All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Roger Pau Monné" <roger.pau@citrix.com>
To: Jan Beulich <jbeulich@suse.com>
Cc: "xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>,
	Andrew Cooper <andrew.cooper3@citrix.com>
Subject: Re: [PATCH v4 01/11] x86/HVM: improve CET-IBT pruning of ENDBR
Date: Wed, 5 Mar 2025 15:48:14 +0100	[thread overview]
Message-ID: <Z8hkLjMAQfhBR2Cm@macbook.local> (raw)
In-Reply-To: <29cc2974-a1d8-4123-83b0-b44a3151f900@suse.com>

On Tue, Feb 25, 2025 at 12:37:00PM +0100, Jan Beulich wrote:
> __init{const,data}_cf_clobber can have an effect only for pointers
> actually populated in the respective tables. While not the case for SVM
> right now, VMX installs a number of pointers only under certain
> conditions. Hence the respective functions would have their ENDBR purged
> only when those conditions are met. Invoke "pruning" functions after
> having copied the respective tables, for them to install any "missing"
> pointers.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Roger Pau Monné <roger.pau@citrix.com>

However I find this filling slightly ugly, and prone to be forgotten
when further hooks are added.

Would it make sense to delay enabling of IBT until after alternatives
have been applied, and thus simply not use the cf_clobber attribute on
functions that are patched to not be indirectly called?

We could still enable IBT before starting the APs.

Thanks, Roger.


  parent reply	other threads:[~2025-03-05 14:48 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-25 11:35 [PATCH v4 00/11] x86/HVM: misc tidying Jan Beulich
2025-02-25 11:37 ` [PATCH v4 01/11] x86/HVM: improve CET-IBT pruning of ENDBR Jan Beulich
2025-03-05 14:47   ` Andrew Cooper
2025-03-05 15:00     ` Jan Beulich
2025-03-05 14:48   ` Roger Pau Monné [this message]
2025-03-05 15:02     ` Jan Beulich
2025-03-05 15:39       ` Roger Pau Monné
2025-03-05 16:23         ` Jan Beulich
2025-03-05 17:26           ` Roger Pau Monné
2025-03-06  9:44             ` Jan Beulich
2025-02-25 11:37 ` [PATCH v4 02/11] VMX: drop vmcs_revision_id Jan Beulich
2025-02-25 11:38 ` [PATCH v4 03/11] VMX: convert vmx_basic_msr Jan Beulich
2025-02-25 11:38 ` [PATCH v4 04/11] VMX: convert vmx_pin_based_exec_control Jan Beulich
2025-02-25 11:38 ` [PATCH v4 05/11] VMX: convert vmx_cpu_based_exec_control Jan Beulich
2025-02-25 11:39 ` [PATCH v4 06/11] VMX: convert vmx_secondary_exec_control Jan Beulich
2025-02-25 11:39 ` [PATCH v4 07/11] VMX: convert vmx_tertiary_exec_control Jan Beulich
2025-02-25 11:40 ` [PATCH v4 08/11] VMX: convert vmx_vmexit_control Jan Beulich
2025-02-25 11:40 ` [PATCH v4 09/11] VMX: convert vmx_vmentry_control Jan Beulich
2025-02-25 11:41 ` [PATCH v4 10/11] VMX: convert vmx_ept_vpid_cap Jan Beulich
2025-02-25 11:41 ` [PATCH v4 11/11] VMX: convert vmx_vmfunc Jan Beulich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Z8hkLjMAQfhBR2Cm@macbook.local \
    --to=roger.pau@citrix.com \
    --cc=andrew.cooper3@citrix.com \
    --cc=jbeulich@suse.com \
    --cc=xen-devel@lists.xenproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.