From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AE21C47420 for ; Mon, 28 Sep 2020 16:59:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id AF0632074F for ; Mon, 28 Sep 2020 16:59:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AF0632074F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0DE676B00A8; Mon, 28 Sep 2020 12:59:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 08FB36B00A9; Mon, 28 Sep 2020 12:59:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EBED56B00AA; Mon, 28 Sep 2020 12:59:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0165.hostedemail.com [216.40.44.165]) by kanga.kvack.org (Postfix) with ESMTP id D71706B00A8 for ; Mon, 28 Sep 2020 12:59:35 -0400 (EDT) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 95ED44DC0 for ; Mon, 28 Sep 2020 16:59:35 +0000 (UTC) X-FDA: 77313081510.27.shop22_450572327183 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin27.hostedemail.com (Postfix) with ESMTP id 639CF3D668 for ; Mon, 28 Sep 2020 16:59:35 +0000 (UTC) X-HE-Tag: shop22_450572327183 X-Filterd-Recvd-Size: 8419 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Mon, 28 Sep 2020 16:59:34 +0000 (UTC) IronPort-SDR: uKu3GHZaEnDlRlP3sLO+82lU5gyl6mj4oDxtnwTH6X7lodihEGr0nDGhT4ycCRH87aPv7+U5/l IFGEXEC1imxQ== X-IronPort-AV: E=McAfee;i="6000,8403,9758"; a="141434995" X-IronPort-AV: E=Sophos;i="5.77,313,1596524400"; d="scan'208";a="141434995" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Sep 2020 09:59:33 -0700 IronPort-SDR: v4S0BhB4JOt8w8+C6wAYJOzwxm6jJAdzApLEgaZKt1x4jjzcU6zXSSjhd5qg7rFNwc4DRjcrvM f41hiv4yqHjw== X-IronPort-AV: E=Sophos;i="5.77,313,1596524400"; d="scan'208";a="349910113" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Sep 2020 09:59:32 -0700 Message-ID: Subject: Re: [PATCH v13 8/8] x86/vsyscall/64: Fixup Shadow Stack and Indirect Branch Tracking for vsyscall emulation From: Yu-cheng Yu To: Andy Lutomirski Cc: Andy Lutomirski , X86 ML , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , LKML , "open list:DOCUMENTATION" , Linux-MM , linux-arch , Linux API , Arnd Bergmann , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu Date: Mon, 28 Sep 2020 09:59:24 -0700 In-Reply-To: <99B32E59-CFF2-4756-89BD-AEA0021F355F@amacapital.net> References: <99B32E59-CFF2-4756-89BD-AEA0021F355F@amacapital.net> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.32.5 (3.32.5-1.fc30) MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, 2020-09-25 at 09:51 -0700, Andy Lutomirski wrote: > > On Sep 25, 2020, at 9:48 AM, Yu, Yu-cheng wro= te: > >=20 > > =EF=BB=BFOn 9/25/2020 9:31 AM, Andy Lutomirski wrote: > > > > On Fri, Sep 25, 2020 at 7:58 AM Yu-cheng Yu wrote: > > > >=20 > >=20 > > [...] > >=20 > > > > @@ -286,6 +289,37 @@ bool emulate_vsyscall(unsigned long error_co= de, > > > > /* Emulate a ret instruction. */ > > > > regs->ip =3D caller; > > > > regs->sp +=3D 8; > > > > + > > > > +#ifdef CONFIG_X86_CET > > > > + if (tsk->thread.cet.shstk_size || tsk->thread.cet.ibt_ena= bled) { > > > > + struct cet_user_state *cet; > > > > + struct fpu *fpu; > > > > + > > > > + fpu =3D &tsk->thread.fpu; > > > > + fpregs_lock(); > > > > + > > > > + if (!test_thread_flag(TIF_NEED_FPU_LOAD)) { > > > > + copy_fpregs_to_fpstate(fpu); > > > > + set_thread_flag(TIF_NEED_FPU_LOAD); > > > > + } > > > > + > > > > + cet =3D get_xsave_addr(&fpu->state.xsave, XFEATUR= E_CET_USER); > > > > + if (!cet) { > > > > + fpregs_unlock(); > > > > + goto sigsegv; > > > I *think* your patchset tries to keep cet.shstk_size and > > > cet.ibt_enabled in sync with the MSR, in which case it should be > > > impossible to get here, but a comment