of ($(KBUILD_TARGET).$(KBUILD_TARGET_ARCH), linux.amd64)
+ ifdef VBOX_WITH_R0_MODULES
+  # Enable IBT branch protection for the R0 modules.
+  # (A make warning will be shown if gcc is too old.)
+  VBOX_WITH_R0_MOD_IBT_BRANCH_PROTECTION = 1
+ endif
 endif
 ## @}
@@ -3433 +3440 @@
  # Clang 13.
         $(QUIET)$(APPEND) '$@' 'VBOX_GCC_Wno-deprecated-copy ?= $(call VBOX_GCC_CHECK_CC,-Wno-deprecated-copy,)'
+ ifdef VBOX_WITH_R0_MOD_IBT_BRANCH_PROTECTION
+        $(QUIET)$(APPEND) '$@' 'VBOX_GCC_fcf-protection_branch ?= $(call VBOX_GCC_CHECK_CXX,-fcf-protection=branch,)'
+        $(QUIET)$(APPEND) '$@' 'VBOX_GCC_fcf-protection_check  ?= $(call VBOX_GCC_CHECK_CXX,-fcf-protection=check)'
+ endif
  ifeq ($(KBUILD_TARGET),solaris)
         $(QUIET)$(APPEND) '$@' 'VBOX_GCC_msave-args            ?= $(call VBOX_GCC_CHECK_CXX,-msave-args,)'
@@ -5415 +5426 @@
  TEMPLATE_VBoxR0_DTRACETOOL         = VBoxTpG-Disabled
 endif
+ifdef VBOX_WITH_R0_MOD_IBT_BRANCH_PROTECTION
+ TEMPLATE_VBoxR0_DEFS              += RT_WITH_IBT_BRANCH_PROTECTION RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
+endif
 
 ifeq ($(VBOX_LDR_FMT),pe)
@@ -5515 +5529 @@
   TEMPLATE_VBoxR0_CFLAGS.linux     += -g1
   TEMPLATE_VBoxR0_CXXFLAGS.linux   += -g1
+ endif
+ ifdef VBOX_WITH_R0_MOD_IBT_BRANCH_PROTECTION
+  TEMPLATE_VBoxR0_CFLAGS          += $(VBOX_GCC_fcf-protection_branch) -fno-jump-tables
+  TEMPLATE_VBoxR0_CXXFLAGS        += $(VBOX_GCC_fcf-protection_branch) -fno-jump-tables
+  TEMPLATE_VBoxR0_LDFLAGS         += $(VBOX_GCC_fcf-protection_branch) $(VBOX_GCC_fcf-protection_check)
+  ifeq ($(VBOX_GCC_fcf-protection_branch),)
+   $(warning VBox: VBOX_WITH_R0_MOD_IBT_BRANCH_PROTECTION is set but gcc doesn't support branch protection)
+  endif
  endif
  ifn1of ($(KBUILD_TARGET), solaris freebsd)