lkml.org 
[lkml]   [2022]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 15/29] x86: Disable IBT around firmware
    On Mon, Feb 21, 2022 at 11:06:15AM +0100, Peter Zijlstra wrote:
    >
    > Could you trim replies so that I can actually find what you write?
    >
    > On Mon, Feb 21, 2022 at 12:27:20AM -0800, Kees Cook wrote:
    >
    > > >+#ifdef CONFIG_X86_IBT
    > > >+
    > > >+u64 ibt_save(void)
    > > >+{
    > > >+ u64 msr = 0;
    > > >+
    > > >+ if (cpu_feature_enabled(X86_FEATURE_IBT)) {
    > > >+ rdmsrl(MSR_IA32_S_CET, msr);
    > > >+ wrmsrl(MSR_IA32_S_CET, msr & ~CET_ENDBR_EN);
    > > >+ }
    > > >+
    > > >+ return msr;
    > > >+}
    > > >+
    > > >+void ibt_restore(u64 save)
    > >
    > > Please make these both __always_inline so there no risk of them ever gaining ENDBRs and being used by ROP to disable IBT...
    >
    > Either that or mark them __noendbr. The below seems to work.
    >
    > Do we have a preference?

    The inline thing runs into header hell..

    \
     
     \ /
      Last update: 2022-02-21 19:21    [W:5.359 / U:0.708 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site