| Date | Thu, 24 Feb 2022 16:35:51 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v2 05/39] x86: Base IBT bits |
| |
On Thu, Feb 24, 2022 at 03:51:43PM +0100, Peter Zijlstra wrote: > Add Kconfig, Makefile and basic instruction support for x86 IBT. > > XXX clang is not playing ball, probably lld being 'funny', I'm having > problems with .plt entries appearing all over after linking.
I'll try to look into this; I know you've been chatting with Nathan about it. Is there an open bug for it? (And any kind of reproducer smaller than a 39 patch series we can show the linker folks?) :)
> [...] > +config X86_KERNEL_IBT > + prompt "Indirect Branch Tracking" > + bool > + depends on X86_64 && CC_HAS_IBT > + help > + Build the kernel with support for Indirect Branch Tracking, a > + hardware supported CFI scheme. Any indirect call must land on
hardware support course-grain forward-edge Control Flow Integrity protection. It enforces that all indirect calls must land on
> + an ENDBR instruction, as such, the compiler will litter the > + code with them to make this happen.
"litter the code" -> "instrument the machine code".
> + > config X86_INTEL_MEMORY_PROTECTION_KEYS > prompt "Memory Protection Keys" > def_bool y > --- a/arch/x86/Makefile > +++ b/arch/x86/Makefile > @@ -36,7 +36,7 @@ endif > > # How to compile the 16-bit code. Note we always compile for -march=i386; > # that way we can complain to the user if the CPU is insufficient. > -REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING \ > +REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ > -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \ > -fno-strict-aliasing -fomit-frame-pointer -fno-pic \ > -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
This change seems important separately from this patch, yes? (Or at least a specific call-out in the commit log.)
Otherwise, looks good.
-- Kees Cook
|