Received: by 2002:a05:6a10:22f:0:0:0:0 with SMTP id 15csp4008484pxk; Tue, 29 Sep 2020 11:41:16 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyJx+xvO1gZIGSvFmcPF27BoAJdXcUpuqMRMYLLSm2nV9Qx0H4a+Wx3KE+ETwhQ6a7dA289 X-Received: by 2002:a50:c8cd:: with SMTP id k13mr4809153edh.387.1601404875892; Tue, 29 Sep 2020 11:41:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1601404875; cv=none; d=google.com; s=arc-20160816; b=Wr4h7meG9uLBg6TmcfwfKGPnJasDxpubvu1l3rPjxdyj3WV1zNLCyfgnLjgtyhF6X6 iKWWkn3nh5gHg7JO9+ofSP+0UpL+l5zwl+clPxsmID2VIfqLOxcBy9BAuMQRK9GiRGtR zche8d34pYra5Ff/wE7vg+PXhANEjhCfZtwmJmC8PXjL0AeCP5tPeFECX0qLDE4rIfJo dJ5GkC+GL+hnV+t6Eo/jEqOMXXZallJC5SYxD9GBijQnjSmVNpatz1oRUzJhI4qaOnv6 1rl+WsqUS3Yg0bCqL2Q5RCXipX2rhczFHPt98F68g+MC8SH8PZLepTpzmEgYIXaWMONy Bz+w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:content-language :in-reply-to:mime-version:user-agent:date:message-id:from:references :cc:to:subject:ironport-sdr:ironport-sdr; bh=L0+88jpG/UQtFDQx9qcklgUyiugOJYP1J3VcJz3MT+Y=; b=uWYjjn1vm/hQaL+eEz2fXbmphCv4aQJG8Xg5nN8eIvvNrBWRD8h3u4J6RJnOd0KuWx EM4ILefcFfMLxIkWTTtp8Ea6lXRr+k2KWkf5goZykeChc+nU4FsfNS8IH/K4Nisjcx+W yFDRViHVFUVKFhjo5En16Gw8FIp/UsViZsFUwQWy6/fvgO07m8LaRjBarTqycArBvypd YQbxGapGDH9dGNmAA7kL3bLldj2f5/5P5WF7HEu7ghSING2VPT690djmQISbz8Wj0yWZ cf2vUJpWlMo9d+Fqj8E9YtQJHqOgk8et1CbAgEcWeuVFreHJj4kf/t2dloznVlaxv79y YTZQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id a16si3564762ejk.665.2020.09.29.11.40.52; Tue, 29 Sep 2020 11:41:15 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728456AbgI2ShW (ORCPT + 99 others); Tue, 29 Sep 2020 14:37:22 -0400 Received: from mga14.intel.com ([192.55.52.115]:40268 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727740AbgI2ShW (ORCPT ); Tue, 29 Sep 2020 14:37:22 -0400 IronPort-SDR: YFXuKotdLt7Url2oOI3K4vEt6J+WcS8pmldf61TdKOwxBqqwJ6zw5kbyuKiUGYYTCN3zC1xuoF 2nxDniGXmnOw== X-IronPort-AV: E=McAfee;i="6000,8403,9759"; a="161483164" X-IronPort-AV: E=Sophos;i="5.77,319,1596524400"; d="scan'208";a="161483164" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Sep 2020 11:37:22 -0700 IronPort-SDR: Mj/KOp4W0zQLSYgXIcIgO1KumZzF8lg7j9lzm+HKUzibluw1cpzsR/McLT5193vD4Pv1dhgAc/ qF/9GFzXl4KQ== X-IronPort-AV: E=Sophos;i="5.77,319,1596524400"; d="scan'208";a="340957279" Received: from yyu32-mobl1.amr.corp.intel.com (HELO [10.212.63.108]) ([10.212.63.108]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Sep 2020 11:37:20 -0700 Subject: Re: [PATCH v13 8/8] x86/vsyscall/64: Fixup Shadow Stack and Indirect Branch Tracking for vsyscall emulation To: Andy Lutomirski Cc: X86 ML , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , LKML , "open list:DOCUMENTATION" , Linux-MM , linux-arch , Linux API , Arnd Bergmann , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu References: <99B32E59-CFF2-4756-89BD-AEA0021F355F@amacapital.net> From: "Yu, Yu-cheng" Message-ID: Date: Tue, 29 Sep 2020 11:37:19 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 9/28/2020 10:37 AM, Andy Lutomirski wrote: > On Mon, Sep 28, 2020 at 9:59 AM Yu-cheng Yu wrote: >> >> On Fri, 2020-09-25 at 09:51 -0700, Andy Lutomirski wrote: >>>> On Sep 25, 2020, at 9:48 AM, Yu, Yu-cheng wrote: >> + >> + cet = get_xsave_addr(&fpu->state.xsave, XFEATURE_CET_USER); >> + if (!cet) { >> + /* >> + * This is an unlikely case where the task is >> + * CET-enabled, but CET xstate is in INIT. >> + */ >> + WARN_ONCE(1, "CET is enabled, but no xstates"); > > "unlikely" doesn't really cover this. > >> + fpregs_unlock(); >> + goto sigsegv; >> + } >> + >> + if (cet->user_ssp && ((cet->user_ssp + 8) < TASK_SIZE_MAX)) >> + cet->user_ssp += 8; > > This looks buggy. The condition should be "if SHSTK is on, then add 8 > to user_ssp". If the result is noncanonical, then some appropriate > exception should be generated, probably by the FPU restore code -- see > below. You should be checking the SHSTK_EN bit, not SSP. Updated. Is this OK? I will resend the whole series later. Thanks, Yu-cheng ====== From 09803e66dca38d7784e32687d0693550948199ed Mon Sep 17 00:00:00 2001 From: Yu-cheng Yu Date: Thu, 29 Nov 2018 14:15:38 -0800 Subject: [PATCH v13 8/8] x86/vsyscall/64: Fixup Shadow Stack and Indirect Branch Tracking for vsyscall emulation Vsyscall entry points are effectively branch targets. Mark them with ENDBR64 opcodes. When emulating the RET instruction, unwind shadow stack and reset IBT state machine. Signed-off-by: Yu-cheng Yu --- v13: - Check shadow stack address is canonical. - Change from writing to MSRs to writing to CET xstate. arch/x86/entry/vsyscall/vsyscall_64.c | 34 +++++++++++++++++++++++ arch/x86/entry/vsyscall/vsyscall_emu_64.S | 9 ++++++ arch/x86/entry/vsyscall/vsyscall_trace.h | 1 + 3 files changed, 44 insertions(+) diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c index 44c33103a955..30b166091d46 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -38,6 +38,9 @@ #include #include #include +#include +#include +#include #define CREATE_TRACE_POINTS #include "vsyscall_trace.h" @@ -286,6 +289,44 @@ bool emulate_vsyscall(unsigned long error_code, /* Emulate a ret instruction. */ regs->ip = caller; regs->sp += 8; + +#ifdef CONFIG_X86_CET + if (tsk->thread.cet.shstk_size || tsk->thread.cet.ibt_enabled) { + struct cet_user_state *cet; + struct fpu *fpu; + + fpu = &tsk->thread.fpu; + fpregs_lock(); + + if (!test_thread_flag(TIF_NEED_FPU_LOAD)) { + copy_fpregs_to_fpstate(fpu); + set_thread_flag(TIF_NEED_FPU_LOAD); + } + + cet = get_xsave_addr(&fpu->state.xsave, XFEATURE_CET_USER); + if (!cet) { + /* + * This should not happen. The task is + * CET-enabled, but CET xstate is in INIT. + */ + WARN_ONCE(1, "CET is enabled, but no xstates"); + fpregs_unlock(); + goto sigsegv; + } + + if (cet->user_cet & CET_SHSTK_EN) { + if (cet->user_ssp && (cet->user_ssp + 8 < TASK_SIZE_MAX)) + cet->user_ssp += 8; + } + + if (cet->user_cet & CET_ENDBR_EN) + cet->user_cet &= ~CET_WAIT_ENDBR; + + __fpu_invalidate_fpregs_state(fpu); + fpregs_unlock(); + } +#endif + return true; sigsegv: diff --git a/arch/x86/entry/vsyscall/vsyscall_emu_64.S b/arch/x86/entry/vsyscall/vsyscall_emu_64.S index 2e203f3a25a7..b2fa92104cdb 100644 --- a/arch/x86/entry/vsyscall/vsyscall_emu_64.S +++ b/arch/x86/entry/vsyscall/vsyscall_emu_64.S @@ -17,16 +17,25 @@ __PAGE_ALIGNED_DATA .type __vsyscall_page, @object __vsyscall_page: +#ifdef CONFIG_X86_BRANCH_TRACKING_USER + endbr64 +#endif mov $__NR_gettimeofday, %rax syscall ret .balign 1024, 0xcc +#ifdef CONFIG_X86_BRANCH_TRACKING_USER + endbr64 +#endif mov $__NR_time, %rax syscall ret .balign 1024, 0xcc +#ifdef CONFIG_X86_BRANCH_TRACKING_USER + endbr64 +#endif mov $__NR_getcpu, %rax syscall ret diff --git a/arch/x86/entry/vsyscall/vsyscall_trace.h b/arch/x86/entry/vsyscall/vsyscall_trace.h index 3c3f9765a85c..7aa2101ada44 100644 --- a/arch/x86/entry/vsyscall/vsyscall_trace.h +++ b/arch/x86/entry/vsyscall/vsyscall_trace.h @@ -25,6 +25,7 @@ TRACE_EVENT(emulate_vsyscall, #endif #undef TRACE_INCLUDE_PATH +#undef TRACE_INCLUDE_FILE #define TRACE_INCLUDE_PATH ../../arch/x86/entry/vsyscall/ #define TRACE_INCLUDE_FILE vsyscall_trace #include -- 2.21.0