From patchwork Fri May 21 22:15:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273933 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 543EEC04FF3 for ; Fri, 21 May 2021 22:16:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EEA07613E3 for ; Fri, 21 May 2021 22:16:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EEA07613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 599648E006E; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 200738E006A; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 004C18E006C; Fri, 21 May 2021 18:16:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0024.hostedemail.com [216.40.44.24]) by kanga.kvack.org (Postfix) with ESMTP id B90738E006C for ; Fri, 21 May 2021 18:16:32 -0400 (EDT) Received: from smtpin13.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 5932182499A8 for ; Fri, 21 May 2021 22:16:32 +0000 (UTC) X-FDA: 78166648224.13.7CCDFBD Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf13.hostedemail.com (Postfix) with ESMTP id 6626BE000800 for ; Fri, 21 May 2021 22:16:27 +0000 (UTC) IronPort-SDR: /B5T5MSM7TQz74ffvlP8w6/Gkfxo2N+Iv/+mV/VdGq+OpLnB/uFaH44INh5yxNTEkUbfA2xgFY CnBxuqps7F2A== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500972" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500972" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:28 -0700 IronPort-SDR: Nb6khD/gChNyk4b0o0lWioO4018zGUysw4o/3Sxtym9lDO6UGtE9CwsE7VkFOBuA2EtCi7oRaR +M1e3OSZLXGQ== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269426" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:28 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 01/10] x86/cet/ibt: Add Kconfig option for Indirect Branch Tracking Date: Fri, 21 May 2021 15:15:22 -0700 Message-Id: <20210521221531.30168-2-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf13.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf13.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 6626BE000800 X-Stat-Signature: y49msqtfxjxwfd74twodgogmcjdzqn6b X-HE-Tag: 1621635387-779923 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Indirect Branch Tracking (IBT) provides protection against CALL-/JMP- oriented programming attacks. It is active when the kernel has this feature enabled, and the processor and the application support it. When this feature is enabled, legacy non-IBT applications continue to work, but without IBT protection. Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook --- arch/x86/Kconfig | 19 +++++++++++++++++++ arch/x86/include/asm/disabled-features.h | 8 +++++++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index af1a096ed023..2e188d50f967 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1972,6 +1972,25 @@ config X86_SHADOW_STACK If unsure, say N. +config X86_IBT + prompt "Intel Indirect Branch Tracking" + def_bool n + depends on X86_SHADOW_STACK + depends on $(cc-option,-fcf-protection) + help + Indirect Branch Tracking (IBT) provides protection against + CALL-/JMP-oriented programming attacks. It is active when + the kernel has this feature enabled, and the processor and + the application support it. When this feature is enabled, + legacy non-IBT applications continue to work, but without + IBT protection. + Support for this feature is present on Tiger Lake family of + processors released in 2020 or later. Enabling this feature + increases kernel text size by 3.7 KB. + See Documentation/x86/intel_cet.rst for more information. + + If unsure, say N. + config EFI bool "EFI runtime service support" depends on ACPI diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h index e5c6ed9373e8..07cc40d49947 100644 --- a/arch/x86/include/asm/disabled-features.h +++ b/arch/x86/include/asm/disabled-features.h @@ -74,6 +74,12 @@ #define DISABLE_SHSTK (1 << (X86_FEATURE_SHSTK & 31)) #endif +#ifdef CONFIG_X86_IBT +#define DISABLE_IBT 0 +#else +#define DISABLE_IBT (1 << (X86_FEATURE_IBT & 31)) +#endif + /* * Make sure to add features to the correct mask */ @@ -96,7 +102,7 @@ #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP| \ DISABLE_ENQCMD|DISABLE_SHSTK) #define DISABLED_MASK17 0 -#define DISABLED_MASK18 0 +#define DISABLED_MASK18 (DISABLE_IBT) #define DISABLED_MASK19 0 #define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20) From patchwork Fri May 21 22:15:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273929 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D23E1C4707A for ; Fri, 21 May 2021 22:16:33 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 79058613F5 for ; Fri, 21 May 2021 22:16:33 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 79058613F5 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 00D068E006D; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EF9348E006B; Fri, 21 May 2021 18:16:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CFD658E006D; Fri, 21 May 2021 18:16:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0121.hostedemail.com [216.40.44.121]) by kanga.kvack.org (Postfix) with ESMTP id 9BC3B8E006A for ; Fri, 21 May 2021 18:16:32 