Continue implementation work on Orchid nanokernel.

.git-blame-ignore-revs

@@ -4,3 +4,5 @@
 2a2e1a95e522e820ba6ef9a0b7af73ddb5ead5b0
 0a178daa6c8c335799c0b05db3f212594435216e
 3f523a79e10e023308d28c4b030c6081b6dbbaa3
+
+# XXX: https://git-scm.com/docs/git-replace

env/cpu-arm64.mk

@@ -0,0 +1,13 @@
+# Cycc/Cympile - Shared Build Scripts for Make
+# Copyright (C) 2013-2020  Jay Freeman (saurik)
+
+# Zero Clause BSD license {{{
+#
+# Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+# }}}
+
+
+# XXX: consider using =pac-ret+leaf
+qflags += -mbranch-protection=standard

env/cpu-x86_64.mk

@@ -0,0 +1,15 @@
+# Cycc/Cympile - Shared Build Scripts for Make
+# Copyright (C) 2013-2020  Jay Freeman (saurik)
+
+# Zero Clause BSD license {{{
+#
+# Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+# }}}
+
+
+ifneq ($(target),win)
+# XXX: this breaks libgcrypt due to cet.h being ELF-specific
+qflags += -fcf-protection=full
+endif

env/kit-android.mk

@@ -67,6 +67,8 @@ cxx := $(llvm)/bin/clang++ $(more)
 define _
 ar/$(1) := $(llvm)/bin/llvm-ar
 ranlib/$(1) := $(llvm)/bin/llvm-ranlib
+objdump/$(1) := $(llvm)/bin/llvm-objdump
+objcopy/$(1) := $(llvm)/bin/llvm-objcopy
 endef
 $(each)
 

env/kit-default.mk

@@ -15,6 +15,8 @@ cxx := clang++$(suffix) $(more)
 define _
 ar/$(1) := ar
 ranlib/$(1) := ranlib
+objdump/$(1) := llvm-objdump$(suffix)
+objcopy/$(1) := llvm-objcopy$(suffix)
 endef
 $(each)
 

env/output.mk

@@ -194,3 +194,10 @@ object := $(filter-out $(1)%.o,$(object))
 linked += $(1)_.a
 endef
 $(foreach archive,$(archive),$(eval $(call _,$(archive))))
+
+define _
+object := $$(patsubst $(1).o,$(1)-.o,$$(object))
+$$(output)/%/$(1)-.o: $$(output)/%/$(1).o
+	$$(objcopy) $(2) $$< $$@
+endef
+$(foreach oflags,$(filter oflags/%,$(.VARIABLES)),$(eval $(call _,$(patsubst oflags/%,%,$(oflags)),$($(oflags)))))

env/setup-apt.sh

@@ -9,7 +9,8 @@ apt-get -y install \
     curl git-core rsync wget \
     fakeroot libtalloc-dev \
     cpio rpm unzip zstd \
-    clang clang-tidy lld \
+    clang clang-tidy lld llvm \
+    binutils-{aarch64,x86-64}-linux-gnu \
     libc++-dev libc++abi-dev \
     g++-multilib gcc-multilib \
     python3-pip python3-setuptools \

env/setup-sys.sh

@@ -5,7 +5,7 @@ shift 1
 export DEBIAN_FRONTEND=noninteractive
 apt-get -y update
 apt-get -y dist-upgrade
-apt-get -y install --no-install-recommends libstdc++-"${llvm}"-dev{,-arm{hf,64}-cross} "$@"
+apt-get -y install --no-install-recommends libstdc++-"${llvm}"-dev{,-{arm{hf,64},i386}-cross} "$@"
 for root in /usr/*-gnu*; do
     ln -s .. "${root}"/usr
 done

env/sys-ubuntu.sh

@@ -24,11 +24,12 @@ if [[ $(uname -s) = Linux ]]; then
 
     debootstrap=${mount}/debootstrap
     # XXX: proot -0 runs the command but fails on exit; fakeroot works correctly
-    DEBOOTSTRAP_DIR=${debootstrap} fakeroot "${debootstrap}"/debootstrap \
-        --foreign --variant=minbase --arch amd64 "${distro}" .
+    DEBOOTSTRAP_DIR=${debootstrap} fakeroot "${debootstrap}"/debootstrap --foreign \
+        --variant=minbase --arch amd64 --components=main,universe "${distro}" .
 
