From patchwork Tue Dec 19 16:07:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878050 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=Y6bnx5HM; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhSP1FR4z20Gb for ; Wed, 20 Dec 2023 03:08:21 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 30D76385E44B for ; Tue, 19 Dec 2023 16:08:19 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by sourceware.org (Postfix) with ESMTPS id 5BD293858417 for ; Tue, 19 Dec 2023 16:08:07 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 5BD293858417 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 5BD293858417 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::42a ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002090; cv=none; b=P8qWgW6oy2pFusg61A6x7cG9HybGObFXrce2VwQBe1CIJwIWiiXhkthbj1X+/L8wxym0/yvTsYcr4wgzmF12w/2MDq5G/3K17lN1S5SaTErQk+vI8/1KKRRkeBUc9roqucUyIGnrlHhjPBXnBbTiUHBXRImYK8V40rsfh/3Y6vw= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002090; c=relaxed/simple; bh=jxW/SkrVn18D8mOS3FpGySqq7q/7HGgXbFvR43enobU=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=yFSMJXTio4Gr4SQ8HERQuXraXf8Cz6Uphy2ALIQ/8twI5KUZEmW1ZjaNBZvj7ukHRE3XahfQpjB08FuoLb6T9010wwzdqvw32IwiAFk72M+++m+cJKZfpoYklNAzXVnuv7VtVc62aqOoeS9X6V0svAwZCSeZ/UrnfWrw/xbj5lM= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-6d7609cb6d2so1394182b3a.1 for ; Tue, 19 Dec 2023 08:08:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002086; x=1703606886; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qMvtHogobq6JlLL5ALFhdAK3OmuMdJlleYsUArs3zhg=; b=Y6bnx5HM687cWv2pR/3ngFIAUzI5aKyBaDHlP8Roq/sVFN0v+W+6CdwYLf0W57vrBW jF1SCunvLnQXNZ7jpGvKitpEzHmKhjiIw8FkeYECdA9t1DkE+mmiDdf6seo6vVR+7i8w 7NayPrSiWqy/r3ylOtnUnWtbzciT6PPHKdmHkJnzLD4FNPzmMs4GA37Z+nsAyTRmdohh bOoMFClnKrUVqnefuzX7yRnK12DLhQAv165gni6KsNa2Eorjo4wkbgIQvVAIEXh0zexx +ijAi1szTtT/epwuEuvh3h/2PEUmNeR6MHxLkfxwSAZDKHN1qnCvfHEu67HzPPgckSBc w0kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002086; x=1703606886; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qMvtHogobq6JlLL5ALFhdAK3OmuMdJlleYsUArs3zhg=; b=H5u3izpPVer9IwZfFjVNR7QIdGirToKOqbmKfplcM6XqVlbpMJhpU9bz3W/DHiqyhD qesmONEHKVMObzyNhgO2gOeq8LHT+YzAgBKHYRQnutJjn6iYov8pXUvk9a8D2q9MP7HC WkKqqIHmyKcoI3WRrcrww955R24rByhI6rT6FMZy5fk6ZooJsvrtWEhVFX1FcraTGH3y S1F1eNVfwamZPKE6tNoF+XWVlTUe6aCRMCFKQBmipSwJuXwjoYIRk1PsMNuEDSIpP4Bu ZnmzeusxAQtF0YkPqLXY8Vtza9nqC/PfEG3kDW5wZxr0bob8rnvya9DQ6IV/GNM6HEpr 8nZA== X-Gm-Message-State: AOJu0Yygtml9MPRS4yCAawMT7F6FndydKYRo6X6pM7kOXOPo6X2FN354 5D1h+1wwsU9+wpmGB59zKmpcPaCrvpQ= X-Google-Smtp-Source: AGHT+IG9+1Fl3IAKOReZo8Jb8WjsK4y37PT7qU+7G8+/tORHb7kBCUmGpPeskjXVT9SnsfFuMqqSIg== X-Received: by 2002:a05:6a21:1f03:b0:18f:97c:4f66 with SMTP id ry3-20020a056a211f0300b0018f097c4f66mr8853410pzb.114.1703002086254; Tue, 19 Dec 2023 08:08:06 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id s10-20020a056a0008ca00b006ce4965fdbdsm6478287pfu.116.2023.12.19.08.07.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:07:55 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 1E48F7403BA; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 1/9] x86/cet: Update tst-cet-vfork-1 Date: Tue, 19 Dec 2023 08:07:32 -0800 Message-ID: <20231219160740.3079330-2-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, KAM_NUMSUBJECT, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Change tst-cet-vfork-1.c to verify that vfork child return triggers SIGSEGV due to shadow stack mismatch. --- sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c | 43 ++++++++----------- 1 file changed, 17 insertions(+), 26 deletions(-) diff --git a/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c b/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c index 9c4b6f4d42..c92ed9e737 100644 --- a/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c +++ b/sysdeps/unix/sysv/linux/x86/tst-cet-vfork-1.c @@ -18,34 +18,26 @@ . */ #include -#include #include #include #include #include #include #include -#include -#include __attribute__ ((noclone, noinline)) static void do_test_1 (void) { pid_t p1; - int fd[2]; - if (pipe (fd) == -1) - { - puts ("pipe failed"); - _exit (EXIT_FAILURE); - } + /* NB: Since child return pops shadow stack which is shared with + parent, child must not return after vfork. */ if ((p1 = vfork ()) == 0) { - pid_t p = getpid (); - TEMP_FAILURE_RETRY (write (fd[1], &p, sizeof (p))); - /* Child return should trigger SIGSEGV. */ + /* Child return should trigger SIGSEGV due to shadow stack + mismatch. */ return; } else if (p1 == -1) @@ -54,22 +46,22 @@ do_test_1 (void) _exit (EXIT_FAILURE); } - pid_t p2 = 0; - if (TEMP_FAILURE_RETRY (read (fd[0], &p2, sizeof (pid_t))) - != sizeof (pid_t)) - puts ("pipd read failed"); - else + int r; + if (TEMP_FAILURE_RETRY (waitpid (p1, &r, 0)) != p1) { - int r; - if (TEMP_FAILURE_RETRY (waitpid (p1, &r, 0)) != p1) - puts ("waitpid failed"); - else if (r != 0) - puts ("pip write in child failed"); + puts ("waitpid failed"); + _exit (EXIT_FAILURE); + } + + if (!WIFSIGNALED (r) || WTERMSIG (r) != SIGSEGV) + { + puts ("Child not terminated with SIGSEGV"); + _exit (EXIT_FAILURE); } /* Parent exits immediately so that parent returns without triggering - SIGSEGV when shadow stack isn't in use. */ - _exit (EXIT_FAILURE); + SIGSEGV when shadow stack is in use. */ + _exit (EXIT_SUCCESS); } static int @@ -80,9 +72,8 @@ do_test (void) return EXIT_UNSUPPORTED; do_test_1 (); /* Child exits immediately so that child returns without triggering - SIGSEGV when shadow stack isn't in use. */ + SIGSEGV when shadow stack is in use. */ _exit (EXIT_FAILURE); } -#define EXPECTED_SIGNAL (_get_ssp () == 0 ? 0 : SIGSEGV) #include From patchwork Tue Dec 19 16:07:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878061 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=DwzldGKR; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhTS02SBz23p3 for ; Wed, 20 Dec 2023 03:09:15 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 165883861867 for ; Tue, 19 Dec 2023 16:09:13 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x436.google.com (mail-pf1-x436.google.com [IPv6:2607:f8b0:4864:20::436]) by sourceware.org (Postfix) with ESMTPS id 1603C385E00B for ; Tue, 19 Dec 2023 16:08:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 1603C385E00B Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 1603C385E00B Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::436 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002099; cv=none; b=WuGn/ywbiXW9ZNxkkzdpz3qQVK+yTvcDdKrJnRuy7vxZJRHjs6J5jJaqC6RRGkkWrJcfVqlnfLOTr1ETNCS5+0sanVvlL38lmBOHRMHjdOaw8oa9JilqpZIVYJfyUp4o2jTfFyieX4DgCXZwcmuLwhEv1KYUNwmzYXe4KdvQh68= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002099; c=relaxed/simple; bh=U7KtRUd4W+8d58U0hiS7FViS0HH/Rp0YE4Is1fguNT0=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=eQr1kyLwJ70jDYVpdoX5WiuRHS7sK2MTPrjJBf6EI/XftEFzzmg5BNxfrWFJ1pCOm32uvQJLFm8NdGYNSHqyo/R5B6UsHlhZ+eoTMw/kOaT3KIKWbT3sujthRrXQ8jVbsQGGeO9ulwfY575gR/O39miF6DXhudq+4e0l7NFOMWI= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x436.google.com with SMTP id d2e1a72fcca58-6d77c6437f0so1546768b3a.2 for ; Tue, 19 Dec 2023 08:08:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002096; x=1703606896; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=WokAJGlqrtoizPOZj4+PiZkzpP7EhDImCNe72omnP0M=; b=DwzldGKRifTT7vNLNNuLum3Bo3fAkoPPtcIAxqpez7/Yu4qY+LReUKI8+FRAeZd4Ss PObFa7txXMYaGuYcyiN7ap3xg5Doa9ei+AyokAhiPj7HLb1P/CAS1tbndjWtN9fF5EPY Su4d+IPdSTk4jmX2stAdSwx6VoTqZ25mD0zby4zBOkAQCEHvUOsZiIx7SVXWoSTXRbbh IKyRgSXMZPH4PWjWoqB6sRiY2eDNOEzfkkSTEOkFC3dth5NxvdVeNF3xDJ+z0FLtMApA NcyAY8Rc0F4g7wR1/P0Aq47VTxAxyQ+yr1E8kdKWCXZP3hidx3l5qH1zZkNSf1LZLDLp 4Apg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002096; x=1703606896; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=WokAJGlqrtoizPOZj4+PiZkzpP7EhDImCNe72omnP0M=; b=nc1+6uMGv5Yrb959Pwo3al3au5QWuyEel44TwcuHYB+psUBm4vyDiFHdr4SGQSRR9H O0Y73ZyP9i+eSSOVgsl2VOvuEbnXurqo7ZfJLIc1jZdQyjVNF9aUvrAQwddlBMyy7Zim oKWP29pU+G/J1wlVum67u2yuyoBl5g/FtB4U5ylIYfFELlo4TtJ8VIwDxwHUT2eykupX DRK7LSQK7MRa681FF4VUue4NPf5KLBGJetT6gMWejax46OQ9xa7KAJO1qv1XSrR+hLi2 ztzyeCDu7TJDh8cW5C+P3VDx+M3GeMy1SnmSyz47m8B3CdGMRlzROrBkboRw3UCtHPNP CwyQ== X-Gm-Message-State: AOJu0Yx3UxkwD7CfCvJ48YZsrGqcX2IRyJBp1ryEliU/jQsaeEbZcfxs jZOAEUHQ35D/ZplAXnt2YXk= X-Google-Smtp-Source: AGHT+IFqeenb1jQNa75buOc5euM2PMBxKcio+Um8ihXfyToq5COw/JEd6COv2oXRPfXOJPEjUYrC3w== X-Received: by 2002:aa7:84cd:0:b0:6d9:3821:be35 with SMTP id x13-20020aa784cd000000b006d93821be35mr669495pfn.25.1703002095866; Tue, 19 Dec 2023 08:08:15 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id y3-20020a056a00180300b006d7dfa7a6e4sm3853322pfa.176.2023.12.19.08.07.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:07:55 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 299B4740633; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 2/9] x86: Modularize sysdeps/x86/dl-cet.c Date: Tue, 19 Dec 2023 08:07:33 -0800 Message-ID: <20231219160740.3079330-3-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Improve readability and make maintenance easier for dl-feature.c by modularizing sysdeps/x86/dl-cet.c: 1. Support processors with: a. Only IBT. Or b. Only SHSTK. Or c. Both IBT and SHSTK. 