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 4200D824999B for ; Fri, 21 May 2021 22:16:32 +0000 (UTC) X-FDA: 78166648224.05.9355213 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf23.hostedemail.com (Postfix) with ESMTP id 1F07DA0001C5 for ; Fri, 21 May 2021 22:16:28 +0000 (UTC) IronPort-SDR: e6JAQtw/KIE1GmiKp8Q3H4cs5vreaKYSzmi4J4CEQRIq+yvAY188qocdoq+t2zqQ+q/kqjDtoh pbs8Ji9d3WFg== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500975" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500975" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:28 -0700 IronPort-SDR: sX3cB7hOdv0qYkzvqnGfwpYlLqksLfnqQW4oUdnnbgSm4pZJdbp6FyVdDgFv9kAmVvkt0guYF4 SovxeF13fxoQ== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269428" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:28 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 02/10] x86/cet/ibt: Add user-mode Indirect Branch Tracking support Date: Fri, 21 May 2021 15:15:23 -0700 Message-Id: <20210521221531.30168-3-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf23.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf23.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 1F07DA0001C5 X-Stat-Signature: anhubmh481qf8a89n4pt6iikktsb8xgy X-HE-Tag: 1621635388-366574 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Introduce user-mode Indirect Branch Tracking (IBT) support. Add routines for the setup/disable of IBT. Signed-off-by: Yu-cheng Yu Cc: Kees Cook --- v27: - Change struct thread_shstk: ibt_enabled to ibt. - Create a helper for set/clear bits of MSR_IA32_U_CET. arch/x86/include/asm/cet.h | 9 ++++++ arch/x86/kernel/Makefile | 1 + arch/x86/kernel/ibt.c | 58 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 68 insertions(+) create mode 100644 arch/x86/kernel/ibt.c diff --git a/arch/x86/include/asm/cet.h b/arch/x86/include/asm/cet.h index c76a85fbd59f..3dfca29a7c0b 100644 --- a/arch/x86/include/asm/cet.h +++ b/arch/x86/include/asm/cet.h @@ -14,6 +14,7 @@ struct thread_shstk { u64 base; u64 size; u64 locked:1; + u64 ibt:1; }; #ifdef CONFIG_X86_SHADOW_STACK @@ -42,6 +43,14 @@ static inline int setup_signal_shadow_stack(int ia32, void __user *restorer) { r static inline int restore_signal_shadow_stack(void) { return 0; } #endif +#ifdef CONFIG_X86_IBT +int ibt_setup(void); +void ibt_disable(void); +#else +static inline int ibt_setup(void) { return 0; } +static inline void ibt_disable(void) {} +#endif + #ifdef CONFIG_X86_SHADOW_STACK int prctl_cet(int option, u64 arg2); #else diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index 2741c91104ac..bc4dc013e1ed 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -151,6 +151,7 @@ obj-$(CONFIG_UNWINDER_GUESS) += unwind_guess.o obj-$(CONFIG_AMD_MEM_ENCRYPT) += sev.o obj-$(CONFIG_X86_SHADOW_STACK) += shstk.o obj-$(CONFIG_X86_SHADOW_STACK) += shstk.o cet_prctl.o +obj-$(CONFIG_X86_IBT) += ibt.o ### # 64 bit specific files ifeq ($(CONFIG_X86_64),y) diff --git a/arch/x86/kernel/ibt.c b/arch/x86/kernel/ibt.c new file mode 100644 index 000000000000..629d4100fc40 --- /dev/null +++ b/arch/x86/kernel/ibt.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * ibt.c - Intel Indirect Branch Tracking support + * + * Copyright (c) 2021, Intel Corporation. + * Yu-cheng Yu + */ + +#include +#include +#include +#include +#include +#include + +static int ibt_set_clear_msr_bits(u64 set, u64 clear) +{ + u64 msr; + int r; + + fpregs_lock(); + + if (test_thread_flag(TIF_NEED_FPU_LOAD)) + __fpregs_load_activate(); + + r = rdmsrl_safe(MSR_IA32_U_CET, &msr); + if (!r) { + msr = (msr & ~clear) | set; + r = wrmsrl_safe(MSR_IA32_U_CET, msr); + } + + fpregs_unlock(); + + return r; +} + +int ibt_setup(void) +{ + int r; + + if (!cpu_feature_enabled(X86_FEATURE_IBT)) + return -EOPNOTSUPP; + + r = ibt_set_clear_msr_bits(CET_ENDBR_EN | CET_NO_TRACK_EN, 0); + if (!r) + current->thread.shstk.ibt = 1; + + return r; +} + +void ibt_disable(void) +{ + if (!current->thread.shstk.ibt) + return; + + ibt_set_clear_msr_bits(0, CET_ENDBR_EN); + current->thread.shstk.ibt = 0; +} From patchwork Fri May 21 22:15:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273935 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A418C04FF3 for ; Fri, 21 May 2021 22:16:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A8121613E3 for ; Fri, 21 May 2021 22:16:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A8121613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A6B3F8E0070; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9F0E58E006F; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 868AE8E006A; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0163.hostedemail.com [216.40.44.163]) by kanga.kvack.org (Postfix) with ESMTP id 55F918E006C for ; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 08E255828 for ; Fri, 21 May 2021 22:16:33 +0000 (UTC) X-FDA: 78166648266.21.C4EAAA3 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf23.hostedemail.com (Postfix) with ESMTP id BC57AA0001C9 for ; Fri, 21 May 2021 22:16:29 +0000 (UTC) IronPort-SDR: x/sP6eUa4EXBiAKdtmck0Lb7uF5o1GGmkaxfEAt4F2tj1pnJg51K9AxUArctvU12Kq1m5uex15 P+Vkc6WIFb0g== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500976" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500976" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 IronPort-SDR: pTla9mSy1XTo6nTQW/SR2bAKW4wCVKXTVX6twdy5UGGihKiomiRDEAEGWLJ8vFFptwSAg/xNh6 3p57bCXs6vZQ== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269434" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:28 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 03/10] x86/cet/ibt: Handle signals for Indirect Branch Tracking Date: Fri, 21 May 2021 15:15:24 -0700 Message-Id: <20210521221531.30168-4-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf23.