[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 00/65] x86: Support for CET Indirect Branch Tracking
- To: Andrew Cooper <amc96@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
- From: Jan Beulich <jbeulich@xxxxxxxx>
- Date: Mon, 29 Nov 2021 17:17:19 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=D5DO0ua4Csy7EOR/h2PhqnA0ZieH7W206sA6OBpBu/g=; b=an2cjrgxm5dFZQPkixCzsIJE6qTmH0aDgmLdOmDxIO9qhWbztUYG70U1pthKcJTgAosgYtg2O1OjXvgjhmRLAxhhgKhEZpK6+AzV7QcewiwA0IEpy23yAHyqx+ScFKo0YdxJWPe5aa57Jjqn4BvSVqnw/LHyYVv5rnS6CDZW326Rr8wFclwnhUHgNrwwC85oFSNpplRFvvYrudYINMDLLADWb8cF8kEPQv+ebv5nmv74naQmjgWJx8mmqE309x1uyYBwTyjxKFRgY1QKwGwKooufqekGf5y81hJ8Nyw6mGWQiH7AnvlNQmGtvPRxYb08AxnO0P6FV1KFmXcDd0UsGA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Iew6drm5w5x86TzgZmNl7ik45KjwTZC+/6434Fj9P7BxsZArUyNeb5AwOYOhB9ZqBYwD67mx0KM30W7yGY7kR8f1PzJKZqFdgmvMi6CUm/IRmq/7O7wAW+kfiH4f/hpWcgXSLedlBBpxhxgYRYl5YRsVgZBxIiHKnzc2l/lt92Of8SC9TrOCl/dt03ovc015Ew/9U+yFzA7bOmsMt6LvUrFcA73LkEgPQRTRtnCiJX/NXAJXnjjpaNstciIUXie0r5aWqSua2x42Uyo0THA9QskmaOPzFbbUTeAx5iZ6JcmYrzi/3EjYmYFsW7yohNW3R4sPlGjtRDIH5oQwSRjHWg==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=suse.com;
- Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, Julien Grall <julien@xxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, Juergen Gross <jgross@xxxxxxxx>, Daniel Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>, Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>, Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- Delivery-date: Mon, 29 Nov 2021 16:17:50 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 29.11.2021 16:09, Andrew Cooper wrote:
> On 29/11/2021 14:44, Jan Beulich wrote:
>> One question though: With the large number of __init functions gaining
>> cf_check, wouldn't it be possible to turn on CET-IBT only when we're
>> done using .init.text?
>
> 233 to be precise.
>
> GCC can't distinguish init from non-init functions as far as the
> improved typechecking (patch 56) goes, so omitting __init would cause
> compilation issues.
Oh, right. Should have been obvious to me, but wasn't.
Jan
> Furthermore, CET-IBT is only one Control Flow Integrity scheme
> attempting to use a nominally arch-neutral interface. There are others
> (PaX RAP, and Intel's FineIBT) which have software components to them,
> and for those, the function pointer callers and callees need to have all
> appropriate ABI modifications.
>
> I'm pretty certain that if we skipped annotation of the __init functions
> for now, we'd have to add them in due course anyway.
>
> We could defer enabling CET-IBT until late on boot, but enabling it
> early gets us better coverage of issues until the first software scheme
> turns up.
>
> ~Andrew
>
|
