1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _ASM_X86_IBT_H 3 #define _ASM_X86_IBT_H 4 5 #include <linux/types.h> 6 7 /* 8 * The rules for enabling IBT are: 9 * 10 * - CC_HAS_IBT: the toolchain supports it 11 * - X86_KERNEL_IBT: it is selected in Kconfig 12 * - !__DISABLE_EXPORTS: this is regular kernel code 13 * 14 * Esp. that latter one is a bit non-obvious, but some code like compressed, 15 * purgatory, realmode etc.. is built with custom CFLAGS that do not include 16 * -fcf-protection=branch and things will go *bang*. 17 * 18 * When all the above are satisfied, HAS_KERNEL_IBT will be 1, otherwise 0. 19 */ 20 #if defined(CONFIG_X86_KERNEL_IBT) && !defined(__DISABLE_EXPORTS) 21 22 #define HAS_KERNEL_IBT 1 23 24 #ifndef __ASSEMBLY__ 25 26 #ifdef CONFIG_X86_64 27 #define ASM_ENDBR "endbr64\n\t" 28 #else 29 #define ASM_ENDBR "endbr32\n\t" 30 #endif 31 32 #define __noendbr __attribute__((nocf_check)) 33 34 static inline __attribute_const__ u32 gen_endbr(void) 35 { 36 u32 endbr; 37 38 /* 39 * Generate ENDBR64 in a way that is sure to not result in 40 * an ENDBR64 instruction as immediate. 41 */ 42 asm ( "mov $~0xfa1e0ff3, %[endbr]\n\t" 43 "not %[endbr]\n\t" 44 : [endbr] "=&r" (endbr) ); 45 46 return endbr; 47 } 48 49 static inline bool is_endbr(u32 val) 50 { 51 val &= ~0x01000000U; /* ENDBR32 -> ENDBR64 */ 52 return val == gen_endbr(); 53 } 54 55 #else /* __ASSEMBLY__ */ 56 57 #ifdef CONFIG_X86_64 58 #define ENDBR endbr64 59 #else 60 #define ENDBR endbr32 61 #endif 62 63 #endif /* __ASSEMBLY__ */ 64 65 #else /* !IBT */ 66 67 #define HAS_KERNEL_IBT 0 68 69 #ifndef __ASSEMBLY__ 70 71 #define ASM_ENDBR 72 73 #define __noendbr 74 75 static inline bool is_endbr(u32 val) { return false; } 76 77 #else /* __ASSEMBLY__ */ 78 79 #define ENDBR 80 81 #endif /* __ASSEMBLY__ */ 82 83 #endif /* CONFIG_X86_KERNEL_IBT */ 84 85 #define ENDBR_INSN_SIZE (4*HAS_KERNEL_IBT) 86 87 #endif /* _ASM_X86_IBT_H */ 88