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf23.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: BC57AA0001C9 X-Stat-Signature: 19j31n55a8raoktw6skgo7jj61wj4xcx X-HE-Tag: 1621635389-506424 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: IBT state machine tracks CALL/JMP instructions. When a such instruction is executed and before arriving at an ENDBR, it is in WAIT_FOR_ENDBR state, which can be read from CET_WAIT_ENDBR bit of MSR_IA32_U_CET. Further details are described in Intel SDM Vol. 1, Sec. 18.3. In handling signals, WAIT_FOR_ENDBR state is saved/restored with a new UC_WAIT_ENDBR flag being introduced. A legacy IA32 signal frame does not have ucontext, and cannot be supported with a uc flag. Thus, IBT feature is not supported for ia32 app's, which is handled in a separate patch. Signed-off-by: Yu-cheng Yu Cc: Andy Lutomirski Cc: Cyrill Gorcunov Cc: Florian Weimer Cc: H. Peter Anvin Cc: Kees Cook Link: https://lore.kernel.org/linux-api/f6e61dae-9805-c855-8873-7481ceb7ea79@intel.com/ --- arch/x86/ia32/ia32_signal.c | 15 ++++++++--- arch/x86/include/asm/cet.h | 4 +++ arch/x86/include/uapi/asm/ucontext.h | 5 ++++ arch/x86/kernel/ibt.c | 36 ++++++++++++++++++++++++++++ arch/x86/kernel/signal.c | 6 +++++ 5 files changed, 64 insertions(+), 3 deletions(-) diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c index d7a30bc98e66..77d0fa90cc19 100644 --- a/arch/x86/ia32/ia32_signal.c +++ b/arch/x86/ia32/ia32_signal.c @@ -129,6 +129,7 @@ COMPAT_SYSCALL_DEFINE0(rt_sigreturn) { struct pt_regs *regs = current_pt_regs(); struct rt_sigframe_ia32 __user *frame; + unsigned int uc_flags; sigset_t set; frame = (struct rt_sigframe_ia32 __user *)(regs->sp - 4); @@ -137,6 +138,11 @@ COMPAT_SYSCALL_DEFINE0(rt_sigreturn) goto badframe; if (__get_user(set.sig[0], (__u64 __user *)&frame->uc.uc_sigmask)) goto badframe; + if (__get_user(uc_flags, &frame->uc.uc_flags)) + goto badframe; + + if (uc_flags & UC_WAIT_ENDBR) + ibt_set_wait_endbr(); set_current_blocked(&set); @@ -312,6 +318,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig, compat_sigset_t *set, struct pt_regs *regs) { struct rt_sigframe_ia32 __user *frame; + unsigned int uc_flags = 0; void __user *restorer; void __user *fp = NULL; @@ -339,6 +346,9 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig, if (setup_signal_shadow_stack(1, restorer)) return -EFAULT; + if (ibt_get_clear_wait_endbr()) + uc_flags |= UC_WAIT_ENDBR; + if (!user_access_begin(frame, sizeof(*frame))) return -EFAULT; @@ -348,9 +358,8 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig, /* Create the ucontext. */ if (static_cpu_has(X86_FEATURE_XSAVE)) - unsafe_put_user(UC_FP_XSTATE, &frame->uc.uc_flags, Efault); - else - unsafe_put_user(0, &frame->uc.uc_flags, Efault); + uc_flags |= UC_FP_XSTATE; + unsafe_put_user(uc_flags, &frame->uc.uc_flags, Efault); unsafe_put_user(0, &frame->uc.uc_link, Efault); unsafe_compat_save_altstack(&frame->uc.uc_stack, regs->sp, Efault); diff --git a/arch/x86/include/asm/cet.h b/arch/x86/include/asm/cet.h index 3dfca29a7c0b..2618faf3fda5 100644 --- a/arch/x86/include/asm/cet.h +++ b/arch/x86/include/asm/cet.h @@ -46,9 +46,13 @@ static inline int restore_signal_shadow_stack(void) { return 0; } #ifdef CONFIG_X86_IBT int ibt_setup(void); void ibt_disable(void); +int ibt_get_clear_wait_endbr(void); +int ibt_set_wait_endbr(void); #else static inline int ibt_setup(void) { return 0; } static inline void ibt_disable(void) {} +static inline int ibt_get_clear_wait_endbr(void) { return 0; } +static inline int ibt_set_wait_endbr(void) { return 0; } #endif #ifdef CONFIG_X86_SHADOW_STACK diff --git a/arch/x86/include/uapi/asm/ucontext.h b/arch/x86/include/uapi/asm/ucontext.h index 5657b7a49f03..905419de2cc7 100644 --- a/arch/x86/include/uapi/asm/ucontext.h +++ b/arch/x86/include/uapi/asm/ucontext.h @@ -51,6 +51,11 @@ #define UC_STRICT_RESTORE_SS 0x4 #endif +/* + * Indicates IBT WAIT-ENDBR status. + */ +#define UC_WAIT_ENDBR 0x08 + #include #endif /* _ASM_X86_UCONTEXT_H */ diff --git a/arch/x86/kernel/ibt.c b/arch/x86/kernel/ibt.c index 629d4100fc40..c9c16d1cfe93 100644 --- a/arch/x86/kernel/ibt.c +++ b/arch/x86/kernel/ibt.c @@ -56,3 +56,39 @@ void ibt_disable(void) ibt_set_clear_msr_bits(0, CET_ENDBR_EN); current->thread.shstk.ibt = 0; } + +int ibt_get_clear_wait_endbr(void) +{ + u64 msr_val = 0; + + if (!current->thread.shstk.ibt) + return 0; + + fpregs_lock(); + + if (!test_thread_flag(TIF_NEED_FPU_LOAD)) { + if (!rdmsrl_safe(MSR_IA32_U_CET, &msr_val)) + wrmsrl(MSR_IA32_U_CET, msr_val & ~CET_WAIT_ENDBR); + } else { + struct cet_user_state *cet; + + cet = get_xsave_addr(¤t->thread.fpu.state.xsave, + XFEATURE_CET_USER); + if (cet) { + msr_val = cet->user_cet; + cet->user_cet = msr_val & ~CET_WAIT_ENDBR; + } + } + + fpregs_unlock(); + + return msr_val & CET_WAIT_ENDBR; +} + +int ibt_set_wait_endbr(void) +{ + if (!current->thread.shstk.ibt) + return 0; + + return ibt_set_clear_msr_bits(CET_WAIT_ENDBR, 0); +} diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index 4d42debbb5ef..903b10965cbe 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -135,6 +135,9 @@ static int restore_sigcontext(struct pt_regs *regs, */ if (unlikely(!(uc_flags & UC_STRICT_RESTORE_SS) && user_64bit_mode(regs))) force_valid_ss(regs); + + if (uc_flags & UC_WAIT_ENDBR) + ibt_set_wait_endbr(); #endif return fpu__restore_sig((void __user *)sc.fpstate, @@ -434,6 +437,9 @@ static unsigned long frame_uc_flags(struct pt_regs *regs) if (likely(user_64bit_mode(regs))) flags |= UC_STRICT_RESTORE_SS; + if (ibt_get_clear_wait_endbr()) + flags |= UC_WAIT_ENDBR; + return flags; } From patchwork Fri May 21 22:15:25 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273937 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7DF9C4707E for ; Fri, 21 May 2021 22:16:39 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 63A06613E3 for ; Fri, 21 May 2021 22:16:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 63A06613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id DEDFC8E006C; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id ADCFB8E0071; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9A30D8E006C; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0173.hostedemail.com [216.40.44.173]) by kanga.kvack.org (Postfix) with ESMTP id 6A64C8E006F for ; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 0FB5A180206D9 for ; Fri, 21 May 2021 22:16:33 +0000 (UTC) X-FDA: 78166648266.16.106ACA6 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf12.hostedemail.com (Postfix) with ESMTP id 29649D5 for ; Fri, 21 May 2021 22:16:28 +0000 (UTC) IronPort-SDR: F3zjC4XyELFnttUeojcLODJ3HCIoyfiDur90h4x4O6ZCEcFF62zmAyMJ2U2RksI4uuUB/vtogH PntAf57m1lZQ== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500979" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500979" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 IronPort-SDR: FTWqQse4Z1XOG06To4nu/vjIPTzNMNKUsrouqC5XU9w7sKSPcbdVsSgFbROWG09zsvdcLh0OVx /8W8enjcF2XA== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269439" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 04/10] x86/cet/ibt: Disable IBT for ia32 Date: Fri, 21 May 2021 15:15:25 -0700 Message-Id: <20210521221531.30168-5-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf12.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf12.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 29649D5 X-Stat-Signature: p8m13nbwfkcz3x3z1hgdqg9sto4nywbh X-HE-Tag: 1621635388-609563 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: In a signal, a task's IBT status needs to be saved to the signal frame, and later restored in sigreturn. For the purpose, previous versions of the series add a new struct to the signal frame. However, a new signal frame format (or re-using a reserved space) introduces complex compatibility issues. In the discussion (see link below), Andy Lutomirski proposed using a ucontext flag. The approach is clean and eliminates most compatibility issues. However, a legacy IA32 signal frame does not have ucontext and cannot support a uc flag. Thus, - Disable IBT for ia32. - In ia32 sigreturn, verify ibt is disabled. Signed-off-by: Yu-cheng Yu Cc: Andy Lutomirski Cc: Cyrill Gorcunov Cc: Florian Weimer Cc: H. Peter Anvin Cc: Kees Cook Link: https://lore.kernel.org/linux-api/f6e61dae-9805-c855-8873-7481ceb7ea79@intel.com/ --- arch/x86/ia32/ia32_signal.c | 7 +++++++ arch/x86/include/asm/elf.h | 13 ++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c index 77d0fa90cc19..946039cb3150 100644 --- a/arch/x86/ia32/ia32_signal.c +++ b/arch/x86/ia32/ia32_signal.c @@ -104,6 +104,13 @@ COMPAT_SYSCALL_DEFINE0(sigreturn) struct sigframe_ia32 __user *frame = (struct sigframe_ia32 __user *)(regs->sp-8); sigset_t set; + /* + * Verify legacy sigreturn does not have IBT enabled. + */ +#ifdef CONFIG_X86_IBT + if (current->thread.shstk.ibt) + goto badframe; +#endif if (!access_ok(frame, sizeof(*frame))) goto badframe; if (__get_user(set.sig[0], &frame->sc.oldmask) diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h index 2fe94efe1c0c..eef78b795b1e 100644 --- a/arch/x86/include/asm/elf.h +++ b/arch/x86/include/asm/elf.h @@ -6,6 +6,7 @@ * ELF register definitions.. */ #include +#include #include #include @@ -399,7 +400,17 @@ struct arch_elf_state { } #define arch_elf_pt_proc(ehdr, phdr, elf, interp, state) (0) -#define