--- v9
+++ v23
@@ -1,108 +1,95 @@
-Indirect Branch Tracking setting does not change in signal delivering or
-sigreturn; except the WAIT_ENDBR status.  In general, a task is in
-WAIT_ENDBR after an indirect CALL/JMP and before the next instruction
-starts.
+When an indirect CALL/JMP instruction is executed and before it reaches
+the target, it is in 'WAIT_ENDBR' status, which can be read from
+MSR_IA32_U_CET.  The status is part of a task's status before a signal is
+raised and preserved in the signal frame.  It is restored for sigreturn.
 
-WAIT_ENDBR status can be read from MSR_IA32_U_CET.  It is reset for signal
-delivering, but preserved on a task's stack and restored for sigreturn.
+IBT state machine is described in Intel SDM Vol. 1, Sec. 18.3.
 
-v9:
-- Fix missing WAIT_ENDBR in signal handling.
-
-Signed-off-by: Yu-cheng Yu <yu-cheng.yu-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
+Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
 ---
- arch/x86/kernel/cet.c        | 24 ++++++++++++++++++++++--
+ arch/x86/kernel/cet.c        | 26 ++++++++++++++++++++++++--
  arch/x86/kernel/fpu/signal.c |  8 +++++---
- 2 files changed, 27 insertions(+), 5 deletions(-)
+ 2 files changed, 29 insertions(+), 5 deletions(-)
 
 diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c
-index 26f5d7c4fbff..07864bef23f9 100644
+index 3361706ba950..34a26eb7f259 100644
 --- a/arch/x86/kernel/cet.c
 +++ b/arch/x86/kernel/cet.c
-@@ -280,7 +280,7 @@ int cet_restore_signal(bool ia32, struct sc_ext *sc_ext)
- 	u64 msr_val = 0;
- 	int err;
- 
--	if (!cet->shstk_enabled)
-+	if (!cet->shstk_enabled && !cet->ibt_enabled)
- 		return 0;
- 
- 	cet_user_state = get_xsave_addr(&current->thread.fpu.state.xsave,
-@@ -297,6 +297,16 @@ int cet_restore_signal(bool ia32, struct sc_ext *sc_ext)
- 		msr_val |= MSR_IA32_CET_SHSTK_EN;
+@@ -300,6 +300,13 @@ void cet_restore_signal(struct sc_ext *sc_ext)
+ 		msr_val |= CET_SHSTK_EN;
  	}
  
 +	if (cet->ibt_enabled) {
-+		msr_val |= (MSR_IA32_CET_ENDBR_EN | MSR_IA32_CET_NO_TRACK_EN);
-+
-+		if (cet->ibt_bitmap_used)
-+			msr_val |= (cet->ibt_bitmap_base | MSR_IA32_CET_LEG_IW_EN);
++		msr_val |= (CET_ENDBR_EN | CET_NO_TRACK_EN);
 +
 +		if (sc_ext->wait_endbr)
-+			msr_val |= MSR_IA32_CET_WAIT_ENDBR;
++			msr_val |= CET_WAIT_ENDBR;
 +	}
 +
- 	cet_user_state->user_cet = msr_val;
- 	return 0;
- }
-@@ -312,7 +322,7 @@ int cet_setup_signal(bool ia32, unsigned long rstor_addr, struct sc_ext *sc_ext)
- 	unsigned long ssp = 0, new_ssp = 0;
- 	int err;
- 
--	if (!cet->shstk_enabled)
-+	if (!cet->shstk_enabled && !cet->ibt_enabled)
- 		return 0;
- 
- 	if (cet->shstk_enabled) {
-@@ -339,6 +349,16 @@ int cet_setup_signal(bool ia32, unsigned long rstor_addr, struct sc_ext *sc_ext)
+ 	if (test_thread_flag(TIF_NEED_FPU_LOAD))
+ 		cet_user_state->user_cet = msr_val;
+ 	else
+@@ -340,9 +347,24 @@ int cet_setup_signal(bool ia32, unsigned long rstor_addr, struct sc_ext *sc_ext)
+ 		sc_ext->ssp = new_ssp;
  	}
  
