linux-kernel - Re: [PATCH v2 00/39] x86: Kernel IBT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220224202602.3gvz5tnxvwb4maod@treble>
Date:   Thu, 24 Feb 2022 12:26:02 -0800
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     x86@...nel.org, joao@...rdrivepizza.com, hjl.tools@...il.com,
        andrew.cooper3@...rix.com, linux-kernel@...r.kernel.org,
        ndesaulniers@...gle.com, keescook@...omium.org,
        samitolvanen@...gle.com, mark.rutland@....com,
        alyssa.milburn@...el.com, mbenes@...e.cz, rostedt@...dmis.org,
        mhiramat@...nel.org, alexei.starovoitov@...il.com
Subject: Re: [PATCH v2 00/39] x86: Kernel IBT

On Thu, Feb 24, 2022 at 03:51:38PM +0100, Peter Zijlstra wrote:
> Hi,
> 
> This is an even more complete Kernel IBT implementation.
> 
> Since last time (in no specific order):
> 
>  - Reworked Xen and paravirt bits lots (andyhpp)
>  - Reworked entry annotation (jpoimboe)
>  - Renamed CONFIG symbol to CONFIG_X86_KERNEL_IBT (redgecomb)
>  - Pinned CR4_CET (kees)
>  - Added __noendbr to CET control functions (kees)
>  - kexec (redgecomb)
>  - made function-graph, kprobes and bpf not explode (rostedt)
>  - cleanups and split ups (jpoimboe, mbenes)
>  - reworked whole module objtool (nathanchance)
>  - attempted and failed at making Clang go
> 
> Specifically to clang; I made clang-13 explode by rediscovering:
> https://reviews.llvm.org/D111108, then I tried clang-14 but it looks like
> ld.lld is still generating .plt entries out of thin air.
> 
> Also, I know the very first patch is somewhat controversial amonst the clang
> people, but I really think the current state of affairs is abysmal and this
> lets me at least use clang.
> 
> Patches are also available here:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git x86/wip.ibt

Bricked my SPR:

[   21.602888] jump_label: Fatal kernel bug, unexpected op at sched_clock_stable+0x4/0x20 [0000000074a0db20] (eb 06 b8 01 00 != eb 0a 00 00 00)) size:2 type:0
[   21.618489] ------------[ cut here ]------------
[   21.623706] kernel BUG at arch/x86/kernel/jump_label.c:73!
[   21.629903] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[   21.630897] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G          I       5.17.0-rc5+ #3
[   21.630897] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0064.D15.2109031959 09/03/2021
[   21.630897] RIP: 0010:__jump_label_patch.cold.0+0x24/0x26
[   21.630897] Code: 9f e9 9d b1 5f ff 48 c7 c3 a8 44 65 a0 41 55 45 89 f1 49 89 d8 4c 89 e1 4c 89 e2 4c 89 e6 48 c7 c7 78 00 77 9f e8 e8 a8 00 00 <0f> 0b 48 89 fb 48 c7 c6 f0 03 77 9f 48 8d bf d0 00 00 00 e8 41 16
[   21.630897] RSP: 0000:ff7af25cc01cfd68 EFLAGS: 00010246
[   21.630897] RAX: 000000000000008f RBX: ffffffffa06544a8 RCX: 0000000000000001
[   21.630897] RDX: 0000000000000000 RSI: 00000000fffeffff RDI: 00000000ffffffff
[   21.630897] RBP: ff7af25cc01cfd98 R08: 0000000000000000 R09: c0000000fffeffff
[   21.630897] R10: 0000000000000001 R11: ff7af25cc01cfb88 R12: ffffffff9e520a74
[   21.630897] R13: 0000000000000000 R14: 0000000000000002 R15: ffffffff9f7293b7
[   21.630897] FS:  0000000000000000(0000) GS:ff422b3e2cc40000(0000) knlGS:0000000000000000
[   21.630897] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   21.630897] CR2: 0000000000000000 CR3: 0000001994810001 CR4: 0000000000f71ee0
[   21.630897] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   21.630897] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[   21.630897] PKRU: 55555554
[   21.630897] Call Trace:
[   21.630897]  <TASK>
[   21.630897]  arch_jump_label_transform_queue+0x37/0x80
[   21.630897]  __jump_label_update+0x74/0x130
[   21.630897]  ? sched_init+0x556/0x556
[   21.630897]  ? rdinit_setup+0x30/0x30
[   21.630897]  static_key_enable_cpuslocked+0x5b/0x90
[   21.630897]  static_key_enable+0x1a/0x20
[   21.630897]  sched_clock_init_late+0x7a/0x95
[   21.630897]  do_one_initcall+0x45/0x200
[   21.630897]  kernel_init_freeable+0x211/0x27a
[   21.630897]  ? rest_init+0xd0/0xd0
[   21.630897]  kernel_init+0x1a/0x130
[   21.630897]  ret_from_fork+0x1f/0x30
[   21.630897]  </TASK>
[   21.630897] Modules linked in:
[   21.838238] ---[ end trace 0000000000000000 ]---


ffffffff81120a70 <sched_clock_stable>:
ffffffff81120a70:       f3 0f 1e fa             endbr64
ffffffff81120a74:       eb 06                   jmp    ffffffff81120a7c <sched_clock_stable+0xc>
ffffffff81120a76:       b8 01 00 00 00          mov    $0x1,%eax
ffffffff81120a7b:       c3                      retq
ffffffff81120a7c:       f3 0f 1e fa             endbr64
ffffffff81120a80:       31 c0                   xor    %eax,%eax
ffffffff81120a82:       c3                      retq
ffffffff81120a83:       66 66 2e 0f 1f 84 00    data16 nopw %cs:0x0(%rax,%rax,1)
ffffffff81120a8a:       00 00 00 00
ffffffff81120a8e:       66 90                   xchg   %ax,%ax