arch_check_elf(ehdr, interp, interp_ehdr, state) (0) +static inline int arch_check_elf(void *ehdr, bool interp, + void *interp_ehdr, + struct arch_elf_state *state) +{ + /* + * Disable IBT for ia32 + */ + if (elf_check_arch_ia32((struct elf32_hdr *)ehdr)) + state->gnu_property &= ~GNU_PROPERTY_X86_FEATURE_1_IBT; + return 0; +} /* Do not change the values. See get_align_mask() */ enum align_flags { From patchwork Fri May 21 22:15:26 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273939 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8DD2C4707E for ; Fri, 21 May 2021 22:16:41 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 594AE613E3 for ; Fri, 21 May 2021 22:16:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 594AE613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 105F08E006A; Fri, 21 May 2021 18:16:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 07C358E006F; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A65508E006A; Fri, 21 May 2021 18:16:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0105.hostedemail.com [216.40.44.105]) by kanga.kvack.org (Postfix) with ESMTP id 7149F8E0070 for ; Fri, 21 May 2021 18:16:33 -0400 (EDT) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 0399E5923C19 for ; Fri, 21 May 2021 22:16:33 +0000 (UTC) X-FDA: 78166648266.23.C3728A0 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf13.hostedemail.com (Postfix) with ESMTP id 39DBFE000800 for ; Fri, 21 May 2021 22:16:29 +0000 (UTC) IronPort-SDR: fGTPNSLmhAegSHpZFWpwQUd2RHX9Wns+LqH4BVEC1wiASmVW0A9twp3oWvSbRqa0XDCFlIc6qX b4aiv7DWaEpQ== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500981" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500981" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 IronPort-SDR: hyu6LDxqE7bbFOlgjYkanhZil89vEUluqIT/QYLYL6MAJnvV2JZuIE9NY6CClaH2AaqvUjkyLo lAWIoEyi3Zmg== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269442" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 05/10] x86/cet/ibt: Update ELF header parsing for Indirect Branch Tracking Date: Fri, 21 May 2021 15:15:26 -0700 Message-Id: <20210521221531.30168-6-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf13.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf13.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 39DBFE000800 X-Stat-Signature: jp5pr4cz8jeb5gm3tanbnph4ch7wfgow X-HE-Tag: 1621635389-56252 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: An ELF file's .note.gnu.property indicates features the file supports. The property is parsed at loading time and passed to arch_setup_elf_ property(). Update it for Indirect Branch Tracking. Signed-off-by: Yu-cheng Yu Cc: Kees Cook --- v27: - Remove selecting of ARCH_USE_GNU_PROPERTY and ARCH_BINFMT_ELF_STATE, since they are already selected by X86_64. arch/x86/kernel/process_64.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c index 1742c16945ef..607b782afe2c 100644 --- a/arch/x86/kernel/process_64.c +++ b/arch/x86/kernel/process_64.c @@ -860,6 +860,14 @@ int arch_setup_elf_property(struct arch_elf_state *state) if (state->gnu_property & GNU_PROPERTY_X86_FEATURE_1_SHSTK) r = shstk_setup(); } + + if (r < 0) + return r; + + if (cpu_feature_enabled(X86_FEATURE_IBT)) { + if (state->gnu_property & GNU_PROPERTY_X86_FEATURE_1_IBT) + r = ibt_setup(); + } #endif return r; From patchwork Fri May 21 22:15:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273941 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D2BAC04FF3 for ; Fri, 21 May 2021 22:16:43 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4C31E613E6 for ; Fri, 21 May 2021 22:16:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4C31E613E6 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 18EDC8E0073; Fri, 21 May 2021 18:16:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0F4CF8E006F; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E0FF68E0073; Fri, 21 May 2021 18:16:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0061.hostedemail.com [216.40.44.61]) by kanga.kvack.org (Postfix) with ESMTP id ADC308E006F for ; Fri, 21 May 2021 18:16:34 -0400 (EDT) Received: from smtpin11.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 54F62180199BD for ; Fri, 21 May 2021 22:16:34 +0000 (UTC) X-FDA: 78166648308.11.6F8BBF1 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf13.hostedemail.com (Postfix) with ESMTP id E63D2E000800 for ; Fri, 21 May 2021 22:16:29 +0000 (UTC) IronPort-SDR: 1fcR/VZ4UJkv+SjMlUFlKq13MbHiJsTpMvSOCXTRQhzgf7082x2rHKFL3URbUq2VH3eQ6Ysc7Y /Czriyu2Hf3w== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500982" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500982" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 IronPort-SDR: 6FPLG67WGIJ/ad6OETWV3vSK1kPZaiCDZqfLQpIwDoAKgpkklqNQvjZbrJYMbl0gX+Lw/VaLQk 6TASBfqAQUMg== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269450" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 06/10] x86/cet/ibt: Update arch_prctl functions for Indirect Branch Tracking Date: Fri, 21 May 2021 15:15:27 -0700 Message-Id: <20210521221531.30168-7-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf13.