On Wed, Apr 28, 2021 at 7:48 AM David Laight <David.Laight@xxxxxxxxxx> wrote: > > From: Yu-cheng Yu > > Sent: 27 April 2021 21:47 > > > > Control-flow Enforcement (CET) is a new Intel processor feature that blocks > > return/jump-oriented programming attacks. Details are in "Intel 64 and > > IA-32 Architectures Software Developer's Manual" [1]. > ... > > Does this feature require that 'binary blobs' for out of tree drivers > be compiled by a version of gcc that adds the ENDBRA instructions? > > If enabled for userspace, what happens if an old .so is dynamically > loaded? > Or do all userspace programs and libraries have to have been compiled > with the ENDBRA instructions? If you believe that the userspace tooling for the legacy IBT table actually works, then it should just work. Yu-cheng, etc: how well tested is it? --Andy
