From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F854C43461 for ; Thu, 15 Apr 2021 22:18:02 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D5FB3610F7 for ; Thu, 15 Apr 2021 22:18:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D5FB3610F7 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 4E6218E0012; Thu, 15 Apr 2021 18:17:53 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4BDBD8E0011; Thu, 15 Apr 2021 18:17:53 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 29E0D8D0011; Thu, 15 Apr 2021 18:17:53 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id EE40A8D0010 for ; Thu, 15 Apr 2021 18:17:52 -0400 (EDT) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id B4AC51838F849 for ; Thu, 15 Apr 2021 22:17:52 +0000 (UTC) X-FDA: 78036014784.17.5846E96 Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by imf21.hostedemail.com (Postfix) with ESMTP id CAAE0E000104 for ; Thu, 15 Apr 2021 22:17:49 +0000 (UTC) IronPort-SDR: Wh3N0lzMeorLkWquYhAGsyMtHMLxAoDfHrzWcPOy7lir+wDhNb/HE9G5aNxLAy/2f24E+TLAKq I8G/psbt+kYQ== X-IronPort-AV: E=McAfee;i="6200,9189,9955"; a="192826356" X-IronPort-AV: E=Sophos;i="5.82,225,1613462400"; d="scan'208";a="192826356" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Apr 2021 15:17:50 -0700 IronPort-SDR: jvncpkn+0Y4mW3Mj67y1BwFOj80I+L0IEb4TsI5vTU9NauLYFd2IEdcSYoQcDUuOavvBTgg7Mj ronHpvLY5BTg== X-IronPort-AV: E=Sophos;i="5.82,225,1613462400"; d="scan'208";a="399720985" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Apr 2021 15:17:48 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang Cc: Yu-cheng Yu , Jarkko Sakkinen Subject: [PATCH v25 7/9] x86/vdso: Introduce ENDBR macro Date: Thu, 15 Apr 2021 15:17:32 -0700 Message-Id: <20210415221734.32628-8-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20210415221734.32628-1-yu-cheng.yu@intel.com> References: <20210415221734.32628-1-yu-cheng.yu@intel.com> MIME-Version: 1.0 X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: CAAE0E000104 X-Stat-Signature: 5peky831wkbb4afjtpkujoceasy99mkc Received-SPF: none (intel.com>: No applicable sender policy available) receiver=imf21; identity=mailfrom; envelope-from=""; helo=mga04.intel.com; client-ip=192.55.52.120 X-HE-DKIM-Result: none/none X-HE-Tag: 1618525069-163022 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: ENDBR is a special new instruction for the Indirect Branch Tracking (IBT) component of CET. IBT prevents attacks by ensuring that (most) indirect branches and function calls may only land at ENDBR instructions. Branche= s that don't follow the rules will result in control flow (#CF) exceptions. ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR instructions are inserted automatically by the compiler, but branch targets written in assembly must have ENDBR added manually. There are two ENDBR versions: endbr64 and endbr32. The compilers (gcc an= d clang) have _CET_ENDBR defined for the proper one. Introduce ENDBR macro= , which equals the compiler macro when enabled, otherwise nothing. Signed-off-by: Yu-cheng Yu Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: Jarkko Sakkinen Cc: Peter Zijlstra --- v25: - Change from using the compiler's cet.h back to just ENDBR64/ENDBR32, since the information is already known, and keep it simple. arch/x86/include/asm/vdso.h | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h index 98aa103eb4ab..97358246e4c7 100644 --- a/arch/x86/include/asm/vdso.h +++ b/arch/x86/include/asm/vdso.h @@ -52,6 +52,24 @@ extern int map_vdso_once(const struct vdso_image *imag= e, unsigned long addr); extern bool fixup_vdso_exception(struct pt_regs *regs, int trapnr, unsigned long error_code, unsigned long fault_addr); -#endif /* __ASSEMBLER__ */ +#else /* __ASSEMBLER__ */ + +/* + * ENDBR is an instruction for the Indirect Branch Tracking (IBT) compon= ent + * of CET. IBT prevents attacks by ensuring that (most) indirect branch= es + * function calls may only land at ENDBR instructions. Branches that do= n't + * follow the rules will result in control flow (#CF) exceptions. + * ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR + * instructions are inserted automatically by the compiler, but branch + * targets written in assembly must have ENDBR added manually. + */ +#ifdef CONFIG_X86_IBT +#define ENDBR64 endbr64 +#define ENDBR32 endbr32 +#else +#define ENDBR64 +#define ENDBR32 +#endif =20 +#endif /* __ASSEMBLER__ */ #endif /* _ASM_X86_VDSO_H */ --=20 2.21.0