and a warning would be much > > > better than a random sigsegv. > >=20 > > Yes, it should be impossible to get here. I will add a comment and a= warning, but still do sigsegv. Should this happen, and the function ret= urn, the app gets a control-protection fault. Why not let it fail early? >=20 > I=E2=80=99m okay with either approach as long as we get a comment and w= arning. >=20 Here is the updated patch. I can also re-send the whole series as v14. = Thanks! =3D=3D=3D=3D=3D=3D >From 09803e66dca38d7784e32687d0693550948199ed Mon Sep 17 00:00:00 2001 From: Yu-cheng Yu Date: Thu, 29 Nov 2018 14:15:38 -0800 Subject: [PATCH v13 8/8] x86/vsyscall/64: Fixup Shadow Stack and Indirect= Branch Tracking for vsyscall emulation Vsyscall entry points are effectively branch targets. Mark them with ENDBR64 opcodes. When emulating the RET instruction, unwind shadow stack and reset IBT state machine. Signed-off-by: Yu-cheng Yu --- v13: - Check shadow stack address is canonical. - Change from writing to MSRs to writing to CET xstate. arch/x86/entry/vsyscall/vsyscall_64.c | 34 +++++++++++++++++++++++ arch/x86/entry/vsyscall/vsyscall_emu_64.S | 9 ++++++ arch/x86/entry/vsyscall/vsyscall_trace.h | 1 + 3 files changed, 44 insertions(+) diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c index 44c33103a955..30b166091d46 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -38,6 +38,9 @@ #include #include #include +#include +#include +#include =20 #define CREATE_TRACE_POINTS #include "vsyscall_trace.h" @@ -286,6 +289,42 @@ bool emulate_vsyscall(unsigned long error_code, /* Emulate a ret instruction. */ regs->ip =3D caller; regs->sp +=3D 8; + +#ifdef CONFIG_X86_CET + if (tsk->thread.cet.shstk_size || tsk->thread.cet.ibt_enabled) { + struct cet_user_state *cet; + struct fpu *fpu; + + fpu =3D &tsk->thread.fpu; + fpregs_lock(); + + if (!test_thread_flag(TIF_NEED_FPU_LOAD)) { + copy_fpregs_to_fpstate(fpu); + set_thread_flag(TIF_NEED_FPU_LOAD); + } + + cet =3D get_xsave_addr(&fpu->state.xsave, XFEATURE_CET_USER); + if (!cet) { + /* + * This is an unlikely case where the task is + * CET-enabled, but CET xstate is in INIT. + */ + WARN_ONCE(1, "CET is enabled, but no xstates"); + fpregs_unlock(); + goto sigsegv; + } + + if (cet->user_ssp && ((cet->user_ssp + 8) < TASK_SIZE_MAX)) + cet->user_ssp +=3D 8; + + if (cet->user_cet & CET_ENDBR_EN) + cet->user_cet &=3D ~CET_WAIT_ENDBR; + + __fpu_invalidate_fpregs_state(fpu); + fpregs_unlock(); + } +#endif + return true; =20 sigsegv: diff --git a/arch/x86/entry/vsyscall/vsyscall_emu_64.S b/arch/x86/entry/vsyscall/vsyscall_emu_64.S index 2e203f3a25a7..b2fa92104cdb 100644 --- a/arch/x86/entry/vsyscall/vsyscall_emu_64.S +++ b/arch/x86/entry/vsyscall/vsyscall_emu_64.S @@ -17,16 +17,25 @@ __PAGE_ALIGNED_DATA .type __vsyscall_page, @object __vsyscall_page: =20 +#ifdef CONFIG_X86_BRANCH_TRACKING_USER + endbr64 +#endif mov $__NR_gettimeofday, %rax syscall ret =20 .balign 1024, 0xcc +#ifdef CONFIG_X86_BRANCH_TRACKING_USER + endbr64 +#endif mov $__NR_time, %rax syscall ret =20 .balign 1024, 0xcc +#ifdef CONFIG_X86_BRANCH_TRACKING_USER + endbr64 +#endif mov $__NR_getcpu, %rax syscall ret diff --git a/arch/x86/entry/vsyscall/vsyscall_trace.h b/arch/x86/entry/vsyscall/vsyscall_trace.h index 3c3f9765a85c..7aa2101ada44 100644 --- a/arch/x86/entry/vsyscall/vsyscall_trace.h +++ b/arch/x86/entry/vsyscall/vsyscall_trace.h @@ -25,6 +25,7 @@ TRACE_EVENT(emulate_vsyscall, #endif =20 #undef TRACE_INCLUDE_PATH +#undef TRACE_INCLUDE_FILE #define TRACE_INCLUDE_PATH ../../arch/x86/entry/vsyscall/ #define TRACE_INCLUDE_FILE vsyscall_trace #include --=20 2.21.0