| From | "Edgecombe, Rick P" <> | Subject | Re: [PATCH 05/29] x86: Base IBT bits | Date | Sat, 19 Feb 2022 01:07:59 +0000 |
| |
On Fri, 2022-02-18 at 17:49 +0100, Peter Zijlstra wrote: > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -1861,6 +1861,21 @@ config X86_UMIP > specific cases in protected and virtual-8086 modes. > Emulated > results are dummy. > > +config CC_HAS_IBT > + # GCC >= 9 and binutils >= 2.29 > + # Retpoline check to work around > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93654 > + def_bool $(cc-option, -fcf-protection=branch -mindirect- > branch-register) && $(as-instr,endbr64) > + > +config X86_IBT > + prompt "Indirect Branch Tracking" > + bool > + depends on X86_64 && CC_HAS_IBT > + help > + Build the kernel with support for Indirect Branch Tracking, > a > + hardware supported CFI scheme. Any indirect call must land > on > + an ENDBR instruction, as such, the compiler will litter the > + code with them to make this happen. > + >
Could you call this something more specific then just X86_IBT? Like X86_KERNEL_IBT or something? It could get confusing if we add userspace IBT, or if someone wants IBT for KVM guests without CFI in the kernel.
|