x86: Build check for embedded endbr64 instructions
authorMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Fri, 26 Nov 2021 15:34:08 +0000 (15:34 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Wed, 23 Feb 2022 15:33:43 +0000 (15:33 +0000)
commit4d037425dccf6c5109d4939a6cd224d846827907
treef13f45270b00120ba268f3beac874304a3807e7b
parent5d59421815d57f437fccea6ac516c2d23a35bbdb
x86: Build check for embedded endbr64 instructions

An interesting corner case occurs when the byte sequence making up endbr64
ends up on a non-instruction boundary.  Such embedded instructions mark legal
indirect branch targets as far as the CPU is concerned, which aren't legal as
far as the logic is concerned.

When CET-IBT is active, check for embedded byte sequences.  Example failures
look like:

  check-endbr.sh xen-syms Fail: Found 2 embedded endbr64 instructions
  0xffff82d040325677: test_endbr64 at /local/xen.git/xen/arch/x86/x86_64/entry.S:28
  0xffff82d040352da6: init_done at /local/xen.git/xen/arch/x86/setup.c:675

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
README
xen/arch/x86/Makefile
xen/tools/check-endbr.sh [new file with mode: 0755]