linux-kernel - Re: [PATCH 05/29] x86: Base IBT bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 19 Feb 2022 01:07:59 +0000
From:   "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To:     "Poimboe, Josh" <jpoimboe@...hat.com>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "hjl.tools@...il.com" <hjl.tools@...il.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "joao@...rdrivepizza.com" <joao@...rdrivepizza.com>,
        "Cooper, Andrew" <andrew.cooper3@...rix.com>
CC:     "keescook@...omium.org" <keescook@...omium.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "mark.rutland@....com" <mark.rutland@....com>,
        "samitolvanen@...gle.com" <samitolvanen@...gle.com>,
        "ndesaulniers@...gle.com" <ndesaulniers@...gle.com>,
        "Milburn, Alyssa" <alyssa.milburn@...el.com>
Subject: Re: [PATCH 05/29] x86: Base IBT bits

On Fri, 2022-02-18 at 17:49 +0100, Peter Zijlstra wrote:
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -1861,6 +1861,21 @@ config X86_UMIP
>           specific cases in protected and virtual-8086 modes.
> Emulated
>           results are dummy.
>  
> +config CC_HAS_IBT
> +       # GCC >= 9 and binutils >= 2.29
> +       # Retpoline check to work around 
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93654
> +       def_bool $(cc-option, -fcf-protection=branch -mindirect-
> branch-register) && $(as-instr,endbr64)
> +
> +config X86_IBT
> +       prompt "Indirect Branch Tracking"
> +       bool
> +       depends on X86_64 && CC_HAS_IBT
> +       help
> +         Build the kernel with support for Indirect Branch Tracking,
> a
> +         hardware supported CFI scheme. Any indirect call must land
> on
> +         an ENDBR instruction, as such, the compiler will litter the
> +         code with them to make this happen.
> +
> 

Could you call this something more specific then just X86_IBT? Like
X86_KERNEL_IBT or something? It could get confusing if we add userspace
IBT, or if someone wants IBT for KVM guests without CFI in the kernel.