Messages in this thread | | | Date | Tue, 18 Oct 2022 22:09:23 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH] x86/ibt: Implement FineIBT |
| |
On Tue, Oct 18, 2022 at 11:09:13AM -0700, Kees Cook wrote:
> > +#ifdef CONFIG_FINEIBT > > +/* > > + * kCFI FineIBT > > + * > > + * __cfi_\func: __cfi_\func: > > + * movl $0x12345678,%eax endbr64 // 4 > > kCFI emits endbr64 here first too ... > > > + * nop subl $0x12345678,%r10d // 7 > > + * nop jz 1f // 2 > > + * nop ud2 // 2 > > + * nop 1: nop // 1 > > + * nop > > + * nop > > + * nop > > + * nop > > + * nop > > + * nop > > + * nop
It does not; it does emit ENDBR at the start of the regular symbol though:
0000000000001040 <__cfi_yield>: 1040: b8 0c 67 40 a5 mov $0xa540670c,%eax 1045: 90 nop 1046: 90 nop 1047: 90 nop 1048: 90 nop 1049: 90 nop 104a: 90 nop 104b: 90 nop 104c: 90 nop 104d: 90 nop 104e: 90 nop 104f: 90 nop
0000000000001050 <yield>: 1050: f3 0f 1e fa endbr64 1054: e8 00 00 00 00 call 1059 <yield+0x9> 1055: R_X86_64_PLT32 __fentry__-0x4 1059: 65 48 8b 05 00 00 00 00 mov %gs:0x0(%rip),%rax # 1061 <yield+0x11> 105d: R_X86_64_PC32 pcpu_hot-0x4 1061: 31 c9 xor %ecx,%ecx 1063: 87 48 18 xchg %ecx,0x18(%rax) 1066: e9 00 00 00 00 jmp 106b <yield+0x1b> 1067: R_X86_64_PLT32 .text+0xc08c 106b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
Not doing that is an option...
> Tangent: why are these nop instead of 0xcc? These bytes aren't executed > ever are they?
Because that's what the compiler gets us through -fpatchable-function-entry.
| |