2. Lock CET features only if IBT or SHSTK are enabled and are not enabled permissively. --- sysdeps/x86/dl-cet.c | 456 ++++++++++++++++++++++++++----------------- 1 file changed, 280 insertions(+), 176 deletions(-) diff --git a/sysdeps/x86/dl-cet.c b/sysdeps/x86/dl-cet.c index 60ea1cb558..67c51ee8c2 100644 --- a/sysdeps/x86/dl-cet.c +++ b/sysdeps/x86/dl-cet.c @@ -32,206 +32,310 @@ # error GNU_PROPERTY_X86_FEATURE_1_SHSTK != X86_FEATURE_1_SHSTK #endif -/* Check if object M is compatible with CET. */ +struct dl_cet_info +{ + const char *program; + + /* Check how IBT and SHSTK should be enabled. */ + enum dl_x86_cet_control enable_ibt_type; + enum dl_x86_cet_control enable_shstk_type; + + /* If IBT and SHSTK were previously enabled. */ + unsigned int feature_1_enabled; + + /* If IBT and SHSTK should be enabled. */ + unsigned int enable_feature_1; + + /* If there are any legacy shared object. */ + unsigned int feature_1_legacy; + + /* Which shared object is the first legacy shared object. */ + unsigned int feature_1_legacy_ibt; + unsigned int feature_1_legacy_shstk; +}; + +/* Check if the object M and its dependencies are legacy object. */ static void -dl_cet_check (struct link_map *m, const char *program) +dl_check_legacy_object (struct link_map *m, + struct dl_cet_info *info) { - /* Check how IBT should be enabled. */ - enum dl_x86_cet_control enable_ibt_type - = GL(dl_x86_feature_control).ibt; - /* Check how SHSTK should be enabled. */ - enum dl_x86_cet_control enable_shstk_type - = GL(dl_x86_feature_control).shstk; - - /* No legacy object check if both IBT and SHSTK are always on. */ - if (enable_ibt_type == cet_always_on - && enable_shstk_type == cet_always_on) + unsigned int i; + struct link_map *l = NULL; + + i = m->l_searchlist.r_nlist; + while (i-- > 0) { - THREAD_SETMEM (THREAD_SELF, header.feature_1, GL(dl_x86_feature_1)); - return; - } + /* Check each shared object to see if IBT and SHSTK are enabled. */ + l = m->l_initfini[i]; - /* Check if IBT is enabled by kernel. */ - bool ibt_enabled - = (GL(dl_x86_feature_1) & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0; - /* Check if SHSTK is enabled by kernel. */ - bool shstk_enabled - = (GL(dl_x86_feature_1) & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0; + if (l->l_init_called) + continue; - if (ibt_enabled || shstk_enabled) - { - struct link_map *l = NULL; - unsigned int ibt_legacy = 0, shstk_legacy = 0; - bool found_ibt_legacy = false, found_shstk_legacy = false; - - /* Check if IBT and SHSTK are enabled in object. */ - bool enable_ibt = (ibt_enabled - && enable_ibt_type != cet_always_off); - bool enable_shstk = (shstk_enabled - && enable_shstk_type != cet_always_off); - if (program) +#ifdef SHARED + /* Skip check for ld.so since it has the features enabled. The + features will be disabled later if they are not enabled in + executable. */ + if (l == &GL(dl_rtld_map) + || l->l_real == &GL(dl_rtld_map) + || (info->program != NULL && l == m)) + continue; +#endif + + /* IBT and SHSTK set only if enabled in executable and all DSOs. + NB: cet_always_on is handled outside of the loop. */ + info->enable_feature_1 &= ((l->l_x86_feature_1_and + & (GNU_PROPERTY_X86_FEATURE_1_IBT + | GNU_PROPERTY_X86_FEATURE_1_SHSTK)) + | ~(GNU_PROPERTY_X86_FEATURE_1_IBT + | GNU_PROPERTY_X86_FEATURE_1_SHSTK)); + if ((info->feature_1_legacy + & GNU_PROPERTY_X86_FEATURE_1_IBT) == 0 + && ((info->enable_feature_1 + & GNU_PROPERTY_X86_FEATURE_1_IBT) + != (info->feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_IBT))) { - /* Enable IBT and SHSTK only if they are enabled in executable. - NB: IBT and SHSTK may be disabled by environment variable: - - GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK - */ - enable_ibt &= (CPU_FEATURE_USABLE (IBT) - && (enable_ibt_type == cet_always_on - || (m->l_x86_feature_1_and - & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0)); - enable_shstk &= (CPU_FEATURE_USABLE (SHSTK) - && (enable_shstk_type == cet_always_on - || (m->l_x86_feature_1_and - & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0)); + info->feature_1_legacy_ibt = i; + info->feature_1_legacy |= GNU_PROPERTY_X86_FEATURE_1_IBT; } - /* ld.so is CET-enabled by kernel. But shared objects may not - support IBT nor SHSTK. */ - if (enable_ibt || enable_shstk) - { - unsigned int i; + if ((info->feature_1_legacy + & GNU_PROPERTY_X86_FEATURE_1_SHSTK) == 0 + && ((info->enable_feature_1 + & GNU_PROPERTY_X86_FEATURE_1_SHSTK) + != (info->feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_SHSTK))) + { + info->feature_1_legacy_shstk = i; + info->feature_1_legacy |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + } + } - i = m->l_searchlist.r_nlist; - while (i-- > 0) - { - /* Check each shared object to see if IBT and SHSTK are - enabled. */ - l = m->l_initfini[i]; + /* Handle cet_always_on. */ + if ((info->feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0 + && info->enable_ibt_type == cet_always_on) + { + info->feature_1_legacy &= ~GNU_PROPERTY_X86_FEATURE_1_IBT; + info->enable_feature_1 |= GNU_PROPERTY_X86_FEATURE_1_IBT; + } - if (l->l_init_called) - continue; + if ((info->feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0 + && info->enable_shstk_type == cet_always_on) + { + info->feature_1_legacy &= ~GNU_PROPERTY_X86_FEATURE_1_SHSTK; + info->enable_feature_1 |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + } +} #ifdef SHARED - /* Skip CET check for ld.so since ld.so is CET-enabled. - CET will be disabled later if CET isn't enabled in - executable. */ - if (l == &GL(dl_rtld_map) - || l->l_real == &GL(dl_rtld_map) - || (program && l == m)) - continue; +/* Enable IBT and SHSTK only if they are enabled in executable. Set + feature bits properly at the start of the program. */ + +static void +dl_cet_check_startup (struct link_map *m, struct dl_cet_info *info) +{ + /* NB: IBT and SHSTK may be disabled by environment variable: + + GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK. + */ + if (CPU_FEATURE_USABLE (IBT)) + { + if (info->enable_ibt_type == cet_always_on) + info->enable_feature_1 |= GNU_PROPERTY_X86_FEATURE_1_IBT; + else + info->enable_feature_1 &= ((m->l_x86_feature_1_and + & GNU_PROPERTY_X86_FEATURE_1_IBT) + | ~GNU_PROPERTY_X86_FEATURE_1_IBT); + } + else + info->enable_feature_1 &= ~GNU_PROPERTY_X86_FEATURE_1_IBT; + + if (CPU_FEATURE_USABLE (SHSTK)) + { + if (info->enable_shstk_type == cet_always_on) + info->enable_feature_1 |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + else + info->enable_feature_1 &= ((m->l_x86_feature_1_and + & GNU_PROPERTY_X86_FEATURE_1_SHSTK) + | ~GNU_PROPERTY_X86_FEATURE_1_SHSTK); + } + else + info->enable_feature_1 &= ~GNU_PROPERTY_X86_FEATURE_1_SHSTK; + + if (info->enable_feature_1 != 0) + dl_check_legacy_object (m, info); + + unsigned int disable_feature_1 + = info->enable_feature_1 ^ info->feature_1_enabled; + if (disable_feature_1 != 0) + { + /* Disable features in the kernel because of legacy objects or + cet_always_off. */ + if (dl_cet_disable_cet (disable_feature_1) != 0) + _dl_fatal_printf ("%s: can't disable x86 Features\n", + info->program); + + /* Clear the disabled bits. Sync dl_x86_feature_1 and + info->feature_1_enabled with info->enable_feature_1. */ + info->feature_1_enabled = info->enable_feature_1; + GL(dl_x86_feature_1) = info->enable_feature_1; + } + + if (HAS_CPU_FEATURE (IBT) || HAS_CPU_FEATURE (SHSTK)) + { + /* Lock CET features only if IBT or SHSTK are enabled and are not + enabled permissively. */ + unsigned int feature_1_lock = 0; + + if (((info->feature_1_enabled & GNU_PROPERTY_X86_FEATURE_1_IBT) + != 0) + && info->enable_ibt_type != cet_permissive) + feature_1_lock |= GNU_PROPERTY_X86_FEATURE_1_IBT; + + if (((info->feature_1_enabled & GNU_PROPERTY_X86_FEATURE_1_SHSTK) + != 0) + && info->enable_shstk_type != cet_permissive) + feature_1_lock |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + + if (feature_1_lock != 0 + && dl_cet_lock_cet () != 0) + _dl_fatal_printf ("%s: can't lock CET\n", info->program); + } + + THREAD_SETMEM (THREAD_SELF, header.feature_1, GL(dl_x86_feature_1)); +} #endif - /* IBT is enabled only if it is enabled in executable as - well as all shared objects. */ - enable_ibt &= (enable_ibt_type == cet_always_on - || (l->l_x86_feature_1_and - & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0); - if (!found_ibt_legacy && enable_ibt != ibt_enabled) - { - found_ibt_legacy = true; - ibt_legacy = i; - } - - /* SHSTK is enabled only if it is enabled in executable as - well as all shared objects. */ - enable_shstk &= (enable_shstk_type == cet_always_on - || (l->l_x86_feature_1_and - & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0); - if (enable_shstk != shstk_enabled) - { - found_shstk_legacy = true; - shstk_legacy = i; - } - } - } +/* Check feature bits when dlopening the shared object M. */ + +static void +dl_cet_check_dlopen (struct link_map *m, struct dl_cet_info *info) +{ + /* Check if there are any legacy objects loaded. */ + if (info->enable_feature_1 != 0) + { + dl_check_legacy_object (m, info); - bool cet_feature_changed = false; + /* Skip if there are no legacy shared objects loaded. */ + if (info->feature_1_legacy == 0) + return; + } - if (enable_ibt != ibt_enabled || enable_shstk != shstk_enabled) - { - if (!program) - { - if (enable_ibt_type != cet_permissive) - { - /* When IBT is enabled, we cannot dlopen a shared - object without IBT. */ - if (found_ibt_legacy) - _dl_signal_error (0, - m->l_initfini[ibt_legacy]->l_name, - "dlopen", - N_("rebuild