- 	start_update_msrs();
-+	if (cet->ibt_enabled) {
-+		u64 r;
+-	if (ssp) {
++	if (ssp || cet->ibt_enabled) {
+ 		start_update_msrs();
+-		wrmsrl(MSR_IA32_PL3_SSP, ssp);
 +
-+		rdmsrl(MSR_IA32_U_CET, r);
-+		if (r & MSR_IA32_CET_WAIT_ENDBR) {
-+			sc_ext->wait_endbr = 1;
-+			wrmsrl(MSR_IA32_U_CET, r & ~MSR_IA32_CET_WAIT_ENDBR);
++		if (ssp)
++			wrmsrl(MSR_IA32_PL3_SSP, ssp);
++
++		if (cet->ibt_enabled) {
++			u64 r;
++
++			rdmsrl(MSR_IA32_U_CET, r);
++
++			if (r & CET_WAIT_ENDBR) {
++				sc_ext->wait_endbr = 1;
++				r &= ~CET_WAIT_ENDBR;
++				wrmsrl(MSR_IA32_U_CET, r);
++			}
 +		}
-+	}
 +
- 	if (cet->shstk_enabled)
- 		wrmsrl(MSR_IA32_PL3_SSP, ssp);
- 	end_update_msrs();
+ 		end_update_msrs();
+ 	}
+ 
 diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
-index 875cc0fadce3..1d8a75408b95 100644
+index 270e4649f435..b914d74c8ba6 100644
 --- a/arch/x86/kernel/fpu/signal.c
 +++ b/arch/x86/kernel/fpu/signal.c
-@@ -57,7 +57,8 @@ int save_cet_to_sigframe(void __user *fp, unsigned long restorer, int is_ia32)
+@@ -57,7 +57,8 @@ int save_cet_to_sigframe(int ia32, void __user *fp, unsigned long restorer)
+ {
  	int err = 0;
  
- #ifdef CONFIG_X86_INTEL_CET
--	if (!current->thread.cet.shstk_enabled)
-+	if (!current->thread.cet.shstk_enabled &&
+-	if (!current->thread.cet.shstk_size)
++	if (!current->thread.cet.shstk_size &&
 +	    !current->thread.cet.ibt_enabled)
  		return 0;
  
  	if (fp) {
-@@ -89,7 +90,8 @@ static int restore_cet_from_sigframe(int is_ia32, void __user *fp)
- 	int err = 0;
+@@ -89,7 +90,8 @@ static int get_cet_from_sigframe(int ia32, void __user *fp, struct sc_ext *ext)
  
- #ifdef CONFIG_X86_INTEL_CET
--	if (!current->thread.cet.shstk_enabled)
-+	if (!current->thread.cet.shstk_enabled &&
+ 	memset(ext, 0, sizeof(*ext));
+ 
+-	if (!current->thread.cet.shstk_size)
++	if (!current->thread.cet.shstk_size &&
 +	    !current->thread.cet.ibt_enabled)
  		return 0;
  
  	if (fp) {
-@@ -548,7 +550,7 @@ static unsigned long fpu__alloc_sigcontext_ext(unsigned long sp)
- 	if (cpu_x86_cet_enabled()) {
- 		struct cet_status *cet = &current->thread.cet;
+@@ -577,7 +579,7 @@ static unsigned long fpu__alloc_sigcontext_ext(unsigned long sp)
+ 	 * sigcontext_ext is at: fpu + fpu_user_xstate_size +
+ 	 * FP_XSTATE_MAGIC2_SIZE, then aligned to 8.
+ 	 */
+-	if (cet->shstk_size)
++	if (cet->shstk_size || cet->ibt_enabled)
+ 		sp -= (sizeof(struct sc_ext) + 8);
  
--		if (cet->shstk_enabled)
-+		if (cet->shstk_enabled || cet->ibt_enabled)
- 			sp -= (sizeof(struct sc_ext) + 8);
- 	}
- 
+ 	return sp;
 -- 
 2.21.0
+