Messages in this thread | | | Date | Mon, 21 Feb 2022 14:22:37 +0100 | From | Peter Zijlstra <> | Subject | Re: [PATCH 15/29] x86: Disable IBT around firmware |
| |
On Mon, Feb 21, 2022 at 11:06:15AM +0100, Peter Zijlstra wrote: > > Could you trim replies so that I can actually find what you write? > > On Mon, Feb 21, 2022 at 12:27:20AM -0800, Kees Cook wrote: > > > >+#ifdef CONFIG_X86_IBT > > >+ > > >+u64 ibt_save(void) > > >+{ > > >+ u64 msr = 0; > > >+ > > >+ if (cpu_feature_enabled(X86_FEATURE_IBT)) { > > >+ rdmsrl(MSR_IA32_S_CET, msr); > > >+ wrmsrl(MSR_IA32_S_CET, msr & ~CET_ENDBR_EN); > > >+ } > > >+ > > >+ return msr; > > >+} > > >+ > > >+void ibt_restore(u64 save) > > > > Please make these both __always_inline so there no risk of them ever gaining ENDBRs and being used by ROP to disable IBT... > > Either that or mark them __noendbr. The below seems to work. > > Do we have a preference?
The inline thing runs into header hell..
| |