diff options
| author | Peter Zijlstra <peterz@infradead.org> | 2023-06-22 16:27:13 +0200 |
|---|---|---|
| committer | Peter Zijlstra <peterz@infradead.org> | 2023-07-10 09:52:23 +0200 |
| commit | 0479a42d4c15bd554f54d89d12bf68218e3e70da (patch) | |
| tree | a408421e96978fe9c527965840a7da3625d3f351 /arch | |
| parent | 06c2afb862f9da8dc5efa4b6076a0e48c3fbaaa5 (diff) | |
x86/cfi: Extend {JMP,CAKK}_NOSPEC comment
With the introduction of kCFI these helpers are no longer equivalent
to C indirect calls and should be used with care.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lkml.kernel.org/r/20230622144321.360957723%40infradead.org
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/include/asm/nospec-branch.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 55388c9f7601..1a65cf4acb2b 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -234,6 +234,10 @@ * JMP_NOSPEC and CALL_NOSPEC macros can be used instead of a simple * indirect jmp/call which may be susceptible to the Spectre variant 2 * attack. + * + * NOTE: these do not take kCFI into account and are thus not comparable to C + * indirect calls, take care when using. The target of these should be an ENDBR + * instruction irrespective of kCFI. */ .macro JMP_NOSPEC reg:req #ifdef CONFIG_RETPOLINE |