shared object with IBT support enabled")); - } - - if (enable_shstk_type != cet_permissive) - { - /* When SHSTK is enabled, we cannot dlopen a shared - object without SHSTK. */ - if (found_shstk_legacy) - _dl_signal_error (0, - m->l_initfini[shstk_legacy]->l_name, - "dlopen", - N_("rebuild shared object with SHSTK support enabled")); - } - - if (enable_ibt_type != cet_permissive - && enable_shstk_type != cet_permissive) - return; - } - - /* Disable IBT and/or SHSTK if they are enabled by kernel, but - disabled in executable or shared objects. */ - unsigned int cet_feature = 0; - - if (!enable_ibt) - cet_feature |= GNU_PROPERTY_X86_FEATURE_1_IBT; - if (!enable_shstk) - cet_feature |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; - - int res = dl_cet_disable_cet (cet_feature); - if (res != 0) - { - if (program) - _dl_fatal_printf ("%s: can't disable CET\n", program); - else - { - if (found_ibt_legacy) - l = m->l_initfini[ibt_legacy]; - else - l = m->l_initfini[shstk_legacy]; - _dl_signal_error (-res, l->l_name, "dlopen", - N_("can't disable CET")); - } - } - - /* Clear the disabled bits in dl_x86_feature_1. */ - GL(dl_x86_feature_1) &= ~cet_feature; - - cet_feature_changed = true; - } + unsigned int disable_feature_1 = 0; + unsigned int legacy_obj = 0; + const char *msg = NULL; -#ifdef SHARED - if (program && (ibt_enabled || shstk_enabled)) + if ((info->feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0 + && (info->feature_1_legacy + & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0) + { + if (info->enable_ibt_type != cet_permissive) { - if ((!ibt_enabled - || enable_ibt_type != cet_permissive) - && (!shstk_enabled - || enable_shstk_type != cet_permissive)) - { - /* Lock CET if IBT or SHSTK is enabled in executable unless - IBT or SHSTK is enabled permissively. */ - int res = dl_cet_lock_cet (); - if (res != 0) - _dl_fatal_printf ("%s: can't lock CET\n", program); - } - - /* Set feature_1 if IBT or SHSTK is enabled in executable. */ - cet_feature_changed = true; + legacy_obj = info->feature_1_legacy_ibt; + msg = N_("rebuild shared object with IBT support enabled"); } -#endif + else + disable_feature_1 |= GNU_PROPERTY_X86_FEATURE_1_IBT; + } - if (cet_feature_changed) + /* Check the next feature only if there is no error. */ + if (msg == NULL + && (info->feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0 + && (info->feature_1_legacy + & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0) + { + if (info->enable_shstk_type != cet_permissive) { - unsigned int feature_1 = 0; - if (enable_ibt) - feature_1 |= GNU_PROPERTY_X86_FEATURE_1_IBT; - if (enable_shstk) - feature_1 |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; - struct pthread *self = THREAD_SELF; - THREAD_SETMEM (self, header.feature_1, feature_1); + legacy_obj = info->feature_1_legacy_shstk; + msg = N_("rebuild shared object with SHSTK support enabled"); } + else + disable_feature_1 |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + } + + /* If there is an error, long jump back to the caller. */ + if (msg != NULL) + _dl_signal_error (0, m->l_initfini[legacy_obj]->l_name, "dlopen", + msg); + + if (disable_feature_1 != 0) + { + int res = dl_cet_disable_cet (disable_feature_1); + if (res) + { + if ((disable_feature_1 + & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0) + msg = N_("can't disable IBT"); + else + msg = N_("can't disable SHSTK"); + /* Long jump back to the caller on error. */ + _dl_signal_error (-res, m->l_initfini[legacy_obj]->l_name, + "dlopen", msg); + } + + /* Clear the disabled bits in dl_x86_feature_1. */ + GL(dl_x86_feature_1) &= ~disable_feature_1; + + THREAD_SETMEM (THREAD_SELF, header.feature_1, + GL(dl_x86_feature_1)); + } +} + +static void +dl_cet_check (struct link_map *m, const char *program) +{ + struct dl_cet_info info; + + /* Check how IBT and SHSTK should be enabled. */ + info.enable_ibt_type = GL(dl_x86_feature_control).ibt; + info.enable_shstk_type = GL(dl_x86_feature_control).shstk; + + info.feature_1_enabled = GL(dl_x86_feature_1); + + /* No legacy object check if IBT and SHSTK are always on. */ + if (info.enable_ibt_type == cet_always_on + && info.enable_shstk_type == cet_always_on) + { +#ifdef SHARED + /* Set it only during startup. */ + if (program != NULL) + THREAD_SETMEM (THREAD_SELF, header.feature_1, + info.feature_1_enabled); +#endif + return; } + + /* Check if IBT and SHSTK were enabled by kernel. */ + if (info.feature_1_enabled == 0) + return; + + info.program = program; + + /* Check which features should be enabled. */ + info.enable_feature_1 = 0; + if (info.enable_ibt_type != cet_always_off) + info.enable_feature_1 |= (info.feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_IBT); + if (info.enable_shstk_type != cet_always_off) + info.enable_feature_1 |= (info.feature_1_enabled + & GNU_PROPERTY_X86_FEATURE_1_SHSTK); + + /* Start with no legacy objects. */ + info.feature_1_legacy = 0; + info.feature_1_legacy_ibt = 0; + info.feature_1_legacy_shstk = 0; + +#ifdef SHARED + if (program) + dl_cet_check_startup (m, &info); + else +#endif + dl_cet_check_dlopen (m, &info); } void From patchwork Tue Dec 19 16:07:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878055 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=En8tLCRJ; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=8.43.85.97; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhSw0f7wz1ydc for ; Wed, 20 Dec 2023 03:08:48 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id B7AE13861000 for ; Tue, 19 Dec 2023 16:08:45 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) by sourceware.org (Postfix) with ESMTPS id 634AF385DC0E for ; Tue, 19 Dec 2023 16:08:13 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 634AF385DC0E Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 634AF385DC0E Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::42b ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002096; cv=none; b=M3yOW2WW470QFPZEOKzRfCt5xU1nBMa/Q6Zdj5sIvuoj6znWtURbvN6JsAIe0IE3VBlpaMlCXQusapjHSupESAF4LCNPEmq8/KvPRWAQO1o3QpXQLehRLjW5bYsMLyu1nF6vUgpullK7YNtQfXtRi24Mu4HVzxeVFj+TfLJApNI= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002096; c=relaxed/simple; bh=NXkKjjkpoww0dKDWMrG91HYQkuqn09QBZZDK2rlEsA4=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=C07DnRcapZvhoqUavDWodiYCu75QY7Ka5G6MpeeVku4kU9idyXBsvoFPHZ0CDT0/dmrSx1g+Es2JEeEr77sSOKPp6i3KxgQdLrq0nU0ITfb8jD/RkDgRqxNGxtbb5Trqad36iSvFNR/FPHpoj1R+OAM335gQJfIzcMbnBI8oxXo= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x42b.google.com with SMTP id d2e1a72fcca58-6d7f1109abcso1469091b3a.3 for ; Tue, 19 Dec 2023 08:08:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002092; x=1703606892; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=n0+nnPzvlA8lkBebuZ08HukDy+KSvZAZOGnkahLwL2o=; b=En8tLCRJaEaq3mhWzjInel/ZvB7zA562BMvDNgd/Qk9WUKK6a+BAXBUmVkHkASj9LS d9HNS89KR+KyIa028YJrqbDs+6JreeAVfsbvdYzeaA+bKyHKOwOG/s0o4w/Hg2Y/ZC3A FzSDb1QX8ln2PkjNHA0i1Kb2b95l5Y/8xAMndCFoer+DAtdIY4G1OxI3265FHzAqJTft EbqS+wvpN4o+PhfRlonPuuFjX/06OaZ3ja8lMVnfyVIHsMNRdMyPiu8aZQAIzsU3df0F NfU6TO5R5Ymaa9rkfG03Ex4orNh20mYG4/41CEZUnSzzoza9+CEhB/2okmER0B+3rvff nqRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002092; x=1703606892; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=n0+nnPzvlA8lkBebuZ08HukDy+KSvZAZOGnkahLwL2o=; b=gSawT01oXDMzc7Tqu7dNvL0LFk2jY6tp/pr97SQ7mPpRzOGB4PK2pOJtdhYGvwYCN3 B3wrbONo5cpT/op/VkKLnYaQ0IhhIbpvhYTnPY4J902395TIvlJYhKb0TR/Hdu94q/8y f1sAlJeaFors8vnEnVqLiwGYtSnB3NBSioLxiFkUJqPhsH73IBnQSYMRdo3gxzA1NOtf ulh666KYs3LCZRTQkqmAS6FrFNXrmrowGqk5IzJEWZc2x48Wb0+AvW0SLf+GNQiHmJ9a j6O9/fpG69qv2V9FfN4gEg5bJndSCre2BKeQiTfvwJWh3p3bIxyCLkf62scAX8TCG+ew 70lQ== X-Gm-Message-State: AOJu0Yw59IcCnUiGifJCaROxsZtImnE6GJuxIQ6TDxULuy9odStXS6oP CUVQ6TSNQIiXwiyt78jM26w= X-Google-Smtp-Source: AGHT+IH7W0vNPIBM1nHmSb9NrnCTUfIqAa7ssWdqNtMEK8dFHzS5djGWUiGDxzYFR1FLNTC7xzt7vw== X-Received: by 2002:a17:90a:c907:b0:28b:c267:4b39 with SMTP id v7-20020a17090ac90700b0028bc2674b39mr470196pjt.35.1703002092009; Tue, 19 Dec 2023 08:08:12 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id gt22-20020a17090af2d600b0028ac1112124sm1780373pjb.30.2023.12.19.08.07.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:07:55 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 351C6740638; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 3/9] x86/cet: Sync with Linux kernel 6.6 shadow stack interface Date: Tue, 19 Dec 2023 08:07:34 -0800 Message-ID: <20231219160740.3079330-4-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Sync with Linux kernel 6.6 shadow stack interface. Since only x86-64 is supported, i386 shadow stack codes are unchanged and CET shouldn't be enabled for i386. 1. When the shadow stack base in TCB is unset, the default shadow stack is in use. Use the current shadow stack pointer as the marker for the default shadow stack. It is used to identify if the current shadow stack is the same as the target shadow stack when switching ucontexts. If yes, INCSSP will be used to unwind shadow stack. Otherwise, shadow stack restore token will be used. 2. Allocate shadow stack with the map_shadow_stack syscall. Since there is no function to explicitly release ucontext, there is no place to release shadow stack allocated by map_shadow_stack in ucontext functions. Such shadow stacks will be leaked. 