lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 24 Aug 2020 17:26:38 -0700 From: Yu-cheng Yu <yu-cheng.yu@...el.com> To: x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org, linux-mm@...ck.org, linux-arch@...r.kernel.org, linux-api@...r.kernel.org, Arnd Bergmann <arnd@...db.de>, Andy Lutomirski <luto@...nel.org>, Balbir Singh <bsingharora@...il.com>, Borislav Petkov <bp@...en8.de>, Cyrill Gorcunov <gorcunov@...il.com>, Dave Hansen <dave.hansen@...ux.intel.com>, Eugene Syromiatnikov <esyr@...hat.com>, Florian Weimer <fweimer@...hat.com>, "H.J. Lu" <hjl.tools@...il.com>, Jann Horn <jannh@...gle.com>, Jonathan Corbet <corbet@....net>, Kees Cook <keescook@...omium.org>, Mike Kravetz <mike.kravetz@...cle.com>, Nadav Amit <nadav.amit@...il.com>, Oleg Nesterov <oleg@...hat.com>, Pavel Machek <pavel@....cz>, Peter Zijlstra <peterz@...radead.org>, Randy Dunlap <rdunlap@...radead.org>, "Ravi V. Shankar" <ravi.v.shankar@...el.com>, Vedvyas Shanbhogue <vedvyas.shanbhogue@...el.com>, Dave Martin <Dave.Martin@....com>, Weijiang Yang <weijiang.yang@...el.com> Cc: Yu-cheng Yu <yu-cheng.yu@...el.com> Subject: [PATCH v11 3/9] x86/cet/ibt: Handle signals for Indirect Branch Tracking An indirect CALL/JMP moves the indirect branch tracking (IBT) state machine to WAIT_ENDBR status until the instruction reaches an ENDBR opcode. If the CALL/JMP does not reach an ENDBR opcode, the processor raises a control- protection fault. WAIT_ENDBR status can be read from MSR_IA32_U_CET. WAIT_ENDBR is cleared for signal handling, and restored for sigreturn. IBT state machine is described in Intel SDM Vol. 1, Sec. 18.3. Signed-off-by: Yu-cheng Yu <yu-cheng.yu@...el.com> --- v9: - Fix missing WAIT_ENDBR in signal handling. arch/x86/kernel/cet.c | 27 +++++++++++++++++++++++++-- arch/x86/kernel/fpu/signal.c | 8 +++++--- 2 files changed, 30 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c index b1c122a5aef4..f783229460b6 100644 --- a/arch/x86/kernel/cet.c +++ b/arch/x86/kernel/cet.c @@ -309,6 +309,13 @@ void cet_restore_signal(struct sc_ext *sc_ext) msr_val |= CET_SHSTK_EN; } + if (cet->ibt_enabled) { + msr_val |= (CET_ENDBR_EN | CET_NO_TRACK_EN); + + if (sc_ext->wait_endbr) + msr_val |= CET_WAIT_ENDBR; + } + if (test_thread_flag(TIF_NEED_FPU_LOAD)) cet_user_state->user_cet = msr_val; else @@ -349,9 +356,25 @@ int cet_setup_signal(bool ia32, unsigned long rstor_addr, struct sc_ext *sc_ext) sc_ext->ssp = new_ssp; } - if (ssp) { + if (ssp || cet->ibt_enabled) { + start_update_msrs(); - wrmsrl(MSR_IA32_PL3_SSP, ssp); + + if (ssp) + wrmsrl(MSR_IA32_PL3_SSP, ssp); + + if (cet->ibt_enabled) { + u64 r; + + rdmsrl(MSR_IA32_U_CET, r); + + if (r & CET_WAIT_ENDBR) { + sc_ext->wait_endbr = 1; + r &= ~CET_WAIT_ENDBR; + wrmsrl(MSR_IA32_U_CET, r); + } + } + end_update_msrs(); } diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index d02ea8c11128..a4d66fa69c1c 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -57,7 +57,8 @@ int save_cet_to_sigframe(int ia32, void __user *fp, unsigned long restorer) { int err = 0; - if (!current->thread.cet.shstk_size) + if (!current->thread.cet.shstk_size && + !current->thread.cet.ibt_enabled) return 0; if (fp) { @@ -89,7 +90,8 @@ static int get_cet_from_sigframe(int ia32, void __user *fp, struct sc_ext *ext) memset(ext, 0, sizeof(*ext)); - if (!current->thread.cet.shstk_size) + if (!current->thread.cet.shstk_size && + !current->thread.cet.ibt_enabled) return 0; if (fp) { @@ -577,7 +579,7 @@ static unsigned long fpu__alloc_sigcontext_ext(unsigned long sp) * sigcontext_ext is at: fpu + fpu_user_xstate_size + * FP_XSTATE_MAGIC2_SIZE, then aligned to 8. */ - if (cet->shstk_size) + if (cet->shstk_size || cet->ibt_enabled) sp -= (sizeof(struct sc_ext) + 8); return sp; -- 2.21.0
Powered by blists - more mailing lists