Rudi Heitbaum 8a0e2b2d69 linux (Generic): Enable Indirect Branch Tracking (X86_KERNEL_IBT) ...

Supported on Tigerlake CPUs and newer

Build the kernel with support for Indirect Branch Tracking, a
hardware support course-grain forward-edge Control Flow Integrity
protection. It enforces that all indirect calls must land on
an ENDBR instruction, as such, the compiler will instrument the
code with them to make this happen.

In addition to building the kernel with IBT, seal all functions that
are not indirect call targets, avoiding them ever becoming one.

This requires LTO like objtool runs and will slow down the build. It
does significantly reduce the number of ENDBR instructions in the
kernel image.

2022-09-05 10:58:03 +00:00

..

linux.x86_64.conf

linux (Generic): Enable Indirect Branch Tracking (X86_KERNEL_IBT)

2022-09-05 10:58:03 +00:00