3. Rename arch_prctl CET commands to ARCH_SHSTK_XXX. 4. Rewrite the CET control functions with the current kernel shadow stack interface. Since CET is no longer enabled by kernel, a separate patch will enable shadow stack during startup. --- sysdeps/unix/sysv/linux/x86/Makefile | 1 + .../sysv/linux/x86/allocate-shadow-stack.c | 62 +++++++++++++++++++ .../sysv/linux/x86/allocate-shadow-stack.h | 27 ++++++++ sysdeps/unix/sysv/linux/x86/bits/mman.h | 5 ++ sysdeps/unix/sysv/linux/x86/cpu-features.c | 13 ++-- sysdeps/unix/sysv/linux/x86/dl-cet.h | 16 +++-- .../unix/sysv/linux/x86/include/asm/prctl.h | 37 +++++------ .../sysv/linux/x86/tst-cet-setcontext-1.c | 17 +++-- .../unix/sysv/linux/x86_64/__start_context.S | 38 +++--------- sysdeps/unix/sysv/linux/x86_64/getcontext.S | 30 ++------- sysdeps/unix/sysv/linux/x86_64/makecontext.c | 29 +++++---- sysdeps/unix/sysv/linux/x86_64/swapcontext.S | 22 ++----- sysdeps/x86/cpu-features.c | 15 +++-- sysdeps/x86/dl-cet.c | 2 +- sysdeps/x86_64/nptl/tls.h | 2 +- 15 files changed, 184 insertions(+), 132 deletions(-) create mode 100644 sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.c create mode 100644 sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.h diff --git a/sysdeps/unix/sysv/linux/x86/Makefile b/sysdeps/unix/sysv/linux/x86/Makefile index 9dfdd689a9..ed0d6500b9 100644 --- a/sysdeps/unix/sysv/linux/x86/Makefile +++ b/sysdeps/unix/sysv/linux/x86/Makefile @@ -44,6 +44,7 @@ CFLAGS-tst-cet-vfork-1.c += -mshstk endif ifeq ($(subdir),stdlib) +sysdep_routines += allocate-shadow-stack tests += tst-cet-setcontext-1 CFLAGS-tst-cet-setcontext-1.c += -mshstk endif diff --git a/sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.c b/sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.c new file mode 100644 index 0000000000..d7938b6ea9 --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.c @@ -0,0 +1,62 @@ +/* Helper function to allocate shadow stack. + Copyright (C) 2023 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include + +/* NB: This can be treated as a syscall by caller. */ + +#ifndef __x86_64__ +__attribute__ ((regparm (2))) +#endif +long int +__allocate_shadow_stack (size_t stack_size, + shadow_stack_size_t *child_stack) +{ +#ifdef __NR_map_shadow_stack + size_t shadow_stack_size + = stack_size >> STACK_SIZE_TO_SHADOW_STACK_SIZE_SHIFT; + /* Align shadow stack to 8 bytes. */ + shadow_stack_size = ALIGN_UP (shadow_stack_size, 8); + /* Since sigaltstack shares shadow stack with the current context in + the thread, add extra 20 stack frames in shadow stack for signal + handlers. */ +# ifdef __x86_64__ + shadow_stack_size += 20 * 8; +# else + shadow_stack_size += 20 * 4; +# endif + void *shadow_stack = (void *)INLINE_SYSCALL_CALL + (map_shadow_stack, NULL, shadow_stack_size, SHADOW_STACK_SET_TOKEN); + /* Report the map_shadow_stack error. */ + if (shadow_stack == MAP_FAILED) + return -errno; + + /* Save the shadow stack base and size on child stack. */ + child_stack[0] = (uintptr_t) shadow_stack; + child_stack[1] = shadow_stack_size; + + return 0; +#else + return -ENOSYS; +#endif +} diff --git a/sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.h b/sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.h new file mode 100644 index 0000000000..834373e0d3 --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86/allocate-shadow-stack.h @@ -0,0 +1,27 @@ +/* Helper function to allocate shadow stack. + Copyright (C) 2023 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +typedef __typeof (((ucontext_t *) 0)->__ssp[0]) shadow_stack_size_t; + +extern long int __allocate_shadow_stack (size_t, shadow_stack_size_t *) +#ifndef __x86_64__ + __attribute__ ((regparm (2))) +#endif + attribute_hidden; diff --git a/sysdeps/unix/sysv/linux/x86/bits/mman.h b/sysdeps/unix/sysv/linux/x86/bits/mman.h index 3d356e86a0..221f7c82bd 100644 --- a/sysdeps/unix/sysv/linux/x86/bits/mman.h +++ b/sysdeps/unix/sysv/linux/x86/bits/mman.h @@ -27,6 +27,11 @@ #define MAP_32BIT 0x40 /* Only give out 32-bit addresses. */ #define MAP_ABOVE4G 0x80 /* Only map above 4GB. */ +#ifdef __USE_MISC +/* Set up a restore token in the newly allocatd shadow stack */ +# define SHADOW_STACK_SET_TOKEN 0x1 +#endif + #include /* Include generic Linux declarations. */ diff --git a/sysdeps/unix/sysv/linux/x86/cpu-features.c b/sysdeps/unix/sysv/linux/x86/cpu-features.c index 41e7600668..0e6e2bf855 100644 --- a/sysdeps/unix/sysv/linux/x86/cpu-features.c +++ b/sysdeps/unix/sysv/linux/x86/cpu-features.c @@ -23,10 +23,15 @@ static inline int __attribute__ ((always_inline)) get_cet_status (void) { - unsigned long long cet_status[3]; - if (INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_CET_STATUS, cet_status) == 0) - return cet_status[0]; - return 0; + unsigned long long kernel_feature; + unsigned int status = 0; + if (INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_STATUS, + &kernel_feature) == 0) + { + if ((kernel_feature & ARCH_SHSTK_SHSTK) != 0) + status = GNU_PROPERTY_X86_FEATURE_1_SHSTK; + } + return status; } # ifndef SHARED diff --git a/sysdeps/unix/sysv/linux/x86/dl-cet.h b/sysdeps/unix/sysv/linux/x86/dl-cet.h index c885bf1323..da220ac627 100644 --- a/sysdeps/unix/sysv/linux/x86/dl-cet.h +++ b/sysdeps/unix/sysv/linux/x86/dl-cet.h @@ -21,12 +21,20 @@ static inline int __attribute__ ((always_inline)) dl_cet_disable_cet (unsigned int cet_feature) { - return (int) INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_CET_DISABLE, - cet_feature); + if (cet_feature != GNU_PROPERTY_X86_FEATURE_1_SHSTK) + return -1; + long long int kernel_feature = ARCH_SHSTK_SHSTK; + return (int) INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_DISABLE, + kernel_feature); } static inline int __attribute__ ((always_inline)) -dl_cet_lock_cet (void) +dl_cet_lock_cet (unsigned int cet_feature) { - return (int) INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_CET_LOCK, 0); + if (cet_feature != GNU_PROPERTY_X86_FEATURE_1_SHSTK) + return -1; + /* Lock all SHSTK features. */ + long long int kernel_feature = -1; + return (int) INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_LOCK, + kernel_feature); } diff --git a/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h b/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h index 45ad0b052f..2f511321ad 100644 --- a/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h +++ b/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h @@ -4,24 +4,19 @@ #include_next -#ifndef ARCH_CET_STATUS -/* CET features: - IBT: GNU_PROPERTY_X86_FEATURE_1_IBT - SHSTK: GNU_PROPERTY_X86_FEATURE_1_SHSTK - */ -/* Return CET features in unsigned long long *addr: - features: addr[0]. - shadow stack base address: addr[1]. - shadow stack size: addr[2]. - */ -# define ARCH_CET_STATUS 0x3001 -/* Disable CET features in unsigned int features. */ -# define ARCH_CET_DISABLE 0x3002 -/* Lock all CET features. */ -# define ARCH_CET_LOCK 0x3003 -/* Allocate a new shadow stack with unsigned long long *addr: - IN: requested shadow stack size: *addr. - OUT: allocated shadow stack address: *addr. - */ -# define ARCH_CET_ALLOC_SHSTK 0x3004 -#endif /* ARCH_CET_STATUS */ +#ifndef ARCH_SHSTK_ENABLE +/* Enable SHSTK features in unsigned long int features. */ +# define ARCH_SHSTK_ENABLE 0x5001 +/* Disable SHSTK features in unsigned long int features. */ +# define ARCH_SHSTK_DISABLE 0x5002 +/* Lock SHSTK features in unsigned long int features. */ +# define ARCH_SHSTK_LOCK 0x5003 +/* Unlock SHSTK features in unsigned long int features. */ +# define ARCH_SHSTK_UNLOCK 0x5004 +/* Return SHSTK features in unsigned long int features. */ +# define ARCH_SHSTK_STATUS 0x5005 + +/* ARCH_SHSTK_ features bits */ +# define ARCH_SHSTK_SHSTK 0x1 +# define ARCH_SHSTK_WRSS 0x2 +#endif diff --git a/sysdeps/unix/sysv/linux/x86/tst-cet-setcontext-1.c b/sysdeps/unix/sysv/linux/x86/tst-cet-setcontext-1.c index 837a9fd0eb..2ea66c803b 100644 --- a/sysdeps/unix/sysv/linux/x86/tst-cet-setcontext-1.c +++ b/sysdeps/unix/sysv/linux/x86/tst-cet-setcontext-1.c @@ -87,15 +87,14 @@ do_test (void) ctx[4].uc_link = &ctx[0]; makecontext (&ctx[4], (void (*) (void)) f1, 0); - /* NB: When shadow stack is enabled, makecontext calls arch_prctl - with ARCH_CET_ALLOC_SHSTK to allocate a new shadow stack which - can be unmapped. The base address and size of the new shadow - stack are returned in __ssp[1] and __ssp[2]. makecontext is - called for CTX1, CTX3 and CTX4. But only CTX1 is used. New - shadow stacks are allocated in the order of CTX3, CTX1, CTX4. - It is very likely that CTX1's shadow stack is placed between - CTX3 and CTX4. We munmap CTX3's and CTX4's shadow stacks to - create gaps above and below CTX1's shadow stack. We check + /* NB: When shadow stack is enabled, makecontext calls map_shadow_stack + to allocate a new shadow stack which can be unmapped. The base + address and size of the new shadow stack are returned in __ssp[1] + and __ssp[2]. makecontext is called for CTX1, CTX3 and CTX4. But + only CTX1 is used. New shadow stacks are allocated in the order + of CTX3, CTX1, CTX4. It is very likely that CTX1's shadow stack is + placed between CTX3 and CTX4. We munmap CTX3's and CTX4's shadow + stacks to create gaps above and below CTX1's shadow stack. We check that setcontext CTX1 works correctly in this case. */ if (_get_ssp () != 0) { diff --git a/sysdeps/unix/sysv/linux/x86_64/__start_context.S b/sysdeps/unix/sysv/linux/x86_64/__start_context.S index