     "${proot}" -0 -r . -w / -b /proc -b /sys /debootstrap/debootstrap --second-stage
-    echo "deb http://archive.ubuntu.com/ubuntu/ ${distro}-updates main" >>etc/apt/sources.list
+    # XXX: https://groups.google.com/g/linux.debian.bugs.dist/c/-p06sQmwamA
+    echo "deb http://archive.ubuntu.com/ubuntu/ ${distro}-updates main universe" >>etc/apt/sources.list
     HOME= "${proot}" -S . -w / -b "${mount}:/mnt" /mnt/setup-sys.sh "$@"
 else
     # https://stackoverflow.com/questions/29934204/mount-data-volume-to-docker-with-readwrite-permission

env/target-and.mk

@@ -67,6 +67,7 @@ else
 
 more = --sysroot=$(llvm)/sysroot
 # https://github.com/android-ndk/ndk/issues/884
+# XXX: wait, but don't I want this? look again!
 more += -fno-addrsig
 include $(pwd)/kit-android.mk
 

env/target-any.mk

@@ -15,10 +15,7 @@ path = $(1)
 .PHONY:
 all:
 
-uname-m := $(shell uname -m)
-uname-s := $(shell uname -s)
-uname-o := $(shell uname -o 2>/dev/null)
--include $(pwd)/uname-$(uname-s).mk
+include $(pwd)/uname.mk
 
 version := $(shell $(pwd)/version.sh)
 monotonic := $(word 1,$(version))
@@ -48,9 +45,14 @@ archive :=
 
 qflags += -gfull -Os
 cflags += -DNDEBUG
-cflags += -D_FORTIFY_SOURCE=2
 qflags += -fno-omit-frame-pointer
 
+cflags += -D_FORTIFY_SOURCE=2
+# XXX: -fstack-protector-{strong,all}
+# XXX: -param=ssp-buffer-size=4
+# XXX: -fsanitize={shado,safe}-stack
+# XXX: -fstack-clash-protection
+
 cflags += -D__STDC_CONSTANT_MACROS
 cflags += -D__STDC_FORMAT_MACROS
 
@@ -69,6 +71,7 @@ cflags += -Wno-misleading-indentation
 cflags += -Wno-missing-selector-name
 cflags += -Wno-overloaded-shift-op-parentheses
 cflags += -Wno-potentially-evaluated-expression
+# XXX: cflags += -Wno-shift-op-parentheses
 cflags += -Wno-tautological-constant-out-of-range-compare
 cflags += -Wno-tautological-overlap-compare
 
@@ -103,6 +106,8 @@ ifeq ($(machine),)
 machine := $(default)
 endif
 
+-include $(pwd)/cpu-$(machine).mk
+
 cflags += -I@/usr/include
 
 define depend

env/target-apl.mk

@@ -23,6 +23,7 @@ lflags += -Wl,-no_dead_strip_inits_and_terms
 # libtool
 qflags += -DPIC
 qflags += -fPIC
+lflags += -fPIC
 
 signature := /_CodeSignature/CodeResources
 

env/target-elf.mk

@@ -10,8 +10,30 @@
 
 
 include $(pwd)/target-lld.mk
-#lflags += -Wl,-error-limit=0
+
 lflags += -Wl,--build-id=none
-lflags += -Wl,-z,relro
+lflags += -Wl,-z,noexecstack
+
 lflags += -Wl,--no-undefined
+lflags += -Wl,-z,defs
+lflags += -Wl,--no-copy-dt-needed-entries
+
+ifeq ($(target),and)
+# XXX: this is wrong in the general case
+# I need a separate build for this... :(
 qflags += -fpic
+lflags += -fpic
+else
+qflags += -fpie
+lflags += -fpie
+endif
+
+qflags += -fno-plt
+lflags += -fno-plt
+
+lflags += -Wl,-z,relro
+lflags += -Wl,-z,now
+
+# https://maskray.me/blog/2021-01-09-copy-relocations-canonical-plt-entries-and-protected
+qflags += -fno-semantic-interposition
+qflags += -fdirect-access-external-data

