| Date | Mon, 7 Mar 2022 12:17:19 +0100 | From | Peter Zijlstra <> | Subject | Re: [PATCH v3 04/39] x86/ibt: Base IBT bits |
| |
On Thu, Mar 03, 2022 at 12:23:25PM +0100, Peter Zijlstra wrote:
> --- a/arch/x86/Makefile > +++ b/arch/x86/Makefile > @@ -62,8 +62,11 @@ export BITS > # > KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx > > -# Intel CET isn't enabled in the kernel > +ifeq ($(CONFIG_X86_KERNEL_IBT),y) > +KBUILD_CFLAGS += $(call cc-option,-fcf-protection=branch) > +else > KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) > +endif > > ifeq ($(CONFIG_X86_32),y) > BITS := 32
Joao reported that RETPOLINE=n builds explode; turns out the compilers default to using NOTRACK prefixes for jump-tables and we explicitly do not enable that security compromise for the kernel.
Since the compilers don't have explicit control over NOTRACK generation, blanket disable jump-tables when using IBT without RETPOLINE.
Joao will be submitting GCC and Clang bugreports on this shortly.
diff --git a/arch/x86/Makefile b/arch/x86/Makefile index d38c18f4bd53..f80a425e7d29 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -63,7 +63,9 @@ export BITS KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx ifeq ($(CONFIG_X86_KERNEL_IBT),y) -KBUILD_CFLAGS += $(call cc-option,-fcf-protection=branch) +# Explicitly disable jump-tables, also implied by RETPOLINE=y, for kernel IBT +# to avoid NOTRACK prefixes. +KBUILD_CFLAGS += $(call cc-option,-fcf-protection=branch -fno-jump-tables) else KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) endif
|