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf13.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: E63D2E000800 X-Stat-Signature: xsqrgf4kndcwddbe9gddzk1km6kbr9ji X-HE-Tag: 1621635389-77070 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: "H.J. Lu" Update ARCH_X86_CET_STATUS and ARCH_X86_CET_DISABLE for Indirect Branch Tracking. Signed-off-by: H.J. Lu Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook --- arch/x86/kernel/cet_prctl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kernel/cet_prctl.c b/arch/x86/kernel/cet_prctl.c index b426d200e070..bd3c80d402e7 100644 --- a/arch/x86/kernel/cet_prctl.c +++ b/arch/x86/kernel/cet_prctl.c @@ -22,6 +22,9 @@ static int cet_copy_status_to_user(struct thread_shstk *shstk, u64 __user *ubuf) buf[2] = shstk->size; } + if (shstk->ibt) + buf[0] |= GNU_PROPERTY_X86_FEATURE_1_IBT; + return copy_to_user(ubuf, buf, sizeof(buf)); } @@ -46,6 +49,8 @@ int prctl_cet(int option, u64 arg2) return -EINVAL; if (arg2 & GNU_PROPERTY_X86_FEATURE_1_SHSTK) shstk_disable(); + if (arg2 & GNU_PROPERTY_X86_FEATURE_1_IBT) + ibt_disable(); return 0; case ARCH_X86_CET_LOCK: From patchwork Fri May 21 22:15:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273943 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BFDDC04FF3 for ; Fri, 21 May 2021 22:16:45 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3CCC2613E6 for ; Fri, 21 May 2021 22:16:45 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3CCC2613E6 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 538F58E0071; Fri, 21 May 2021 18:16:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4C1B78E006F; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 18BA78E0071; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0054.hostedemail.com [216.40.44.54]) by kanga.kvack.org (Postfix) with ESMTP id CBC2C8E0071 for ; Fri, 21 May 2021 18:16:34 -0400 (EDT) Received: from smtpin03.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 68E7B181AEF3E for ; Fri, 21 May 2021 22:16:34 +0000 (UTC) X-FDA: 78166648308.03.EC1CBB4 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf12.hostedemail.com (Postfix) with ESMTP id DD7CDD5 for ; Fri, 21 May 2021 22:16:28 +0000 (UTC) IronPort-SDR: 2HeXkOYuQfwnRMDo3xx21T8ziGYJzImPG67JeTOywZjGCTzhnfwJ04hTwWsTa/DGvJWhbkwxap 4gvcjTd33sTA== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500984" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500984" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 IronPort-SDR: co53eXo5DCDvsGJPFWwC71Lst/q8q8N/PIyeP/SiYADLSp5k36fV2vi7D+w/hLNdQVqt9B2AEY 4YqJsp9Ihvhg== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269453" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:29 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 07/10] x86/vdso: Insert endbr32/endbr64 to vDSO Date: Fri, 21 May 2021 15:15:28 -0700 Message-Id: <20210521221531.30168-8-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf12.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf12.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: DD7CDD5 X-Stat-Signature: 5aeecax8s7fn9idtmpi4cp5qhbri4zxp X-HE-Tag: 1621635388-88955 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: "H.J. Lu" When Indirect Branch Tracking (IBT) is enabled, vDSO entry points need ENDBR32/ENDBR64 as first instructions. Kconfig X86_IBT verifies compiler's -fcf-protection support. Update vDso Makefile to enable it. Signed-off-by: H.J. Lu Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook Cc: Andy Lutomirski --- arch/x86/entry/vdso/Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile index 05c4abc2fdfd..a773a5f03b63 100644 --- a/arch/x86/entry/vdso/Makefile +++ b/arch/x86/entry/vdso/Makefile @@ -93,6 +93,10 @@ endif $(vobjs): KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_LTO) $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS),$(KBUILD_CFLAGS)) $(CFL) +ifdef CONFIG_X86_IBT +$(vobjs) $(vobjs32): KBUILD_CFLAGS += -fcf-protection=branch +endif + # # vDSO code runs in userspace and -pg doesn't help with profiling anyway. # From patchwork Fri May 21 22:15:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273947 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EA15C4707E for ; Fri, 21 May 2021 22:16:47 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id B4E51613E3 for ; Fri, 21 May 2021 22:16:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B4E51613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 761DB8E006F; Fri, 21 May 2021 18:16:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 649408E0074; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 363CD8E0072; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0185.hostedemail.com [216.40.44.185]) by kanga.kvack.org (Postfix) with ESMTP id D226D8E0072 for ; Fri, 21 May 2021 18:16:34 -0400 (EDT) Received: from smtpin02.