Add endbr annotations before indirect branch targets. This lets QEMU enable
IBT even for TCG-enabled builds.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
---
Makefile.target | 2 ++
configure | 9 +++++++++
tcg/i386/tcg-target.inc.c | 14 ++++++++++++++
3 files changed, 25 insertions(+)
diff --git a/Makefile.target b/Makefile.target
index fa143d7b4b..df413c9b7f 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -114,8 +114,10 @@ obj-y += accel/
obj-$(CONFIG_TCG) += tcg/tcg.o tcg/tcg-op.o tcg/tcg-op-vec.o tcg/tcg-op-gvec.o
obj-$(CONFIG_TCG) += tcg/tcg-common.o tcg/optimize.o
ifeq ($(CONFIG_CET),y)
+ifneq ($(CONFIG_CET_TCG),y)
tcg/tcg.o-cflags := -fcf-protection=return
endif
+endif
obj-$(CONFIG_TCG_INTERPRETER) += tcg/tci.o
obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
obj-$(CONFIG_TCG) += fpu/softfloat.o
diff --git a/configure b/configure
index 4470fe8e74..4e553e521b 100755
--- a/configure
+++ b/configure
@@ -5096,6 +5096,11 @@ if test "$cet" = ""; then
cet=yes
QEMU_CFLAGS="-fcf-protection $QEMU_CFLAGS"
fi
+if test "$cpu" = "x86_64"; then
+ cet_tcg=yes
+else
+ cet_tcg=no
+fi
##########################################
# check and set a backend for coroutine
@@ -6290,6 +6295,7 @@ echo "TCG support $tcg"
if test "$tcg" = "yes" ; then
echo "TCG debug enabled $debug_tcg"
echo "TCG interpreter $tcg_interpreter"
+ echo "TCG CET support $cet_tcg"
fi
echo "malloc trim support $malloc_trim"
echo "RDMA support $rdma"
@@ -6495,6 +6501,9 @@ fi
if test "$cet" = "yes" ; then
echo "CONFIG_CET=y" >> $config_host_mak
fi
+if test "$cet_tcg" = "yes" ; then
+ echo "CONFIG_CET_TCG=y" >> $config_host_mak
+fi
if test "$slirp" != "no"; then
echo "CONFIG_SLIRP=y" >> $config_host_mak
echo "CONFIG_SMBD_COMMAND=\"$smbd\"" >> $config_host_mak
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index 781b1faec2..4d1f80c1b2 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -808,6 +808,17 @@ static inline void tgen_arithr(TCGContext *s, int subop,
int dest, int src)
tcg_out_modrm(s, OPC_ARITH_GvEv + (subop << 3) + ext, dest, src);
}
+static void tcg_out_endbr(TCGContext *s)
+{
+#if defined __CET__ && (__CET__ & 1)
+#ifdef __x86_64__
+ tcg_out32(s, 0xfa1e0ff3);
+#else
+ tcg_out32(s, 0xfb1e0ff3);
+#endif
+#endif
+}
+
static void tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
{
int rexw = 0;
@@ -3499,6 +3510,7 @@ static const int tcg_target_callee_save_regs[] = {
static inline void tcg_out_start(TCGContext *s)
{
+ tcg_out_endbr(s);
}
/* Generate global QEMU prologue and epilogue code */
@@ -3514,6 +3526,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
CPU_TEMP_BUF_NLONGS * sizeof(long));
/* Save all callee saved registers. */
+ tcg_out_endbr(s);
for (i = 0; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) {
tcg_out_push(s, tcg_target_callee_save_regs[i]);
}
@@ -3553,6 +3566,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
* and fall through to the rest of the epilogue.
*/
s->code_gen_epilogue = s->code_ptr;
+ tcg_out_endbr(s);
tcg_out_movi(s, TCG_TYPE_REG, TCG_REG_EAX, 0);
/* TB epilogue */
--
2.20.1
