Messages in this thread | | | Date | Thu, 24 Feb 2022 17:46:59 -0700 | From | Nathan Chancellor <> | Subject | Re: [PATCH v2 05/39] x86: Base IBT bits |
| |
On Thu, Feb 24, 2022 at 04:35:51PM -0800, Kees Cook wrote: > On Thu, Feb 24, 2022 at 03:51:43PM +0100, Peter Zijlstra wrote: > > Add Kconfig, Makefile and basic instruction support for x86 IBT. > > > > XXX clang is not playing ball, probably lld being 'funny', I'm having > > problems with .plt entries appearing all over after linking. > > I'll try to look into this; I know you've been chatting with Nathan > about it. Is there an open bug for it? (And any kind of reproducer > smaller than a 39 patch series we can show the linker folks?) :)
I should be able to create a reproducer with cvise and file a bug on GitHub around this tomorrow, I should have done it after Peter's comments on IRC.
Cheers, Nathan
> > [...] > > +config X86_KERNEL_IBT > > + prompt "Indirect Branch Tracking" > > + bool > > + depends on X86_64 && CC_HAS_IBT > > + help > > + Build the kernel with support for Indirect Branch Tracking, a > > + hardware supported CFI scheme. Any indirect call must land on > > hardware support course-grain forward-edge Control Flow Integrity > protection. It enforces that all indirect calls must land on > > > + an ENDBR instruction, as such, the compiler will litter the > > + code with them to make this happen. > > "litter the code" -> "instrument the machine code". > > > > + > > config X86_INTEL_MEMORY_PROTECTION_KEYS > > prompt "Memory Protection Keys" > > def_bool y > > --- a/arch/x86/Makefile > > +++ b/arch/x86/Makefile > > @@ -36,7 +36,7 @@ endif > > > > # How to compile the 16-bit code. Note we always compile for -march=i386; > > # that way we can complain to the user if the CPU is insufficient. > > -REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING \ > > +REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ > > -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \ > > -fno-strict-aliasing -fomit-frame-pointer -fno-pic \ > > -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none) > > This change seems important separately from this patch, yes? (Or at > least a specific call-out in the commit log.) > > Otherwise, looks good. > > -- > Kees Cook
| |