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 70B55824999B for ; Fri, 21 May 2021 22:16:34 +0000 (UTC) X-FDA: 78166648308.02.C0ADE0C Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf23.hostedemail.com (Postfix) with ESMTP id 89883A0001C1 for ; Fri, 21 May 2021 22:16:30 +0000 (UTC) IronPort-SDR: snsMhGdDX0XELX9QDpKSGuUTEPhaVhm2/lXnAFGQVkZmmT5iXq27th4mKWWwloaIsUmBQf4EGu PNeKUED0t+iQ== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500987" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500987" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 IronPort-SDR: x6ExHnwI+3hUto9HSvZGb6Gq/IO8/NiRup+pQksgpGux8t8CuBK432UCz09lC0A94rPySD80S8 i6Dc1Nlso6gw== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269459" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu , Jarkko Sakkinen Subject: [PATCH v27 08/10] x86/vdso: Introduce ENDBR macro Date: Fri, 21 May 2021 15:15:29 -0700 Message-Id: <20210521221531.30168-9-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf23.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf23.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 89883A0001C1 X-Stat-Signature: 8zcyb7xcpyg1cfbonqx9bebz6ffaew5m X-HE-Tag: 1621635390-611982 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: ENDBR is a special new instruction for the Indirect Branch Tracking (IBT) component of CET. IBT prevents attacks by ensuring that (most) indirect branches and function calls may only land at ENDBR instructions. Branches that don't follow the rules will result in control flow (#CF) exceptions. ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR instructions are inserted automatically by the compiler, but branch targets written in assembly must have ENDBR added manually. Introduce ENDBR64/ENDBR32 macros. Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Jarkko Sakkinen Cc: Peter Zijlstra --- arch/x86/include/asm/vdso.h | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h index 98aa103eb4ab..97358246e4c7 100644 --- a/arch/x86/include/asm/vdso.h +++ b/arch/x86/include/asm/vdso.h @@ -52,6 +52,24 @@ extern int map_vdso_once(const struct vdso_image *image, unsigned long addr); extern bool fixup_vdso_exception(struct pt_regs *regs, int trapnr, unsigned long error_code, unsigned long fault_addr); -#endif /* __ASSEMBLER__ */ +#else /* __ASSEMBLER__ */ + +/* + * ENDBR is an instruction for the Indirect Branch Tracking (IBT) component + * of CET. IBT prevents attacks by ensuring that (most) indirect branches + * function calls may only land at ENDBR instructions. Branches that don't + * follow the rules will result in control flow (#CF) exceptions. + * ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR + * instructions are inserted automatically by the compiler, but branch + * targets written in assembly must have ENDBR added manually. + */ +#ifdef CONFIG_X86_IBT +#define ENDBR64 endbr64 +#define ENDBR32 endbr32 +#else +#define ENDBR64 +#define ENDBR32 +#endif +#endif /* __ASSEMBLER__ */ #endif /* _ASM_X86_VDSO_H */ From patchwork Fri May 21 22:15:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273945 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4279C04FF3 for ; Fri, 21 May 2021 22:16:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 919BC613E3 for ; Fri, 21 May 2021 22:16:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 919BC613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id CB2E48E0075; Fri, 21 May 2021 18:16:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C8C8E8E0072; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ADD6F8E0075; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0045.hostedemail.com [216.40.44.45]) by kanga.kvack.org (Postfix) with ESMTP id 7EE358E0072 for ; Fri, 21 May 2021 18:16:35 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 23A77181AEF3E for ; Fri, 21 May 2021 22:16:35 +0000 (UTC) X-FDA: 78166648350.24.E22A9E5 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf13.hostedemail.com (Postfix) with ESMTP id 4A0BAE00013F for ; Fri, 21 May 2021 22:16:31 +0000 (UTC) IronPort-SDR: YcCJ/VJGqFp2YU57N/iLMcy7ff/9GkM8gcWTLJgvB3YNNh0Q7Sx83Iup1qhNPkArBy85wcBcy0 dvJTm+QZR3fQ== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500989" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500989" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 IronPort-SDR: /rk/XekRvxxa6kQ91PownmMdhpdvv8W1JSCZzq/hlvloHpBKbcOJG4SIFGMU+/pnzLEodLA8fn lbOPjpk81Mrw== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269466" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu Subject: [PATCH v27 09/10] x86/vdso/32: Add ENDBR to __kernel_vsyscall entry point Date: Fri, 21 May 2021 15:15:30 -0700 Message-Id: <20210521221531.30168-10-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf13.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf13.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 4A0BAE00013F X-Stat-Signature: jm1no7sametz1ecptuya18ed6i6suwxd X-HE-Tag: 1621635391-46079 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: "H.J. Lu" ENDBR is a special new instruction for the Indirect Branch Tracking (IBT) component of CET. IBT prevents attacks by ensuring that (most) indirect branches and function calls may only land at ENDBR instructions. Branches that don't follow the rules will result in control flow (#CF) exceptions. ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR instructions are inserted automatically by the compiler, but branch targets written in assembly must have ENDBR added manually. Add that to __kernel_vsyscall entry point. Signed-off-by: H.J. Lu Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook Cc: Andy Lutomirski --- arch/x86/entry/vdso/vdso32/system_call.S | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/entry/vdso/vdso32/system_call.S b/arch/x86/entry/vdso/vdso32/system_call.S index 6ddd7a937b3e..d321c2ded33a 100644 --- a/arch/x86/entry/vdso/vdso32/system_call.S +++ b/arch/x86/entry/vdso/vdso32/system_call.S @@ -7,6 +7,7 @@ #include #include #include +#include .text .globl __kernel_vsyscall @@ -14,6 +15,7 @@ ALIGN __kernel_vsyscall: CFI_STARTPROC + ENDBR32 /* * Reshuffle regs so that all of any of the entry instructions * will preserve enough state. From patchwork Fri May 21 22:15:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12273949 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3C7FC4707A for ; Fri, 21 May 2021 22:16:50 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7418C613E3 for ; Fri, 21 May 2021 22:16:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7418C613E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 118778E0074; Fri, 21 May 2021 18:16:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0F1DC8E0072; Fri, 21 May 2021 18:16:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CFE818E0076; Fri, 21 May 2021 18:16:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0088.hostedemail.com [216.40.44.88]) by kanga.kvack.org (Postfix) with ESMTP id 982AE8E0074 for ; Fri, 21 May 2021 18:16:35 -0400 (EDT) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 3E9525820 for ; Fri, 21 May 2021 22:16:35 +0000 (UTC) X-FDA: 78166648350.18.6E4F422 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf12.hostedemail.com (Postfix) with ESMTP id 4C0B52D2 for ; Fri, 21 May 2021 22:16:30 +0000 (UTC) IronPort-SDR: iOIFr0rqYuooHjaJAhVLv9m1vLO/24k6JdoU5xpv3+ckbLzq/DK8VNCROES8utocXx9yUWmM1I eoPyTNhdWExA== X-IronPort-AV: E=McAfee;i="6200,9189,9991"; a="198500992" X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="198500992" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 IronPort-SDR: 1l69DAZyY78End//6ty+lXDAXAR/M4LFGsFa5D08zBRC6f/uigwN86g4Ts7u9QzSGnVqiSUIaU Py/4i8avNqnA== X-IronPort-AV: E=Sophos;i="5.82,319,1613462400"; d="scan'208";a="441269472" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 May 2021 15:16:30 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu , Jarkko Sakkinen Subject: [PATCH v27 10/10] x86/vdso: Add ENDBR to __vdso_sgx_enter_enclave Date: Fri, 21 May 2021 15:15:31 -0700 Message-Id: <20210521221531.30168-11-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210521221531.30168-1-yu-cheng.yu@intel.com> References: <20210521221531.30168-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 Authentication-Results: imf12.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf12.hostedemail.com: domain of yu-cheng.yu@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=yu-cheng.yu@intel.com X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 4C0B52D2 X-Stat-Signature: i34esb6eq4ow5nn3puc6afshud7txpdm X-HE-Tag: 1621635390-585115 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: ENDBR is a special new instruction for the Indirect Branch Tracking (IBT) component of CET. IBT prevents attacks by ensuring that (most) indirect branches and function calls may only land at ENDBR instructions. Branches that don't follow the rules will result in control flow (#CF) exceptions. ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR instructions are inserted automatically by the compiler, but branch targets written in assembly must have ENDBR added manually. Add ENDBR to __vdso_sgx_enter_enclave() branch targets. Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Jarkko Sakkinen Cc: Peter Zijlstra Acked-by: Jarkko Sakkinen --- arch/x86/entry/vdso/vsgx.S | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/entry/vdso/vsgx.S b/arch/x86/entry/vdso/vsgx.S index 99dafac992e2..c7cb85d57b3f 100644 --- a/arch/x86/entry/vdso/vsgx.S +++ b/arch/x86/entry/vdso/vsgx.S @@ -4,6 +4,7 @@ #include #include #include +#include #include "extable.h" @@ -27,6 +28,7 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave) /* Prolog */ .cfi_startproc + ENDBR64 push %rbp .cfi_adjust_cfa_offset 8 .cfi_rel_offset %rbp, 0 @@ -62,6 +64,7 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave) .Lasync_exit_pointer: .Lenclu_eenter_eresume: enclu + ENDBR64 /* EEXIT jumps here unless the enclave is doing something fancy. */ mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx @@ -91,6 +94,7 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave) jmp .Lout .Lhandle_exception: + ENDBR64 mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx /* Set the exception info. */