mirror of
https://github.com/torvalds/linux.git
synced 2026-05-14 17:32:42 +02:00
7001052160
coarse grained, hardware based, forward edge Control-Flow-Integrity mechanism where any indirect CALL/JMP must target an ENDBR instruction or suffer #CP. Additionally, since Alderlake (12th gen)/Sapphire-Rapids, speculation is limited to 2 instructions (and typically fewer) on branch targets not starting with ENDBR. CET-IBT also limits speculation of the next sequential instruction after the indirect CALL/JMP [1]. CET-IBT is fundamentally incompatible with retpolines, but provides, as described above, speculation limits itself. [1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html -----BEGIN PGP SIGNATURE----- iQJJBAABCgAzFiEEv3OU3/byMaA0LqWJdkfhpEvA5LoFAmI/LI8VHHBldGVyekBp bmZyYWRlYWQub3JnAAoJEHZH4aRLwOS6ZnkP/2QCgQLTu6oRxv9O020CHwlaSEeD 1Hoy3loum5q5hAi1Ik3dR9p0H5u64c9qbrBVxaFoNKaLt5GKrtHaDSHNk2L/CFHX urpH65uvTLxbyZzcahkAahoJ71XU+m7PcrHLWMunw9sy10rExYVsUOlFyoyG6XCF BDCNZpdkC09ZM3vwlWGMZd5Pp+6HcZNPyoV9tpvWAS2l+WYFWAID7mflbpQ+tA8b y/hM6b3Ud0rT2ubuG1iUpopgNdwqQZ+HisMPGprh+wKZkYwS2l8pUTrz0MaBkFde go7fW16kFy2HQzGm6aIEBmfcg0palP/mFVaWP0zS62LwhJSWTn5G6xWBr3yxSsht 9gWCiI0oDZuTg698MedWmomdG2SK6yAuZuqmdKtLLoWfWgviPEi7TDFG/cKtZdAW ag8GM8T4iyYZzpCEcWO9GWbjo6TTGq30JBQefCBG47GjD0csv2ubXXx0Iey+jOwT x3E8wnv9dl8V9FSd/tMpTFmje8ges23yGrWtNpb5BRBuWTeuGiBPZED2BNyyIf+T dmewi2ufNMONgyNp27bDKopY81CPAQq9cVxqNm9Cg3eWPFnpOq2KGYEvisZ/rpEL EjMQeUBsy/C3AUFAleu1vwNnkwP/7JfKYpN00gnSyeQNZpqwxXBCKnHNgOMTXyJz beB/7u2KIUbKEkSN =jZfK -----END PGP SIGNATURE----- Merge tag 'x86_core_for_5.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CET-IBT (Control-Flow-Integrity) support from Peter Zijlstra: "Add support for Intel CET-IBT, available since Tigerlake (11th gen), which is a coarse grained, hardware based, forward edge Control-Flow-Integrity mechanism where any indirect CALL/JMP must target an ENDBR instruction or suffer #CP. Additionally, since Alderlake (12th gen)/Sapphire-Rapids, speculation is limited to 2 instructions (and typically fewer) on branch targets not starting with ENDBR. CET-IBT also limits speculation of the next sequential instruction after the indirect CALL/JMP [1]. CET-IBT is fundamentally incompatible with retpolines, but provides, as described above, speculation limits itself" [1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html * tag 'x86_core_for_5.