[kvm-unit-tests PATCH v3 11/17] x86: cet: Simplify IBT test

Sean Christopherson
2025-11-14T00:13:20Z

From: Mathias Krause <minipli@grsecurity.net>

The inline assembly of cet_ibt_func() does unnecessary things and
doesn't mention the clobbered registers.

Fix that by reducing the code to what's needed (an indirect jump to a
target lacking the ENDBR instruction) and passing and output register
variable for it.

Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
x86/cet.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/x86/cet.c b/x86/cet.c
index 61059ef2..a1643c83 100644
--- a/x86/cet.c
+++ b/x86/cet.c
@@ -33,18 +33,17 @@ static uint64_t cet_shstk_func(void)

static uint64_t cet_ibt_func(void)
{
+ unsigned long tmp;
/*
* In below assembly code, the first instruction at label 2 is not
* endbr64, it'll trigger #CP with error code 0x3, and the execution
* is terminated when HW detects the violation.
*/
printf("No endbr64 instruction at jmp target, this triggers #CP...\n");
- asm volatile ("movq $2, %rcx\n"
- "dec %rcx\n"
- "leaq 2f(%rip), %rax\n"
- "jmp *%rax \n"
- "2:\n"
- "dec %rcx\n");
+ asm volatile ("leaq 2f(%%rip), %0\n\t"
+ "jmpq *%0\n\t"
+ "2:"
+ : "=r"(tmp));
return 0;
}

--
2.52.0.rc1.455.g30608eb744-goog