f6436dd6bb..ae04203c90 100644 --- a/sysdeps/unix/sysv/linux/x86_64/__start_context.S +++ b/sysdeps/unix/sysv/linux/x86_64/__start_context.S @@ -24,20 +24,14 @@ /* Use CALL to push __start_context onto the new stack as well as the new shadow stack. RDI points to ucontext: Incoming: - __ssp[0]: The original caller's shadow stack pointer. - __ssp[1]: The size of the new shadow stack. - __ssp[2]: The size of the new shadow stack. - Outgoing: __ssp[0]: The new shadow stack pointer. __ssp[1]: The base address of the new shadow stack. __ssp[2]: The size of the new shadow stack. */ ENTRY(__push___start_context) - /* Save the pointer to ucontext. */ - movq %rdi, %r9 /* Get the original shadow stack pointer. */ - rdsspq %r8 + rdsspq %rcx /* Save the original stack pointer. */ movq %rsp, %rdx /* Load the top of the new stack into RSI. */ @@ -45,24 +39,12 @@ ENTRY(__push___start_context) /* Add 8 bytes to RSI since CALL will push the 8-byte return address onto stack. */ leaq 8(%rsi), %rsp - /* Allocate the new shadow stack. The size of the new shadow - stack is passed in __ssp[1]. */ - lea (oSSP + 8)(%rdi), %RSI_LP - movl $ARCH_CET_ALLOC_SHSTK, %edi - movl $__NR_arch_prctl, %eax - /* The new shadow stack base is returned in __ssp[1]. */ - syscall - testq %rax, %rax - jne L(hlt) /* This should never happen. */ - - /* Get the size of the new shadow stack. */ - movq 8(%rsi), %rdi - - /* Get the base address of the new shadow stack. */ - movq (%rsi), %rsi - + /* The size of the new shadow stack is stored in __ssp[2]. */ + mov (oSSP + 16)(%rdi), %RSI_LP + /* The new shadow stack base is stored in __ssp[1]. */ + mov (oSSP + 8)(%rdi), %RAX_LP /* Use the restore stoken to restore the new shadow stack. */ - rstorssp -8(%rsi, %rdi) + rstorssp -8(%rax, %rsi) /* Save the restore token on the original shadow stack. */ saveprevssp @@ -73,18 +55,12 @@ ENTRY(__push___start_context) jmp __start_context 1: - /* Get the new shadow stack pointer. */ - rdsspq %rdi - /* Use the restore stoken to restore the original shadow stack. */ - rstorssp -8(%r8) + rstorssp -8(%rcx) /* Save the restore token on the new shadow stack. */ saveprevssp - /* Store the new shadow stack pointer in __ssp[0]. */ - movq %rdi, oSSP(%r9) - /* Restore the original stack. */ mov %rdx, %rsp ret diff --git a/sysdeps/unix/sysv/linux/x86_64/getcontext.S b/sysdeps/unix/sysv/linux/x86_64/getcontext.S index a00e2f6290..71f3802dca 100644 --- a/sysdeps/unix/sysv/linux/x86_64/getcontext.S +++ b/sysdeps/unix/sysv/linux/x86_64/getcontext.S @@ -58,35 +58,15 @@ ENTRY(__getcontext) testl $X86_FEATURE_1_SHSTK, %fs:FEATURE_1_OFFSET jz L(no_shstk) - /* Save RDI in RDX which won't be clobbered by syscall. */ - movq %rdi, %rdx - xorl %eax, %eax cmpq %fs:SSP_BASE_OFFSET, %rax jnz L(shadow_stack_bound_recorded) - /* Get the base address and size of the default shadow stack - which must be the current shadow stack since nothing has - been recorded yet. */ - sub $24, %RSP_LP - mov %RSP_LP, %RSI_LP - movl $ARCH_CET_STATUS, %edi - movl $__NR_arch_prctl, %eax - syscall - testq %rax, %rax - jz L(continue_no_err) - - /* This should never happen. */ - hlt - -L(continue_no_err): - /* Record the base of the current shadow stack. */ - movq 8(%rsp), %rax + /* When the shadow stack base is unset, the default shadow + stack is in use. Use the current shadow stack pointer + as the marker for the default shadow stack. */ + rdsspq %rax movq %rax, %fs:SSP_BASE_OFFSET - add $24, %RSP_LP - - /* Restore RDI. */ - movq %rdx, %rdi L(shadow_stack_bound_recorded): /* Get the current shadow stack pointer. */ @@ -94,7 +74,7 @@ L(shadow_stack_bound_recorded): /* NB: Save the caller's shadow stack so that we can jump back to the caller directly. */ addq $8, %rax - movq %rax, oSSP(%rdx) + movq %rax, oSSP(%rdi) /* Save the current shadow stack base in ucontext. */ movq %fs:SSP_BASE_OFFSET, %rax diff --git a/sysdeps/unix/sysv/linux/x86_64/makecontext.c b/sysdeps/unix/sysv/linux/x86_64/makecontext.c index de9e03eb81..788b730132 100644 --- a/sysdeps/unix/sysv/linux/x86_64/makecontext.c +++ b/sysdeps/unix/sysv/linux/x86_64/makecontext.c @@ -24,6 +24,8 @@ # include # include # include +# include +# include #endif #include "ucontext_i.h" @@ -88,23 +90,24 @@ __makecontext (ucontext_t *ucp, void (*func) (void), int argc, ...) if ((feature_1 & X86_FEATURE_1_SHSTK) != 0) { /* Shadow stack is enabled. We need to allocate a new shadow - stack. */ - unsigned long ssp_size = (((uintptr_t) sp - - (uintptr_t) ucp->uc_stack.ss_sp) - >> STACK_SIZE_TO_SHADOW_STACK_SIZE_SHIFT); - /* Align shadow stack to 8 bytes. */ - ssp_size = ALIGN_UP (ssp_size, 8); - - ucp->__ssp[1] = ssp_size; - ucp->__ssp[2] = ssp_size; - - /* Call __push___start_context to allocate a new shadow stack, - push __start_context onto the new stack as well as the new - shadow stack. NB: After __push___start_context returns, + stack. NB: ucp->__ssp[0]: The new shadow stack pointer. ucp->__ssp[1]: The base address of the new shadow stack. ucp->__ssp[2]: The size of the new shadow stack. */ + long int ret + = __allocate_shadow_stack (((uintptr_t) sp + - (uintptr_t) ucp->uc_stack.ss_sp), + &ucp->__ssp[1]); + if (ret != 0) + { + /* FIXME: What should we do? */ + abort (); + } + + ucp->__ssp[0] = ucp->__ssp[1] + ucp->__ssp[2] - 8; + /* Call __push___start_context to push __start_context onto the new + stack as well as the new shadow stack. */ __push___start_context (ucp); } else diff --git a/sysdeps/unix/sysv/linux/x86_64/swapcontext.S b/sysdeps/unix/sysv/linux/x86_64/swapcontext.S index 5925752164..2f2fe9875b 100644 --- a/sysdeps/unix/sysv/linux/x86_64/swapcontext.S +++ b/sysdeps/unix/sysv/linux/x86_64/swapcontext.S @@ -109,25 +109,11 @@ ENTRY(__swapcontext) cmpq %fs:SSP_BASE_OFFSET, %rax jnz L(shadow_stack_bound_recorded) - /* Get the base address and size of the default shadow stack - which must be the current shadow stack since nothing has - been recorded yet. */ - sub $24, %RSP_LP - mov %RSP_LP, %RSI_LP - movl $ARCH_CET_STATUS, %edi - movl $__NR_arch_prctl, %eax - syscall - testq %rax, %rax - jz L(continue_no_err) - - /* This should never happen. */ - hlt - -L(continue_no_err): - /* Record the base of the current shadow stack. */ - movq 8(%rsp), %rax + /* When the shadow stack base is unset, the default shadow + stack is in use. Use the current shadow stack pointer + as the marker for the default shadow stack. */ + rdsspq %rax movq %rax, %fs:SSP_BASE_OFFSET - add $24, %RSP_LP L(shadow_stack_bound_recorded): /* If we unwind the stack, we can't undo stack unwinding. Just diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c index 0bf923d48b..f180f0d9a4 100644 --- a/sysdeps/x86/cpu-features.c +++ b/sysdeps/x86/cpu-features.c @@ -1121,8 +1121,9 @@ no_cpuid: # ifndef SHARED /* Check if IBT and SHSTK are enabled by kernel. */ - if ((cet_status & GNU_PROPERTY_X86_FEATURE_1_IBT) - || (cet_status & GNU_PROPERTY_X86_FEATURE_1_SHSTK)) + if ((cet_status + & (GNU_PROPERTY_X86_FEATURE_1_IBT + | GNU_PROPERTY_X86_FEATURE_1_SHSTK))) { /* Disable IBT and/or SHSTK if they are enabled by kernel, but disabled by environment variable: @@ -1131,9 +1132,11 @@ no_cpuid: */ unsigned int cet_feature = 0; if (!CPU_FEATURE_USABLE (IBT)) - cet_feature |= GNU_PROPERTY_X86_FEATURE_1_IBT; + cet_feature |= (cet_status + & GNU_PROPERTY_X86_FEATURE_1_IBT); if (!CPU_FEATURE_USABLE (SHSTK)) - cet_feature |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + cet_feature |= (cet_status + & GNU_PROPERTY_X86_FEATURE_1_SHSTK); if (cet_feature) { @@ -1148,7 +1151,9 @@ no_cpuid: lock CET if IBT or SHSTK is enabled permissively. */ if (GL(dl_x86_feature_control).ibt != cet_permissive && GL(dl_x86_feature_control).shstk != cet_permissive) - dl_cet_lock_cet (); + dl_cet_lock_cet (GL(dl_x86_feature_1) + & (GNU_PROPERTY_X86_FEATURE_1_IBT + | GNU_PROPERTY_X86_FEATURE_1_SHSTK)); } # endif } diff --git a/sysdeps/x86/dl-cet.c b/sysdeps/x86/dl-cet.c index 67c51ee8c2..8b911fd931 100644 --- a/sysdeps/x86/dl-cet.c +++ b/sysdeps/x86/dl-cet.c @@ -201,7 +201,7 @@ dl_cet_check_startup (struct link_map *m, struct dl_cet_info *info) feature_1_lock |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; if (feature_1_lock != 0 - && dl_cet_lock_cet () != 0) + && dl_cet_lock_cet (feature_1_lock) != 0) _dl_fatal_printf ("%s: can't lock CET\n", info->program); } diff --git a/sysdeps/x86_64/nptl/tls.h b/sysdeps/x86_64/nptl/tls.h index 1403f939f7..4bcc2552a1 100644 --- a/sysdeps/x86_64/nptl/tls.h +++ b/sysdeps/x86_64/nptl/tls.h @@ -60,7 +60,7 @@ typedef struct void *__private_tm[4]; /* GCC split stack support. */ void *__private_ss; - /* The lowest address of shadow stack, */ + /* The marker for the current shadow stack. */ unsigned long long int ssp_base; /* Must be kept even if it is no longer used by glibc since programs, like AddressSanitizer, depend on the size of tcbhead_t. */ From patchwork Tue Dec 19 16:07:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878049 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=Wn2NlTgO; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhSN3KLsz1ydc for ; Wed, 20 Dec 2023 03:08:19 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 9E3B8385771F for ; Tue, 19 Dec 2023 16:08:17 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pg1-x52f.google.com (mail-pg1-x52f.google.com [IPv6:2607:f8b0:4864:20::52f]) by sourceware.org (Postfix) with ESMTPS id E89F6385840D for ; Tue, 19 Dec 2023 