Re: [RFC] Circumventing FineIBT Via Entrypoints

[Peter Zijlstra]

On Mon, Feb 17, 2025 at 06:38:27PM +0000, David Laight wrote:

> I may not have retpolines enabled, a typical call site is (from vmlinux.o):

Make sure CONFIG_FINEIBT=y, otherwise there is no point in talking about
this. This requires KERNEL_IBT=y RETPOLINE=y CALL_PADDING=y CFI_CLANG=y.

Then look at arch/x86/include/asm/cfi.h and make sure to read the
comment, and then read arch/x86/kernel/alternative.c:__apply_fineibt().

Which ever way around you're going to turn this, you'll never find the
fineibt code in the object files.