Linux-api Archive on lore.kernel.org
 help / color / Atom feed
From: Yu-cheng Yu <yu-cheng.yu@intel.com>
To: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>,
	linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
	linux-mm@kvack.org, linux-arch@vger.kernel.org,
	linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>,
	Andy Lutomirski <luto@kernel.org>,
	Balbir Singh <bsingharora@gmail.com>,
	Borislav Petkov <bp@alien8.de>,
	Cyrill Gorcunov <gorcunov@gmail.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Eugene Syromiatnikov <esyr@redhat.com>,
	Florian Weimer <fweimer@redhat.com>,
	"H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>,
	Jonathan Corbet <corbet@lwn.net>,
	Kees Cook <keescook@chromium.org>,
	Mike Kravetz <mike.kravetz@oracle.com>,
	Nadav Amit <nadav.amit@gmail.com>,
	Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>,
	Peter Zijlstra <peterz@infradead.org>,
	Randy Dunlap <rdunlap@infradead.org>,
	"Ravi V. Shankar" <ravi.v.shankar@intel.com>,
	Vedvyas Shanbhogue <vedvyas.shanbhogue@intel.com>,
	Dave Martin <Dave.Martin@arm.com>,
	Weijiang Yang <weijiang.yang@intel.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Subject: [PATCH v12 0/8] Control-flow Enforcement: Indirect Branch Tracking
Date: Fri, 18 Sep 2020 12:23:04 -0700
Message-ID: <20200918192312.25978-1-yu-cheng.yu@intel.com> (raw)

Control-flow Enforcement (CET) is a new Intel processor feature that blocks
return/jump-oriented programming attacks.  Details are in "Intel 64 and
IA-32 Architectures Software Developer's Manual" [1].

This is the second part of CET and enables Indirect Branch Tracking (IBT).
It is built on top of the shadow stack series.

Changes in v12:

- Replace obj file list with $(vobjs) $(vobjs32) in VDSO Makefile.
- Disable vsyscall emulation only when it is attempted.
- Split out ptrace patch.

[1] Intel 64 and IA-32 Architectures Software Developer's Manual:

    https://software.intel.com/en-us/download/intel-64-and-ia-32-
    architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4

[2] Indirect Branch Tracking patches v11.

    https://lkml.kernel.org/r/20200825002645.3658-1-yu-cheng.yu@intel.com/

H.J. Lu (3):
  x86/cet/ibt: Update arch_prctl functions for Indirect Branch Tracking
  x86/vdso/32: Add ENDBR32 to __kernel_vsyscall entry point
  x86/vdso: Insert endbr32/endbr64 to vDSO

Yu-cheng Yu (5):
  x86/cet/ibt: Add Kconfig option for user-mode Indirect Branch Tracking
  x86/cet/ibt: User-mode Indirect Branch Tracking support
  x86/cet/ibt: Handle signals for Indirect Branch Tracking
  x86/cet/ibt: ELF header parsing for Indirect Branch Tracking
  x86: Disallow vsyscall emulation when CET is enabled

 arch/x86/Kconfig                              | 18 ++++++
 arch/x86/entry/vdso/Makefile                  |  4 ++
 arch/x86/entry/vdso/vdso32/system_call.S      |  3 +
 arch/x86/entry/vsyscall/vsyscall_64.c         |  9 +++
 arch/x86/include/asm/cet.h                    |  3 +
 arch/x86/include/asm/disabled-features.h      |  8 ++-
 arch/x86/kernel/cet.c                         | 60 ++++++++++++++++++-
 arch/x86/kernel/cet_prctl.c                   |  8 ++-
 arch/x86/kernel/cpu/common.c                  | 17 ++++++
 arch/x86/kernel/fpu/signal.c                  |  8 ++-
 arch/x86/kernel/process_64.c                  |  8 +++
 .../arch/x86/include/asm/disabled-features.h  |  8 ++-
 12 files changed, 146 insertions(+), 8 deletions(-)

