From: Dave Hansen <dave.hansen@intel.com>
To: Jarkko Sakkinen <jarkko@kernel.org>
Cc: "Yu, Yu-cheng" <yu-cheng.yu@intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
linux-mm@kvack.org, linux-arch@vger.kernel.org,
linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>,
Andy Lutomirski <luto@kernel.org>,
Balbir Singh <bsingharora@gmail.com>,
Borislav Petkov <bp@alien8.de>,
Cyrill Gorcunov <gorcunov@gmail.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Eugene Syromiatnikov <esyr@redhat.com>,
Florian Weimer <fweimer@redhat.com>,
"H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>,
Jonathan Corbet <corbet@lwn.net>,
Kees Cook <keescook@chromium.org>,
Mike Kravetz <mike.kravetz@oracle.com>,
Nadav Amit <nadav.amit@gmail.com>,
Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>,
Peter Zijlstra <peterz@infradead.org>,
Randy Dunlap <rdunlap@infradead.org>,
"Ravi V. Shankar" <ravi.v.shankar@intel.com>,
Vedvyas Shanbhogue <vedvyas.shanbhogue@intel.com>,
Dave Martin <Dave.Martin@arm.com>,
Weijiang Yang <weijiang.yang@intel.com>,
Pengfei Xu <pengfei.xu@intel.com>,
Haitao Huang <haitao.huang@intel.com>
Subject: Re: [PATCH v22 8/8] x86/vdso: Add ENDBR64 to __vdso_sgx_enter_enclave
Date: Fri, 12 Mar 2021 08:59:53 -0800 [thread overview]
Message-ID: <c3fd1dc5-638c-978d-d959-0c3ebf92df16@intel.com> (raw)
In-Reply-To: <YEudGizbVrQaRoPq@kernel.org>
On 3/12/21 8:55 AM, Jarkko Sakkinen wrote:
>> ENDBR is a special new instruction for the Indirect Branch Tracking
>> (IBT) component of CET. IBT prevents attacks by ensuring that (most)
>> indirect branches and function calls may only land at ENDBR
>> instructions. Branches that don't follow the rules will result in
>> control flow (#CF) exceptions.
>>
>> ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR
>> instructions are inserted automatically by the compiler, but branch
>> targets written in assembly must have ENDBR added manually, like this one.
> Thank you, this clears the whole thing a lot.
>
> Doesn't this mean that it could be there just as well unconditionally?
It could be there unconditionally. But, I think it's still worth the
#ifdef just out of the principle of being as tidy as possible. The
#ifdef is basically as low cost and low complexity as you get. It is
also somewhat self-documenting: "This instruction is only necessary when
your CPU supports IBT".
next prev parent reply other threads:[~2021-03-12 17:00 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-10 22:05 [PATCH v22 0/8] Control-flow Enforcement: Indirect Branch Tracking Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 1/8] x86/cet/ibt: Update Kconfig for user-mode " Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 2/8] x86/cet/ibt: User-mode Indirect Branch Tracking support Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 3/8] x86/cet/ibt: Handle signals for Indirect Branch Tracking Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 4/8] x86/cet/ibt: Update ELF header parsing " Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 5/8] x86/cet/ibt: Update arch_prctl functions " Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 6/8] x86/vdso/32: Add ENDBR32 to __kernel_vsyscall entry point Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 7/8] x86/vdso: Insert endbr32/endbr64 to vDSO Yu-cheng Yu
2021-03-10 22:05 ` [PATCH v22 8/8] x86/vdso: Add ENDBR64 to __vdso_sgx_enter_enclave Yu-cheng Yu
2021-03-10 22:39 ` Jarkko Sakkinen
2021-03-10 22:55 ` Yu, Yu-cheng
2021-03-10 23:17 ` Borislav Petkov
2021-03-10 23:20 ` Dave Hansen
2021-03-10 23:22 ` Yu, Yu-cheng
2021-03-12 16:55 ` Jarkko Sakkinen
2021-03-12 16:57 ` Jarkko Sakkinen
2021-03-12 16:59 ` Dave Hansen [this message]
2021-03-11 3:36 ` Jarkko Sakkinen
2021-03-11 8:42 ` Peter Zijlstra
2021-03-11 15:44 ` Yu, Yu-cheng
2021-03-12 16:56 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c3fd1dc5-638c-978d-d959-0c3ebf92df16@intel.com \
--to=dave.hansen@intel.com \
--cc=Dave.Martin@arm.com \
--cc=arnd@arndb.de \
--cc=bp@alien8.de \
--cc=bsingharora@gmail.com \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=esyr@redhat.com \
--cc=fweimer@redhat.com \
--cc=gorcunov@gmail.com \
--cc=haitao.huang@intel.com \
--cc=hjl.tools@gmail.com \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=jarkko@kernel.org \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mike.kravetz@oracle.com \
--cc=mingo@redhat.com \
--cc=nadav.amit@gmail.com \
--cc=oleg@redhat.com \
--cc=pavel@ucw.cz \
--cc=pengfei.xu@intel.com \
--cc=peterz@infradead.org \
--cc=ravi.v.shankar@intel.com \
--cc=rdunlap@infradead.org \
--cc=tglx@linutronix.de \
--cc=vedvyas.shanbhogue@intel.com \
--cc=weijiang.yang@intel.com \
--cc=x86@kernel.org \
--cc=yu-cheng.yu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.