16:08:06 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E89F6385840D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org E89F6385840D Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::52f ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002088; cv=none; b=IaSj/UCOggyGp2GX+8khn2CmChan+twwDANTLu4MzSc3S2xar+t1+m39tQu+STh3tqofZQGssjf7HJp29AxJtJYqIHEKiYrJgmvLO6g/n30lcrclhOrYwQs9X540h2nMqHTvK9wvs7MJfS3F43p34g9HJolHQYxSVFopUv/vVWE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002088; c=relaxed/simple; bh=A1+fHusyoFA5MDej/XYdek+uGkHZyKKGCEBcDtlbUlM=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=R3nquXbIwrZTNGO5a7ZW5KPgG2VqThpiOvoaHz7Qw82awkqshQZKOkFJ3EG1AibWUn1SJCczNzjhMTaa7JLHeQ8HWyp7Kk7DvulMeJtqSoYRAiiASO+EpDJU4zKsy0xXe+47iQx7viTskbCRxRFORhQaTvJLhmm0uOLx8UExsaM= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pg1-x52f.google.com with SMTP id 41be03b00d2f7-5cd86e3a9afso2018812a12.1 for ; Tue, 19 Dec 2023 08:08:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002086; x=1703606886; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=VuRsd3PBVfXGnOWm4frtoz3pLiPQWXDOpUpz4C5moqM=; b=Wn2NlTgO6daJ2wv4N49S7hA09g9y8ah8W46ecJKLc1Y35btlPWk/Hb5MZmuMuWSDnB jnekmQ0Vm3KdKouPRxl6P8dQFKXQh/OmBZVewbAzKtd16Vf6mlHAaK5G4VzTib8gkaRj RhOM2/zE+FKFnfqna1SiYZadXm9AX9FKFl1wNXh9VDbkZmIjKtj8+ulDn1bbKzQS/SkW aK8PMTUn0Nk22fIYR3gc4P5NYkgklR/QVpoGEDTitX8/hAT+hw3ZLehynwe9x0uj9JZj 5TNkMy0Yx50EqHHO+6Ecf2rfjfzNgpsHYFGfjZvR8njxjTYG4nCOyZkZpDVcm/WOhk5d uDag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002086; x=1703606886; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VuRsd3PBVfXGnOWm4frtoz3pLiPQWXDOpUpz4C5moqM=; b=kgp7jm3UJMCYtcgJgM+g2yasRaOPrkNWqLLQ0fWfu7idcs165sog2WIdz4/6XZBLoJ Qc2eU/6KrFMYvxu5rXgvOvTalU5necBjZP7Wa5fX/CxV+0+ph9JH+0etf7sSqy7n2W+Q 6DT6YJ1q/WIJ1oVvxhUbmn2A8KuYrkqFi/d9A2ceoM7C+xa76IolytUMyBiWCCoDjhQj P8vZO4RRlSauvvKhOVduC1vmHbg+MzfpuO08evcSPAirY9riEsMQRD01Gij4VSNXxDlW kCTxhMRq1iZQOAS+IcLp/yZi4/SIm8KpRyB6Zsb6iV0dR6mD5Sumld79nek0BtTNPbqi ZjwA== X-Gm-Message-State: AOJu0YyXRtAb7a+2KUfmD8IIxbOlBVdY/W+jg9yczFIrx/1K6teoY6Td tMtPjSfCoFC3ZC3cbAdHw6QQ8HbFd+4= X-Google-Smtp-Source: AGHT+IFRuIjNhu50wqx6I9pcdcZ0UhWUGdHdFRc5K+HAyU7JTx+6F0q+bqss8Po3pw6Evf3O/NMdqg== X-Received: by 2002:a17:90b:350:b0:28b:4750:c85a with SMTP id fh16-20020a17090b035000b0028b4750c85amr1653011pjb.43.1703002085631; Tue, 19 Dec 2023 08:08:05 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id pw5-20020a17090b278500b0028593e9eaadsm1783303pjb.31.2023.12.19.08.07.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:07:55 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 410A474063A; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 4/9] elf: Always provide _dl_get_dl_main_map in libc.a Date: Tue, 19 Dec 2023 08:07:35 -0800 Message-ID: <20231219160740.3079330-5-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Always provide _dl_get_dl_main_map in libc.a. It will be used by x86 to process PT_GNU_PROPERTY segment. --- elf/dl-support.c | 2 -- sysdeps/generic/ldsodefs.h | 8 ++++---- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/elf/dl-support.c b/elf/dl-support.c index 837fa1c836..70c5b3599a 100644 --- a/elf/dl-support.c +++ b/elf/dl-support.c @@ -344,7 +344,6 @@ _dl_non_dynamic_init (void) DL_SYSINFO_IMPLEMENTATION #endif -#if ENABLE_STATIC_PIE /* Since relocation to hidden _dl_main_map causes relocation overflow on aarch64, a function is used to get the address of _dl_main_map. */ @@ -353,7 +352,6 @@ _dl_get_dl_main_map (void) { return &_dl_main_map; } -#endif /* This is used by _dl_runtime_profile, not used on static code. */ void diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h index 9b50ddd09f..0e8a008a49 100644 --- a/sysdeps/generic/ldsodefs.h +++ b/sysdeps/generic/ldsodefs.h @@ -1172,10 +1172,6 @@ void __libc_setup_tls (void); # if ENABLE_STATIC_PIE /* Relocate static executable with PIE. */ extern void _dl_relocate_static_pie (void) attribute_hidden; - -/* Get a pointer to _dl_main_map. */ -extern struct link_map * _dl_get_dl_main_map (void) - __attribute__ ((visibility ("hidden"))); # else # define _dl_relocate_static_pie() # endif @@ -1217,6 +1213,10 @@ rtld_hidden_proto (_dl_deallocate_tls) extern void _dl_nothread_init_static_tls (struct link_map *) attribute_hidden; +/* Get a pointer to _dl_main_map. */ +extern struct link_map * _dl_get_dl_main_map (void) + __attribute__ ((visibility ("hidden"))); + /* Find origin of the executable. */ extern const char *_dl_get_origin (void) attribute_hidden; From patchwork Tue Dec 19 16:07:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878065 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=IGfgXCYZ; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhTy2yDDz20Gb for ; Wed, 20 Dec 2023 03:09:42 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 32FCA386D618 for ; Tue, 19 Dec 2023 16:09:37 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com [IPv6:2607:f8b0:4864:20::433]) by sourceware.org (Postfix) with ESMTPS id 7F39E3860769 for ; Tue, 19 Dec 2023 16:08:29 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7F39E3860769 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7F39E3860769 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::433 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002112; cv=none; b=b4utn08O5ZR5kLrv18HrW3RIC1ZxVtKxRy8MineNValiZrP9XXBo4TrvczthsoP2PzibUMHV9XvPkrn4OW/lig8sfiqJDOUxkGtOp28WvBSUNT5s3hrggBC1Mc6YWcTJmEh6IH3FX9bO2sRkEysWrdI0AjsYrEzZTMrXW+FZdVY= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002112; c=relaxed/simple; bh=pA6BPG8wsC+1rIbqp4XcoYZ2vXLFP5+ZY9/2TnpSKtQ=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=KmvlzTXwUOWwt3viTp+52Bi1tUKlr/OdMDJFqCGLaNypEqky6qiqs6fv4EyJABJO4jJhPMIW2PxtUiUfhr2UgSFkpWSOeiLhfMQMS4HC3gz2o4VRtD/DktA2CCPkORckwaBLI8gRpDRYluwi8LbWUstQlM+h7vJF4WTG6TTnq70= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x433.google.com with SMTP id d2e1a72fcca58-6d741fb7c8eso2378687b3a.2 for ; Tue, 19 Dec 2023 08:08:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002108; x=1703606908; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=w1D2EylYV9b/f4Ars25AyfbEe7+2l9nwJs86HEkWjTg=; b=IGfgXCYZuxmSvqQd2WqSyk1unWXvMMy6VoJ+J2rwsVJDNI6rbAQj20Uxl2y4w4VyEm x67mRWzJIr+lk//uJJgajdPTr+mM68f2I87nYmcSs7UlyIXY7yfIIveSHtosHZNpMkjZ rniR4VkQOrnjIhJk5kRL0cX5SQMHFY9vwfh4kJJwPfVHIBPhlu8OPh0Y6yT7dlXvtWxv UqvislhlS4SMHqkB8IZuE8iZWZv0zbk/v6fKQ2lFr5hh3QgtudlPA+F+ol6K7KRM2l2T 1okg4DVD6PlkdcTmjPr4GX7mUY3Qxx3vT1/BrGD+vcN1DNFjjs+elso2hxZa0B+srN3B 0Cuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002108; x=1703606908; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=w1D2EylYV9b/f4Ars25AyfbEe7+2l9nwJs86HEkWjTg=; b=Hy2QCqw6WaHTQcn38ePiRsExVkxfQeMoOCvLPLblCWKQO5Bndwz55PaG+gNvtHhz78 p1AocKo2CLkd1dGFcZiUtNCtulvnl3dkbF4yh6eZ2kl2v+4vA7WbAY5u/Xsu/79WxIxS 7f2tMdLxvDX8lRmK3M/R2yIsjELNMrYkOC7OOU3Oo4se0RUTt/mdIUYGoD4Vz2xnlHOX EMAOE6G8qRw+aWjIHykvXdYgt5vDS7rc6wlrBGfjTkK9ahNoFQZTVdO/kq/nSX0we7dg 7tOv7iGAYCR78kAxmuS84hVSvdFDDLyAMzJRc+8Hdagu9gE0S5h/PkYwil+cidMV3wb4 mgkQ== X-Gm-Message-State: AOJu0Ywb/0LZEt6lnXwun6wzZ96+tndisOKYZD5pgGoEf58yRTaaLLr6 wZRZ8zpamyRVKjH9lrdo8W4ioPads2Q= X-Google-Smtp-Source: AGHT+IH+hVgDpnPPrrvFu4SaPzGh6wq1MaoIF8nWFpoc4VuiC0NDyYXeLMvs1mZoipArB0V6cJrpfg== X-Received: by 2002:a05:6a00:3012:b0:6d8:2e9a:5d3c with SMTP id ay18-20020a056a00301200b006d82e9a5d3cmr3723607pfb.38.1703002108328; Tue, 19 Dec 2023 08:08:28 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id h18-20020a056a00171200b006d45b47612csm5664569pfc.89.2023.12.19.08.08.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:08:18 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 4C3AD74063C; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 5/9] x86/cet: Enable shadow stack during startup Date: Tue, 19 Dec 2023 08:07:36 -0800 Message-ID: <20231219160740.3079330-6-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Previously, CET was enabled by kernel before passing control to user space and the startup code must disable CET if applications or shared libraries aren't CET enabled. Since the current kernel only supports shadow stack and won't enable shadow stack before passing control to user space, we need to enable shadow stack during startup if the application and all shared library are shadow stack enabled. There is no need to disable shadow stack at startup. Shadow stack can only be enabled in a function which will never return. Otherwise, shadow stack will underflow at the function return. 1. GL(dl_x86_feature_1) is set to the CET features which are supported by the processor and are not disabled by the tunable. Only non-zero features in GL(dl_x86_feature_1) should be enabled. After enabling shadow stack with ARCH_SHSTK_ENABLE, ARCH_SHSTK_STATUS is used to check if shadow stack is really enabled. 2. Use ARCH_SHSTK_ENABLE in RTLD_START in dynamic executable. It is safe since RTLD_START never returns. 