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (53 commits) kvm/emulate: Fix SETcc emulation for ENDBR x86/Kconfig: Only allow CONFIG_X86_KERNEL_IBT with ld.lld >= 14.0.0 x86/Kconfig: Only enable CONFIG_CC_HAS_IBT for clang >= 14.0.0 kbuild: Fixup the IBT kbuild changes x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy x86: Remove toolchain check for X32 ABI capability x86/alternative: Use .ibt_endbr_seal to seal indirect calls objtool: Find unused ENDBR instructions objtool: Validate IBT assumptions objtool: Add IBT/ENDBR decoding objtool: Read the NOENDBR annotation x86: Annotate idtentry_df() x86,objtool: Move the ASM_REACHABLE annotation to objtool.h x86: Annotate call_on_stack() objtool: Rework ASM_REACHABLE x86: Mark __invalid_creds() __noreturn exit: Mark do_group_exit() __noreturn x86: Mark stop_this_cpu() __noreturn objtool: Ignore extra-symbol code objtool: Rename --duplicate to --lto ... |
||
|---|---|---|
| .. | ||
| bitops | ||
| vdso | ||
| access_ok.h | ||
| asm-offsets.h | ||
| asm-prototypes.h | ||
| atomic.h | ||
| atomic64.h | ||
| audit_change_attr.h | ||
| audit_dir_write.h | ||
| audit_read.h | ||
| audit_signal.h | ||
| audit_write.h | ||
| barrier.h | ||
| bitops.h | ||
| bitsperlong.h | ||
| bug.h | ||
| bugs.h | ||
| cache.h | ||
| cacheflush.h | ||
| checksum.h | ||
| cmpxchg-local.h | ||
| cmpxchg.h | ||
| compat.h | ||
| current.h | ||
| delay.h | ||
| device.h | ||
| div64.h | ||
| dma-mapping.h | ||
| dma.h | ||
| early_ioremap.h | ||
| emergency-restart.h | ||
| error-injection.h | ||
| exec.h | ||
| export.h | ||
| extable.h | ||
| fb.h | ||
| fixmap.h | ||
| flat.h | ||
| ftrace.h | ||
| futex.h | ||
| getorder.h | ||
| gpio.h | ||
| hardirq.h | ||
| hugetlb.h | ||
| hw_irq.h | ||
| hyperv-tlfs.h | ||
| ide_iops.h | ||
| int-ll64.h | ||
| io.h | ||
| ioctl.h | ||
| iomap.h | ||
| irq_regs.h | ||
| irq_work.h | ||
| irq.h | ||
| irqflags.h | ||
| Kbuild | ||
| kdebug.h | ||
| kmap_size.h | ||
| kprobes.h | ||
| kvm_para.h | ||
| kvm_types.h | ||
| linkage.h | ||
| local.h | ||
| local64.h | ||
| logic_io.h | ||
| mcs_spinlock.h | ||
| memory_model.h | ||
| mm_hooks.h | ||
| mmiowb_types.h | ||
| mmiowb.h | ||
| mmu_context.h | ||
| mmu.h | ||
| module.h | ||
| module.lds.h | ||
| mshyperv.h | ||
| msi.h | ||
| nommu_context.h | ||
| numa.h | ||
| page.h | ||
| param.h | ||
| parport.h | ||
| pci_iomap.h | ||
| pci.h | ||
| percpu.h | ||
| pgalloc.h | ||
| pgtable_uffd.h | ||
| pgtable-nop4d.h | ||
| pgtable-nopmd.h | ||
| pgtable-nopud.h | ||
| preempt.h | ||
| qrwlock_types.h | ||
| qrwlock.h | ||
| qspinlock_types.h | ||
| qspinlock.h | ||
| resource.h | ||
| rwonce.h | ||
| seccomp.h | ||
| sections.h | ||
| serial.h | ||
| set_memory.h | ||
| shmparam.h | ||
| signal.h | ||
| simd.h | ||
| softirq_stack.h | ||
| spinlock.h | ||
| statfs.h | ||
| string.h | ||
| switch_to.h | ||
| syscall.h | ||
| syscalls.h | ||
| termios-base.h | ||
| termios.h | ||
| timex.h | ||
| tlb.h | ||
| tlbflush.h | ||
| topology.h | ||
| trace_clock.h | ||
| uaccess.h | ||
| unaligned.h | ||
| user.h | ||
| vermagic.h | ||
| vga.h | ||
| vmlinux.lds.h | ||
| vtime.h | ||
| word-at-a-time.h | ||
| xor.h | ||