[PATCH v24 3/9] x86/cet/ibt: Handle signals for Indirect Branch Tracking
From: Yu-cheng Yu <hidden>
Date: 2021-04-01 22:14:50
Also in:
linux-api, linux-arch, linux-mm, lkml
Subsystem:
the rest, x86 architecture (32-bit and 64-bit) · Maintainers:
Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen
When an indirect CALL/JMP instruction is executed and before it reaches the target, it is in 'WAIT_ENDBR' status, which can be read from MSR_IA32_U_CET. The status is part of a task's status before a signal is raised and preserved in the signal frame. It is restored for sigreturn. IBT state machine is described in Intel SDM Vol. 1, Sec. 18.3. Signed-off-by: Yu-cheng Yu <redacted> Cc: Kees Cook <redacted> --- v24: - Update for changes from splitting shadow stack and ibt. arch/x86/kernel/fpu/signal.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 2e56f2fe8be0..1f54c18607c9 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c@@ -71,16 +71,32 @@ int save_extra_state_to_sigframe(int ia32, void __user *fp, unsigned long restor return err; ext.ssp = token_addr; + } + if (new_ssp || cet->ibt_enabled) { fpregs_lock(); if (test_thread_flag(TIF_NEED_FPU_LOAD)) __fpregs_load_activate(); + if (new_ssp) wrmsrl(MSR_IA32_PL3_SSP, new_ssp); + + if (cet->ibt_enabled) { + u64 r; + + rdmsrl(MSR_IA32_U_CET, r); + + if (r & CET_WAIT_ENDBR) { + ext.wait_endbr = 1; + r &= ~CET_WAIT_ENDBR; + wrmsrl(MSR_IA32_U_CET, r); + } + } + fpregs_unlock(); } - if (ext.ssp) { + if (ext.ssp || cet->ibt_enabled) { void __user *p = fp; ext.total_size = sizeof(ext);
@@ -110,7 +126,8 @@ static int get_extra_state_from_sigframe(int ia32, void __user *fp, struct sc_ex if (!cpu_feature_enabled(X86_FEATURE_CET)) return 0; - if (!cet->shstk_size) + if (!cet->shstk_size && + !cet->ibt_enabled) return 0; memset(ext, 0, sizeof(*ext));
@@ -162,6 +179,13 @@ void restore_extra_state(struct sc_ext *sc_ext) msr_val |= CET_SHSTK_EN; } + if (cet->ibt_enabled) { + msr_val |= (CET_ENDBR_EN | CET_NO_TRACK_EN); + + if (sc_ext->wait_endbr) + msr_val |= CET_WAIT_ENDBR; + } + if (test_thread_flag(TIF_NEED_FPU_LOAD)) cet_user_state->user_cet = msr_val; else
@@ -626,7 +650,7 @@ static unsigned long fpu__alloc_sigcontext_ext(unsigned long sp) * sigcontext_ext is at: fpu + fpu_user_xstate_size + * FP_XSTATE_MAGIC2_SIZE, then aligned to 8. */ - if (cet->shstk_size) + if (cet->shstk_size || cet->ibt_enabled) sp -= (sizeof(struct sc_ext) + 8); #endif return sp;
--
2.21.0