RE: How do I force an IBT trap in a demo kernel module?

[David Laight <David.Laight@ACULAB.COM>]

From: Preble, Adam C
> Sent: 23 May 2023 20:29
> 
> I am debugging why a kernel module of ours triggers the IBT (Indirect Branch Tracking) trap, and while
> doing that, I was trying to write a standalone demo that would forcefully trigger it on purpose. This
> has turned out to be much more difficult than I thought! What can I do to get a module to generate an
> indirect branch without an endbr64? Creating the indirect branch itself doesn't appear to be hard:
> 
> 1. Set up a function call
> 2. Assign it to a function pointer
> 3. Call the function pointer
> 4. ...maybe add a compiler flag so it doesn't optimize the call to a direct branch.
> 
> I am primarily building in a Debian environment with gcc (Debian 10.2.1-6) 10.2.1 20210110. By
> default, the branch does get optimized away. I had to set the -mforce-indirect-call flag. The endbr64
> instruction would still emit so I added a function attribute to suppress it:
...
> So what do I have to do to tell objtool to allow to me deliberately shoot myself in the foot here?

You could try adjusting the function pointer by the size of the endbr64 instrauction.

Oh, put the function pointer variable into static data.
That should stop it all being optimised away.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)