-- 
2.21.0


             reply index

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-18 19:23 Yu-cheng Yu [this message]
2020-09-18 19:23 ` [PATCH v12 1/8] x86/cet/ibt: Add Kconfig option for user-mode " Yu-cheng Yu
2020-09-18 20:24   ` Randy Dunlap
2020-09-18 20:59     ` Pavel Machek
2020-09-18 21:08       ` H.J. Lu
2020-09-18 21:24         ` Pavel Machek
2020-09-18 21:36           ` H.J. Lu
2020-09-18 21:25       ` Yu, Yu-cheng
2020-09-18 21:40         ` Pavel Machek
2020-09-18 21:46           ` H.J. Lu
2020-09-18 22:03             ` Pavel Machek
2020-09-21 22:30           ` Yu, Yu-cheng
2020-09-21 22:41             ` Dave Hansen
2020-09-21 22:47               ` Yu, Yu-cheng
     [not found]                 ` <9cf234db-d0f7-0466-be2c-afe04eb76759@intel.com>
2020-09-21 23:27                   ` Yu, Yu-cheng
2020-09-21 22:52               ` Pavel Machek
2020-09-18 19:23 ` [PATCH v12 4/8] x86/cet/ibt: ELF header parsing for " Yu-cheng Yu
2020-09-18 19:23 ` [PATCH v12 5/8] x86/cet/ibt: Update arch_prctl functions " Yu-cheng Yu
2020-09-18 19:23 ` [PATCH v12 6/8] x86/vdso/32: Add ENDBR32 to __kernel_vsyscall entry point Yu-cheng Yu
2020-09-18 19:23 ` [PATCH v12 7/8] x86/vdso: Insert endbr32/endbr64 to vDSO Yu-cheng Yu
2020-09-18 19:23 ` [PATCH v12 8/8] x86: Disallow vsyscall emulation when CET is enabled Yu-cheng Yu
2020-09-18 19:32   ` Dave Hansen
2020-09-18 21:00     ` Pavel Machek
2020-09-18 21:06       ` H.J. Lu
2020-09-18 21:17         ` Dave Hansen
2020-09-18 21:22           ` H.J. Lu
2020-09-18 21:28             ` Dave Hansen
2020-09-18 21:21       ` Yu, Yu-cheng
2020-09-18 21:22         ` Pavel Machek
2020-09-19  0:11   ` Andy Lutomirski
2020-09-21 16:22     ` Yu, Yu-cheng
2020-09-21 22:37       ` Yu-cheng Yu
2020-09-21 23:48         ` Andy Lutomirski
2020-09-23 21:29           ` Sean Christopherson
     [not found]             ` <a2e872ef-5539-c7c1-49ca-95d590f3b92a@intel.com>
     [not found]               ` <e7c20f4c-23a0-4a34-3895-c4f60993ec41@intel.com>
2020-09-23 22:20                 ` Yu, Yu-cheng
2020-09-23 22:47                   ` Andy Lutomirski
2020-09-23 22:53                     ` Dave Hansen
     [not found]           ` <b3defc91-1e8e-d0d5-2ac3-3861a7e3355c@intel.com>
2020-09-23 21:34             ` Andy Lutomirski
2020-09-23 22:07               ` Yu, Yu-cheng

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200918192312.25978-1-yu-cheng.yu@intel.com \
    --to=yu-cheng.yu@intel.com \
    --cc=Dave.Martin@arm.com \
    --cc=arnd@arndb.de \
    --cc=bp@alien8.de \
    --cc=bsingharora@gmail.com \
    --cc=corbet@lwn.net \
    --cc=dave.hansen@linux.intel.com \
    --cc=esyr@redhat.com \
    --cc=fweimer@redhat.com \
    --cc=gorcunov@gmail.com \
    --cc=hjl.tools@gmail.com \
    --cc=hpa@zytor.com \
    --cc=jannh@google.com \
    --cc=keescook@chromium.org \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=luto@kernel.org \
    --cc=mike.kravetz@oracle.com \
    --cc=mingo@redhat.com \
    --cc=nadav.amit@gmail.com \
    --cc=oleg@redhat.com \
    --cc=pavel@ucw.cz \
    --cc=peterz@infradead.org \
    --cc=ravi.v.shankar@intel.com \
    --cc=rdunlap@infradead.org \
    --cc=tglx@linutronix.de \
    --cc=vedvyas.shanbhogue@intel.com \
    --cc=weijiang.yang@intel.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-api Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-api/0 linux-api/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-api linux-api/ https://lore.kernel.org/linux-api \
		linux-api@vger.kernel.org
	public-inbox-index linux-api

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-api


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git