env/target-lld.mk

@@ -13,5 +13,6 @@ include $(pwd)/target-gnu.mk
 
 wflags += -fuse-ld=lld
 lflags += -Wl,--icf=all
+lflags += -Wl,--error-limit=0
 
 export LLD_VERSION := Linker: LLD

env/target-lnx.mk

@@ -24,6 +24,7 @@ archs += i386
 openssl/i386 := linux-x86
 host/i386 := i386-linux-$(libc)
 triple/i386 := i686-unknown-linux-$(libc)
+format/i386 := elf32-i386
 meson/i386 := x86
 bits/i386 := 32
 centos/i386 := i686
@@ -32,6 +33,7 @@ archs += x86_64
 openssl/x86_64 := linux-x86_64
 host/x86_64 := x86_64-linux-$(libc)
 triple/x86_64 := x86_64-unknown-linux-$(libc)
+format/x86_64 := elf64-x86-64
 meson/x86_64 := x86_64
 bits/x86_64 := 64
 centos/x86_64 := x86_64
@@ -40,20 +42,23 @@ archs += arm64
 openssl/arm64 := linux-aarch64
 host/arm64 := aarch64-linux-$(libc)
 triple/arm64 := aarch64-unknown-linux-$(libc)
+format/arm64 := elf64-littleaarch64
 meson/arm64 := aarch64
 bits/arm64 := 64
 
 archs += armhf
 openssl/armhf := linux-armv4
 host/armhf := arm-linux-$(libc)eabihf
 triple/armhf := arm-unknown-linux-$(libc)eabihf
+format/armhf := elf32-littlearm
 meson/armhf := arm
 bits/armhf := 32
 
 archs += mips
 openssl/mips := linux-mips32
 host/mips := mips-linux-$(libc)
 triple/mips := mips-unknown-linux-$(libc)
+format/mips := elf32-tradlittlemips
 meson/mips := mips
 bits/mips := 32
 

env/uname-Darwin.mk

@@ -16,3 +16,6 @@ endif
 prebuilt := darwin-x86_64
 
 export PATH := /usr/local/opt/gettext/bin:$(PATH)
+
+export PATH := $(PATH):/usr/local/opt/binutils/bin
+objcopy = objcopy

env/uname.mk

@@ -0,0 +1,18 @@
+# Cycc/Cympile - Shared Build Scripts for Make
+# Copyright (C) 2013-2020  Jay Freeman (saurik)
+
+# Zero Clause BSD license {{{
+#
+# Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+# }}}
+
+
+uname-m := $(shell uname -m)
+uname-s := $(shell uname -s)
+uname-o := $(shell uname -o 2>/dev/null)
+
+objcopy = $(host/$*)-objcopy
+
+-include $(pwd)/uname-$(uname-s).mk

srv-daemon/makefile

@@ -64,14 +64,9 @@ endif
 kernel/$(output)/$(machine)/kernel: force
 	$(MAKE) -C kernel target=lnx machine=$(machine)
 
-$(output)/embed: env/embed.c
-	clang -o $@ $<
-
-$(output)/$(machine)/extra/kernel.xxd: kernel/$(output)/$(machine)/kernel $(output)/embed
-	@mkdir -p $(dir $@)
-	$(output)/embed kernel $< >$@
-
-$(call depend,$(pwd)/source/kernel.cpp.o,$(output)/$(machine)/extra/kernel.xxd)
+$(output)/%/kernel.o: kernel/$(output)/%/kernel
+	cd $(dir $<) && $(objcopy/$*) -O $(format/$*) -I binary $(notdir $<) $(CURDIR)/$@ --set-section-alignment '.data=4096' --set-section-flags '.data=alloc,load,readonly,data'
+linked += kernel.o
 
 include env/output.mk