From: Kees Cook <kees@kernel.org>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: peterz@infradead.org, bp@alien8.de, dave.hansen@linux.intel.com,
hpa@zytor.com, justinstitt@google.com,
linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
llvm@lists.linux.dev, mingo@redhat.com, morbo@google.com,
nathan@kernel.org, ndesaulniers@google.com,
samitolvanen@google.com, tglx@kernel.org, x86@kernel.org
Subject: Re: [PATCH 2/3] x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
Date: Tue, 13 Oct 2026 01:07:31 -0700 [thread overview]
Message-ID: <202610130106.5CF1301D@keescook> (raw)
In-Reply-To: <8aae2418-38e1-479a-bf82-df65acde0ffd@citrix.com>
On Mon, Oct 12, 2026 at 08:05:21PM +0100, Andrew Cooper wrote:
> > On Mon, Oct 12, 2026 at 02:04:25AM -0700, Kees Cook wrote:
> >> The "cs" prefix on the LEA in the FineIBT paranoid caller template is
> >> padding: it places the LEA's 0xf0 immediate byte where it doubles as the
> >> LOCK prefix that makes the failing Jcc raise #UD. GNU as warns about it
> >> in every CONFIG_FINEIBT=y build:
> >>
> >> Warning: segment override on `lea' is ineffectual
> > Shees...
>
> This is a binutils bug. Can't we fix it here?
I can try to send a binutils bug fix?
> The claim in the warning is simply not true. This is an example where
> it absolutely does matter, and it also matters for legibility that we
> can avoid writing raw hex.
Well, we'd have to keep some kind of work-around for earlier binutils
for a long while...
--
Kees Cook
next prev parent reply other threads:[~2026-10-13 8:07 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-12 9:04 [PATCH 0/3] x86/cfi: Fix a few kCFI issues found with GCC Kees Cook
2026-10-12 9:04 ` [PATCH 1/3] x86/kcfi: Decode the kCFI check from the trap address Kees Cook
2026-10-12 9:04 ` [PATCH 2/3] x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte Kees Cook
2026-10-12 9:16 ` Peter Zijlstra
2026-10-12 19:05 ` Andrew Cooper
2026-10-13 8:07 ` Kees Cook [this message]
2026-10-12 9:04 ` [PATCH 3/3] objtool: Skip jump table jumps in the kCFI indirect call check Kees Cook
2026-10-12 9:22 ` Peter Zijlstra
2026-10-12 18:41 ` Kees Cook
2026-10-13 6:44 ` Peter Zijlstra
2026-10-13 8:37 ` Kees Cook
2026-10-13 9:06 ` Peter Zijlstra
2026-10-13 9:11 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202610130106.5CF1301D@keescook \
--to=kees@kernel.org \
--cc=andrew.cooper3@citrix.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=justinstitt@google.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=mingo@redhat.com \
--cc=morbo@google.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=peterz@infradead.org \
--cc=samitolvanen@google.com \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.