From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F388C433F5 for ; Mon, 3 Oct 2022 22:52:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 18A946B0071; Mon, 3 Oct 2022 18:52:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 13CA86B0073; Mon, 3 Oct 2022 18:52:04 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EF8916B0074; Mon, 3 Oct 2022 18:52:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id DA7C06B0071 for ; Mon, 3 Oct 2022 18:52:03 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id AC9EA1C625C for ; Mon, 3 Oct 2022 22:52:03 +0000 (UTC) X-FDA: 79981137726.03.D7F1FCD Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf16.hostedemail.com (Postfix) with ESMTP id 453DB18000A for ; Mon, 3 Oct 2022 22:52:03 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 59FA061212; Mon, 3 Oct 2022 22:52:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F4163C433D6; Mon, 3 Oct 2022 22:51:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1664837521; bh=YuqryQv+2VNLlqIKzcek0mnAh0zfi2NsIbmmJLKzIRA=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=fFJZh/VJU83iUHZkS1ckcVz9uuKC1SHc2RoBtYifsLyr2S9vDllUF7vehaknkYoqn 898ArZtex0fetHKUzLGBI79OcxwFo9rG+wUWKdb87egTES03XOrbNTJlIGZQi41onI pX/TDLMBHeBhxdjvdUcJrdpgM+9IA9V3nyx+ua8Gml6Pum9xauSacbKS7So75kCxF9 +Tze+CwIkZktGNvvXuz3Ln+FFrZ/LZmz2mqJF6P/vvB2JaYBl1pUkenR60VKWNEazr GG1c7abCwNef2Fkr+2j2wrOG+aivL3mXNbHpxzNzbG8AjnqYy8f499ezYV3uJfbTZL 7vYY4GjZiozhw== Message-ID: <4e145653-a62c-e4ea-dfa7-f18c0282c315@kernel.org> Date: Mon, 3 Oct 2022 15:51:59 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.12.0 Subject: Re: [PATCH v2 07/39] x86/cet: Add user control-protection fault handler Content-Language: en-US To: Rick Edgecombe , x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V . Shankar" , Weijiang Yang , "Kirill A . Shutemov" , joao.moreira@intel.com, John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com Cc: Yu-cheng Yu , Michael Kerrisk References: <20220929222936.14584-1-rick.p.edgecombe@intel.com> <20220929222936.14584-8-rick.p.edgecombe@intel.com> From: Andy Lutomirski In-Reply-To: <20220929222936.14584-8-rick.p.edgecombe@intel.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1664837523; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=DIgw3BtIuMB098eeYJajLhR7Ra3FEF6fyj6Onx3k0tI=; b=ppBmfXDC+JaNuWWvEOnMb1TEwpIWAs3oDCHejg1bkZLp5mydhcK1hIg42miUmel3NyQzzW +I6+rR7wQ6QTt9jUGNm6Vh+hSrJtMSWCm7d+EU/+rQi1dDt4I/+5wuis9MICjfFMf20mQc Y5ewbrSzsYLCwrZ8ESHEuu13NjQCFvI= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="fFJZh/VJ"; spf=pass (imf16.hostedemail.com: domain of luto@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=luto@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1664837523; a=rsa-sha256; cv=none; b=geP0gHKRGu44KO1w5T8vCt1Qu03YO+zXO0dv3p7aLNY17xr0WGBVi7KBMYqifEhBrM8aGX MjF0YwuaSR9hQGnJjUCEOxvrJqSs/w2/c1XjlhV10rmaWya98uYBLToI4hfBy7SLwHOT7m Wp4TIh/EdNfJj3229i5HvIs0JMBqqSo= X-Stat-Signature: h3teckxiyirq63p7r7w8rd5khsubgydo X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 453DB18000A Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="fFJZh/VJ"; spf=pass (imf16.hostedemail.com: domain of luto@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=luto@kernel.org; dmarc=pass (policy=none) header.from=kernel.org X-Rspam-User: X-HE-Tag: 1664837523-734025 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 9/29/22 15:29, Rick Edgecombe wrote: > From: Yu-cheng Yu > > +static void do_user_control_protection_fault(struct pt_regs *regs, > + unsigned long error_code) > { > - if (!cpu_feature_enabled(X86_FEATURE_IBT)) { > - pr_err("Unexpected #CP\n"); > - BUG(); > + struct task_struct *tsk; > + unsigned long ssp; > + > + /* Read SSP before enabling interrupts. */ > + rdmsrl(MSR_IA32_PL3_SSP, ssp); > + > + cond_local_irq_enable(regs); I feel like I'm missing something. Either PL3_SSL is context switched correctly and reading it with IRQs off is useless, or it's not context switched, and I'm very confused. Please either improve the comment or move it after the cond_local_irq_enable(). --Andy > + > + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) > + WARN_ONCE(1, "User-mode control protection fault with shadow support disabled\n"); > + > + tsk = current; > + tsk->thread.error_code = error_code; > + tsk->thread.trap_nr = X86_TRAP_CP; > + > + /* Ratelimit to prevent log spamming. */ > + if (show_unhandled_signals && unhandled_signal(tsk, SIGSEGV) && > + __ratelimit(&cpf_rate)) { > + unsigned int cpec; > + > + cpec = error_code & CP_EC; > + if (cpec >= ARRAY_SIZE(control_protection_err)) > + cpec = 0; > + > + pr_emerg("%s[%d] control protection ip:%lx sp:%lx ssp:%lx error:%lx(%s)%s", > + tsk->comm, task_pid_nr(tsk), > + regs->ip, regs->sp, ssp, error_code, > + control_protection_err[cpec], > + error_code & CP_ENCL ? " in enclave" : ""); > + print_vma_addr(KERN_CONT " in ", regs->ip); > + pr_cont("\n"); > } > > - if (WARN_ON_ONCE(user_mode(regs) || (error_code & CP_EC) != CP_ENDBR)) > - return; > + force_sig_fault(SIGSEGV, SEGV_CPERR, (void __user *)0); > + cond_local_irq_disable(regs); > +} > +#else > +static void do_user_control_protection_fault(struct pt_regs *regs, > + unsigned long error_code) > +{ > + WARN_ONCE(1, "User-mode control protection fault with shadow support disabled\n"); > +} > +#endif > + > +#ifdef CONFIG_X86_KERNEL_IBT > + > +static __ro_after_init bool ibt_fatal = true; > + > +extern void ibt_selftest_ip(void); /* code label defined in asm below */ > > +static void do_kernel_control_protection_fault(struct pt_regs *regs) > +{ > if (unlikely(regs->ip == (unsigned long)&ibt_selftest_ip)) { > regs->ax = 0; > return; > @@ -283,9 +335,29 @@ static int __init ibt_setup(char *str) > } > > __setup("ibt=", ibt_setup); > - > +#else > +static void do_kernel_control_protection_fault(struct pt_regs *regs) > +{ > + WARN_ONCE(1, "Kernel-mode control protection fault with IBT disabled\n"); > +} > #endif /* CONFIG_X86_KERNEL_IBT */ > > +#if defined(CONFIG_X86_KERNEL_IBT) || defined(CONFIG_X86_SHADOW_STACK) > +DEFINE_IDTENTRY_ERRORCODE(exc_control_protection) > +{ > + if (!cpu_feature_enabled(X86_FEATURE_IBT) && > + !cpu_feature_enabled(X86_FEATURE_SHSTK)) { > + pr_err("Unexpected #CP\n"); > + BUG(); > + } > + > + if (user_mode(regs)) > + do_user_control_protection_fault(regs, error_code); > + else > + do_kernel_control_protection_fault(regs); > +} > +#endif /* defined(CONFIG_X86_KERNEL_IBT) || defined(CONFIG_X86_SHADOW_STACK) */ > + > #ifdef CONFIG_X86_F00F_BUG > void handle_invalid_op(struct pt_regs *regs) > #else > diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c > index 0ed2e487a693..57faa287163f 100644 > --- a/arch/x86/xen/enlighten_pv.c > +++ b/arch/x86/xen/enlighten_pv.c > @@ -628,7 +628,7 @@ static struct trap_array_entry trap_array[] = { > TRAP_ENTRY(exc_coprocessor_error, false ), > TRAP_ENTRY(exc_alignment_check, false ), > TRAP_ENTRY(exc_simd_coprocessor_error, false ), > -#ifdef CONFIG_X86_KERNEL_IBT > +#if defined(CONFIG_X86_KERNEL_IBT) || defined(CONFIG_X86_SHADOW_STACK) > TRAP_ENTRY(exc_control_protection, false ), > #endif > }; > diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S > index 6b4fdf6b9542..e45ff6300c7d 100644 > --- a/arch/x86/xen/xen-asm.S > +++ b/arch/x86/xen/xen-asm.S > @@ -148,7 +148,7 @@ xen_pv_trap asm_exc_page_fault > xen_pv_trap asm_exc_spurious_interrupt_bug > xen_pv_trap asm_exc_coprocessor_error > xen_pv_trap asm_exc_alignment_check > -#ifdef CONFIG_X86_KERNEL_IBT > +#if defined(CONFIG_X86_KERNEL_IBT) || defined(CONFIG_X86_SHADOW_STACK) > xen_pv_trap asm_exc_control_protection > #endif > #ifdef CONFIG_X86_MCE > diff --git a/include/uapi/asm-generic/siginfo.h b/include/uapi/asm-generic/siginfo.h > index ffbe4cec9f32..0f52d0ac47c5 100644 > --- a/include/uapi/asm-generic/siginfo.h > +++ b/include/uapi/asm-generic/siginfo.h > @@ -242,7 +242,8 @@ typedef struct siginfo { > #define SEGV_ADIPERR 7 /* Precise MCD exception */ > #define SEGV_MTEAERR 8 /* Asynchronous ARM MTE error */ > #define SEGV_MTESERR 9 /* Synchronous ARM MTE exception */ > -#define NSIGSEGV 9 > +#define SEGV_CPERR 10 /* Control protection fault */ > +#define NSIGSEGV 10 > > /* > * SIGBUS si_codes