3. Call arch_prctl (ARCH_SHSTK_ENABLE) from ARCH_SETUP_TLS in static executable. Since the start function using ARCH_SETUP_TLS never returns, it is safe to enable shadow stack in ARCH_SETUP_TLS. --- sysdeps/unix/sysv/linux/x86/cpu-features.c | 49 -------------- sysdeps/unix/sysv/linux/x86/dl-cet.h | 23 +++++++ sysdeps/unix/sysv/linux/x86_64/dl-cet.h | 47 +++++++++++++ sysdeps/x86/cpu-features-offsets.sym | 1 + sysdeps/x86/cpu-features.c | 51 -------------- sysdeps/x86/dl-cet.c | 77 +++++++++++----------- sysdeps/x86/get-cpuid-feature-leaf.c | 2 +- sysdeps/x86/include/cpu-features.h | 3 + sysdeps/x86/libc-start.h | 54 ++++++++++++++- sysdeps/x86_64/dl-machine.h | 12 +++- 10 files changed, 175 insertions(+), 144 deletions(-) delete mode 100644 sysdeps/unix/sysv/linux/x86/cpu-features.c create mode 100644 sysdeps/unix/sysv/linux/x86_64/dl-cet.h diff --git a/sysdeps/unix/sysv/linux/x86/cpu-features.c b/sysdeps/unix/sysv/linux/x86/cpu-features.c deleted file mode 100644 index 0e6e2bf855..0000000000 --- a/sysdeps/unix/sysv/linux/x86/cpu-features.c +++ /dev/null @@ -1,49 +0,0 @@ -/* Initialize CPU feature data for Linux/x86. - This file is part of the GNU C Library. - Copyright (C) 2018-2023 Free Software Foundation, Inc. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; if not, see - . */ - -#if CET_ENABLED -# include -# include - -static inline int __attribute__ ((always_inline)) -get_cet_status (void) -{ - unsigned long long kernel_feature; - unsigned int status = 0; - if (INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_STATUS, - &kernel_feature) == 0) - { - if ((kernel_feature & ARCH_SHSTK_SHSTK) != 0) - status = GNU_PROPERTY_X86_FEATURE_1_SHSTK; - } - return status; -} - -# ifndef SHARED -static inline void -x86_setup_tls (void) -{ - __libc_setup_tls (); - THREAD_SETMEM (THREAD_SELF, header.feature_1, GL(dl_x86_feature_1)); -} - -# define ARCH_SETUP_TLS() x86_setup_tls () -# endif -#endif - -#include diff --git a/sysdeps/unix/sysv/linux/x86/dl-cet.h b/sysdeps/unix/sysv/linux/x86/dl-cet.h index da220ac627..634c885d33 100644 --- a/sysdeps/unix/sysv/linux/x86/dl-cet.h +++ b/sysdeps/unix/sysv/linux/x86/dl-cet.h @@ -38,3 +38,26 @@ dl_cet_lock_cet (unsigned int cet_feature) return (int) INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_LOCK, kernel_feature); } + +static inline unsigned int __attribute__ ((always_inline)) +dl_cet_get_cet_status (void) +{ + unsigned long long kernel_feature; + unsigned int status = 0; + if (INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_STATUS, + &kernel_feature) == 0) + { + if ((kernel_feature & ARCH_SHSTK_SHSTK) != 0) + status = GNU_PROPERTY_X86_FEATURE_1_SHSTK; + } + return status; +} + +/* Enable shadow stack with a macro to avoid shadow stack underflow. */ +#define ENABLE_X86_CET(cet_feature) \ + if ((cet_feature & GNU_PROPERTY_X86_FEATURE_1_SHSTK)) \ + { \ + long long int kernel_feature = ARCH_SHSTK_SHSTK; \ + INTERNAL_SYSCALL_CALL (arch_prctl, ARCH_SHSTK_ENABLE, \ + kernel_feature); \ + } diff --git a/sysdeps/unix/sysv/linux/x86_64/dl-cet.h b/sysdeps/unix/sysv/linux/x86_64/dl-cet.h new file mode 100644 index 0000000000..e23e05c6b8 --- /dev/null +++ b/sysdeps/unix/sysv/linux/x86_64/dl-cet.h @@ -0,0 +1,47 @@ +/* Linux/x86-64 CET initializers function. + Copyright (C) 2023 Free Software Foundation, Inc. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include_next + +#define X86_STRINGIFY_1(x) #x +#define X86_STRINGIFY(x) X86_STRINGIFY_1 (x) + +/* Enable shadow stack before calling _dl_init if it is enabled in + GL(dl_x86_feature_1). Call _dl_setup_x86_features to setup shadow + stack. */ +#define RTLD_START_ENABLE_X86_FEATURES \ +"\ + # Check if shadow stack is enabled in GL(dl_x86_feature_1).\n\ + movl _rtld_local+" X86_STRINGIFY (RTLD_GLOBAL_DL_X86_FEATURE_1_OFFSET) "(%rip), %edx\n\ + testl $" X86_STRINGIFY (X86_FEATURE_1_SHSTK) ", %edx\n\ + jz 1f\n\ + # Enable shadow stack if enabled in GL(dl_x86_feature_1).\n\ + movl $" X86_STRINGIFY (ARCH_SHSTK_SHSTK) ", %esi\n\ + movl $" X86_STRINGIFY (ARCH_SHSTK_ENABLE) ", %edi\n\ + movl $" X86_STRINGIFY (__NR_arch_prctl) ", %eax\n\ + syscall\n\ +1:\n\ + # Pass GL(dl_x86_feature_1) to _dl_cet_setup_features.\n\ + movl %edx, %edi\n\ + # Align stack for the _dl_cet_setup_features call.\n\ + andq $-16, %rsp\n\ + call _dl_cet_setup_features\n\ + # Restore %rax and %rsp from %r12 and %r13.\n\ + movq %r12, %rax\n\ + movq %r13, %rsp\n\ +" diff --git a/sysdeps/x86/cpu-features-offsets.sym b/sysdeps/x86/cpu-features-offsets.sym index 6d03cea8e8..5429f60632 100644 --- a/sysdeps/x86/cpu-features-offsets.sym +++ b/sysdeps/x86/cpu-features-offsets.sym @@ -4,3 +4,4 @@ RTLD_GLOBAL_RO_DL_X86_CPU_FEATURES_OFFSET offsetof (struct rtld_global_ro, _dl_x86_cpu_features) XSAVE_STATE_SIZE_OFFSET offsetof (struct cpu_features, xsave_state_size) +RTLD_GLOBAL_DL_X86_FEATURE_1_OFFSET offsetof (struct rtld_global, _dl_x86_feature_1) diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c index f180f0d9a4..097868c1d9 100644 --- a/sysdeps/x86/cpu-features.c +++ b/sysdeps/x86/cpu-features.c @@ -1106,57 +1106,6 @@ no_cpuid: TUNABLE_CALLBACK (set_x86_ibt)); TUNABLE_GET (x86_shstk, tunable_val_t *, TUNABLE_CALLBACK (set_x86_shstk)); - - /* Check CET status. */ - unsigned int cet_status = get_cet_status (); - - if ((cet_status & GNU_PROPERTY_X86_FEATURE_1_IBT) == 0) - CPU_FEATURE_UNSET (cpu_features, IBT) - if ((cet_status & GNU_PROPERTY_X86_FEATURE_1_SHSTK) == 0) - CPU_FEATURE_UNSET (cpu_features, SHSTK) - - if (cet_status) - { - GL(dl_x86_feature_1) = cet_status; - -# ifndef SHARED - /* Check if IBT and SHSTK are enabled by kernel. */ - if ((cet_status - & (GNU_PROPERTY_X86_FEATURE_1_IBT - | GNU_PROPERTY_X86_FEATURE_1_SHSTK))) - { - /* Disable IBT and/or SHSTK if they are enabled by kernel, but - disabled by environment variable: - - GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK - */ - unsigned int cet_feature = 0; - if (!CPU_FEATURE_USABLE (IBT)) - cet_feature |= (cet_status - & GNU_PROPERTY_X86_FEATURE_1_IBT); - if (!CPU_FEATURE_USABLE (SHSTK)) - cet_feature |= (cet_status - & GNU_PROPERTY_X86_FEATURE_1_SHSTK); - - if (cet_feature) - { - int res = dl_cet_disable_cet (cet_feature); - - /* Clear the disabled bits in dl_x86_feature_1. */ - if (res == 0) - GL(dl_x86_feature_1) &= ~cet_feature; - } - - /* Lock CET if IBT or SHSTK is enabled in executable. Don't - lock CET if IBT or SHSTK is enabled permissively. */ - if (GL(dl_x86_feature_control).ibt != cet_permissive - && GL(dl_x86_feature_control).shstk != cet_permissive) - dl_cet_lock_cet (GL(dl_x86_feature_1) - & (GNU_PROPERTY_X86_FEATURE_1_IBT - | GNU_PROPERTY_X86_FEATURE_1_SHSTK)); - } -# endif - } #endif #ifndef SHARED diff --git a/sysdeps/x86/dl-cet.c b/sysdeps/x86/dl-cet.c index 8b911fd931..f40f8e17b0 100644 --- a/sysdeps/x86/dl-cet.c +++ b/sysdeps/x86/dl-cet.c @@ -172,40 +172,11 @@ dl_cet_check_startup (struct link_map *m, struct dl_cet_info *info) = info->enable_feature_1 ^ info->feature_1_enabled; if (disable_feature_1 != 0) { - /* Disable features in the kernel because of legacy objects or - cet_always_off. */ - if (dl_cet_disable_cet (disable_feature_1) != 0) - _dl_fatal_printf ("%s: can't disable x86 Features\n", - info->program); - /* Clear the disabled bits. Sync dl_x86_feature_1 and info->feature_1_enabled with info->enable_feature_1. */ info->feature_1_enabled = info->enable_feature_1; GL(dl_x86_feature_1) = info->enable_feature_1; } - - if (HAS_CPU_FEATURE (IBT) || HAS_CPU_FEATURE (SHSTK)) - { - /* Lock CET features only if IBT or SHSTK are enabled and are not - enabled permissively. */ - unsigned int feature_1_lock = 0; - - if (((info->feature_1_enabled & GNU_PROPERTY_X86_FEATURE_1_IBT) - != 0) - && info->enable_ibt_type != cet_permissive) - feature_1_lock |= GNU_PROPERTY_X86_FEATURE_1_IBT; - - if (((info->feature_1_enabled & GNU_PROPERTY_X86_FEATURE_1_SHSTK) - != 0) - && info->enable_shstk_type != cet_permissive) - feature_1_lock |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; - - if (feature_1_lock != 0 - && dl_cet_lock_cet (feature_1_lock) != 0) - _dl_fatal_printf ("%s: can't lock CET\n", info->program); - } - - THREAD_SETMEM (THREAD_SELF, header.feature_1, GL(dl_x86_feature_1)); } #endif @@ -291,6 +262,15 @@ dl_cet_check (struct link_map *m, const char *program) { struct dl_cet_info info; + /* CET is enabled only if RTLD_START_ENABLE_X86_FEATURES is defined. */ +#if defined SHARED && defined RTLD_START_ENABLE_X86_FEATURES + /* Set dl_x86_feature_1 to features enabled in the executable. */ + if (program != NULL) + GL(dl_x86_feature_1) = (m->l_x86_feature_1_and + & (X86_FEATURE_1_IBT + | X86_FEATURE_1_SHSTK)); +#endif + /* Check how IBT and SHSTK should be enabled. */ info.enable_ibt_type = GL(dl_x86_feature_control).ibt; info.enable_shstk_type = GL(dl_x86_feature_control).shstk; @@ -300,17 +280,9 @@ dl_cet_check (struct link_map *m, const char *program) /* No legacy object check if IBT and SHSTK are always on. */ if (info.enable_ibt_type == cet_always_on && info.enable_shstk_type == cet_always_on) - { -#ifdef SHARED - /* Set it only during startup. */ - if (program != NULL) - THREAD_SETMEM (THREAD_SELF, header.feature_1, - info.feature_1_enabled); -#endif - return; - } + return; - /* Check if IBT and SHSTK were enabled by kernel. */ + /* Check if IBT and SHSTK were enabled. */ if (info.feature_1_enabled == 0) return; @@ -344,6 +316,33 @@ _dl_cet_open_check (struct link_map *l) dl_cet_check (l, NULL); } +/* Set GL(dl_x86_feature_1) to the enabled features and clear the + active bits of the disabled features. */ + +attribute_hidden +void +_dl_cet_setup_features (unsigned int cet_feature) +{ + /* NB: cet_feature == GL(dl_x86_feature_1) which is set to features + enabled from executable, not necessarily supported by kernel. */ + if (cet_feature) + { + cet_feature = dl_cet_get_cet_status (); + if (cet_feature) + { + THREAD_SETMEM (THREAD_SELF, header.feature_1, cet_feature); + + /* Lock CET if IBT or SHSTK is enabled in executable. Don't + lock CET if IBT or SHSTK is enabled permissively. */ + if (GL(dl_x86_feature_control).ibt != cet_permissive + && (GL(dl_x86_feature_control).shstk != cet_permissive)) + dl_cet_lock_cet (cet_feature); + } + /* Sync GL(dl_x86_feature_1) with kernel. */ + GL(dl_x86_feature_1) = cet_feature; + } +} + #ifdef SHARED # ifndef LINKAGE diff --git a/sysdeps/x86/get-cpuid-feature-leaf.c b/sysdeps/x86/get-cpuid-feature-leaf.c index 40a46cc79c..9317a6b494 100644 --- a/sysdeps/x86/get-cpuid-feature-leaf.c +++ b/sysdeps/x86/get-cpuid-feature-leaf.c @@ -24,7 +24,7 @@ __x86_get_cpuid_feature_leaf (unsigned int leaf) static const struct cpuid_feature feature = {}; if (leaf < CPUID_INDEX_MAX) return ((const struct cpuid_feature *) - &GLRO(dl_x86_cpu_features).features[leaf]); + &GLRO(dl_x86_cpu_features).features[leaf]); else return &feature; } diff --git a/sysdeps/x86/include/cpu-features.h b/sysdeps/x86/include/cpu-features.h index 2d7427a6c0..23bd8146a2 100644 --- a/sysdeps/x86/include/cpu-features.h +++ b/sysdeps/x86/include/cpu-features.h @@ -990,6 +990,9 @@ extern const struct cpu_features *_dl_x86_get_cpu_features (void) # define INIT_ARCH() # define _dl_x86_get_cpu_features() (&GLRO(dl_x86_cpu_features)) extern void _dl_x86_init_cpu_features (void) attribute_hidden; + +extern void _dl_cet_setup_features (unsigned int) + attribute_hidden; #endif #ifdef __x86_64__ diff --git a/sysdeps/x86/libc-start.h b/sysdeps/x86/libc-start.h index e93da6ef3d..856230daeb 100644 --- a/sysdeps/x86/libc-start.h +++ b/sysdeps/x86/libc-start.h @@ -19,7 +19,57 @@ #ifndef SHARED # define ARCH_SETUP_IREL() apply_irel () # define ARCH_APPLY_IREL() -# ifndef ARCH_SETUP_TLS -# define ARCH_SETUP_TLS() __libc_setup_tls () +# ifdef __CET__ +/* Get CET features enabled in the static executable. */ + +static inline unsigned int +get_cet_feature (void) +{ + /* Check if CET is supported and not disabled by tunables. */ + struct cpu_features *cpu_features + = (struct cpu_features *) __get_cpu_features (); + unsigned int cet_feature = 0; + if (CPU_FEATURE_USABLE_P (cpu_features, IBT)) + cet_feature |= GNU_PROPERTY_X86_FEATURE_1_IBT; + if (CPU_FEATURE_USABLE_P (cpu_features, SHSTK)) + cet_feature |= GNU_PROPERTY_X86_FEATURE_1_SHSTK; + if (!cet_feature) + return cet_feature; + + struct link_map *main_map = _dl_get_dl_main_map (); + + /* Scan program headers backward to check PT_GNU_PROPERTY early for + x86 feature bits on static executable. */ + const ElfW(Phdr) *phdr = GL(dl_phdr); + const ElfW(Phdr) *ph; + for (ph = phdr + GL(dl_phnum); ph != phdr; ph--) + if (ph[-1].p_type == PT_GNU_PROPERTY) + { + _dl_process_pt_gnu_property (main_map, -1, &ph[-1]); + /* Enable IBT and SHSTK only if they are enabled on static + executable. */ + cet_feature &= (main_map->l_x86_feature_1_and + & (GNU_PROPERTY_X86_FEATURE_1_IBT + | GNU_PROPERTY_X86_FEATURE_1_SHSTK)); + /* Set GL(dl_x86_feature_1) to the enabled CET features. */ + GL(dl_x86_feature_1) = cet_feature; + break; + } + + return cet_feature; +} + +/* The function using this macro to enable shadow stack must not return + to avoid shadow stack underflow. */ +# define ARCH_SETUP_TLS() \ + { \ + __libc_setup_tls (); \ + \ + unsigned int cet_feature = get_cet_feature (); \ + ENABLE_X86_CET (cet_feature); \ + _dl_cet_setup_features (cet_feature); \ + } +# else +# define ARCH_SETUP_TLS() __libc_setup_tls () # endif #endif /* !SHARED */ diff --git a/sysdeps/x86_64/dl-machine.h b/sysdeps/x86_64/dl-machine.h index 581a2f1a9e..faeae723cb 100644 --- a/sysdeps/x86_64/dl-machine.h +++ b/sysdeps/x86_64/dl-machine.h @@ -29,6 +29,11 @@ #include #include #include +#ifdef __CET__ +# include +#else +# define RTLD_START_ENABLE_X86_FEATURES +#endif /* Return nonzero iff ELF header is compatible with the running host. */ static inline int __attribute__ ((unused)) @@ -146,13 +151,16 @@ _start:\n\ _dl_start_user:\n\ # Save the user entry point address in %r12.\n\ movq %rax, %r12\n\ + # Save %rsp value in %r13.\n\ + movq %rsp, %r13\n\ +"\ + RTLD_START_ENABLE_X86_FEATURES \ +"\ # Read the original argument count.\n\ movq (%rsp), %rdx\n\ # Call _dl_init (struct link_map *main_map, int argc, char **argv, char **env)\n\ # argc -> rsi\n\ movq %rdx, %rsi\n\ - # Save %rsp value in %r13.\n\ - movq %rsp, %r13\n\ # And align stack for the _dl_init call. \n\ andq $-16, %rsp\n\ # _dl_loaded -> rdi\n\ From patchwork Tue Dec 19 16:07:37 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878056 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=mJDQXXDP; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=8.43.85.97; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhSz5n7hz1ydc for ; Wed, 20 Dec 2023 03:08:51 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id D2AB83860758 for ; Tue, 19 Dec 2023 16:08:49 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pl1-x635.google.com (mail-pl1-x635.google.com [IPv6:2607:f8b0:4864:20::635]) by sourceware.org (Postfix) with ESMTPS id A7DD0386181E for ; Tue, 19 Dec 2023 16:08:29 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A7DD0386181E Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A7DD0386181E Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::635 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002111; cv=none; b=lq1FMnais+Zo93hEmnHOhWn47vIFqJSrXii56rXWm0Md+d8i/Gd6tQRBCTH51qoFaLzrzJ4lojvXIFAfLwGFIQmOIq7zUug0tg4cDU66AC3Ro9kClUjz2/XcQPelvrLIg7hycdlxl/LVuFZBYLQ3v8MKkpfEkoac3ZHkVS4Z7XE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002111; c=relaxed/simple; bh=TbbKXol4dplac/fN2Lhtbgcm6bquwYuTPcEpG6ZOLDk=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=T7lUjritD36EM/prYKYol19gpWC8GI7dqqkOb7b04b5s7Ln6C/A7KXFsOYsD59H/6bUrDquhpMUbPJhSKBrTWGBWZzEZNj5Z5slAJiv+ImPWzv6AorjNsrNqVbu+sdyHuiwBOt5XfOmV7hkClfLhjC8iX81aRkoIvUWSQjt3ikg= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pl1-x635.google.com with SMTP id d9443c01a7336-1d32c5ce32eso39684565ad.0 for ; Tue, 19 Dec 2023 08:08:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002109; x=1703606909; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ANRVNjPijP3Z9eM3L0G9RkyDQHQgPqv1CKkr0Ocdpjs=; b=mJDQXXDPhSBWrcuYL6BsSOJU2OfiRcafdL/eD/Xh1JXe+sxH4YQQ9Xn9BJCRZHVCa7 XU0iD5fGnMyIhLlUKAkX0FFAZjCZ91SdsVj1KhYmnb0o/4PJDrG6KpXvPqj22svIuvOH i4RDR73UbsKK9oSuJGNb49NvHcykFKcMoLS94DzM0SGiiB435Pggo8sSWeMwnT1XRdKO GqPc75OB0SbRONZIAW+H0rUmBUaoRsD7p6T1hQNDvjoVzbp2DLkv10rgO6fkY9vY4/Is q7HbUg8xFiGrkIuzKNruu9CApGNM97qq/lwgY63t97tfvDY6mYTni8wAFMF5exqVNGgn qrFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002109; x=1703606909; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ANRVNjPijP3Z9eM3L0G9RkyDQHQgPqv1CKkr0Ocdpjs=; b=GFnyEIKP9NQmeyPAkgOP9GAunhueHhABPgTFohy8AMPvXC+SdjZCzTeNEzZtJnE2Cd F/m2FIbdedRKks/Uo7vlwSfI/N2CdVqoV5hYB+/a73tvrzbjpaUA/5eDTPTgeGkKbMtN CuV3l3H1JWpnEXg9ECUY8cH7JudFYhmvP7bIy46EZ9KBT7pkXwIF04FPlPdFvrc0RFF4 aHulI4ELc1RcxCzVW3FAb9wendbJp45804QeXXbZNJV4DCX1+p1Gzcq7Muk5NEtvH435 AYrwGe9PW8Jw0e1Epd9IxaqlAZWe4KWajEY7mHtiMP7oaLwNrvb/8w6UPeP8K7j+Kof5 n46g== X-Gm-Message-State: AOJu0YyJuW5wQfWac5vvsGfFNumB3WqSwmM5DPRb0Ju46WxafxzDEI0+ KJmOXpkdq6mXqcdNgLS65+nTMfzHM8M= X-Google-Smtp-Source: AGHT+IE+kPRLI2qF5bR9jVz99B+ZtaRFCSYWd3cMOyUph8DiaZByPoRzqn9ov5E8/f3Mh3vUrShmtg== X-Received: by 2002:a17:90a:f98d:b0:28b:bc34:edb4 with SMTP id cq13-20020a17090af98d00b0028bbc34edb4mr1395107pjb.10.1703002108492; Tue, 19 Dec 2023 08:08:28 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id ok13-20020a17090b1d4d00b0028aea6c24bcsm1807573pjb.53.2023.12.19.08.08.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:08:18 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 5816B74063E; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 6/9] x86/cet: Check feature_1 in TCB for active IBT and SHSTK Date: Tue, 19 Dec 2023 08:07:37 -0800 Message-ID: <20231219160740.3079330-7-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Initially, IBT and SHSTK are marked as active when CPU supports them and CET are enabled in glibc. They can be disabled early by tunables before relocation. Since after relocation, GLRO(dl_x86_cpu_features) becomes read-only, we can't update GLRO(dl_x86_cpu_features) to mark IBT and SHSTK as inactive. Instead, check the feature_1 field in TCB to decide if IBT and SHST are active. --- sysdeps/x86/bits/platform/x86.h | 8 ++++++++ sysdeps/x86/get-cpuid-feature-leaf.c | 11 ++++++++++- sysdeps/x86/sys/platform/x86.h | 17 +++++++++++++++++ 3 files changed, 35 insertions(+), 1 deletion(-) diff --git a/sysdeps/x86/bits/platform/x86.h b/sysdeps/x86/bits/platform/x86.h index 1e23d53ba2..1575ae53fb 100644 --- a/sysdeps/x86/bits/platform/x86.h +++ b/sysdeps/x86/bits/platform/x86.h @@ -337,3 +337,11 @@ enum x86_cpu_AVX10_YMM = x86_cpu_index_24_ecx_0_ebx + 17, x86_cpu_AVX10_ZMM = x86_cpu_index_24_ecx_0_ebx + 18, }; + +/* Bits in the feature_1 field in TCB. */ + +enum +{ + x86_feature_1_ibt = 1U << 0, + x86_feature_1_shstk = 1U << 1 +}; diff --git a/sysdeps/x86/get-cpuid-feature-leaf.c b/sysdeps/x86/get-cpuid-feature-leaf.c index 9317a6b494..f69936b31e 100644 --- a/sysdeps/x86/get-cpuid-feature-leaf.c +++ b/sysdeps/x86/get-cpuid-feature-leaf.c @@ -15,9 +15,18 @@ License along with the GNU C Library; if not, see . */ - +#include +#include #include +#ifdef __x86_64__ +# ifdef __LP64__ +_Static_assert (FEATURE_1_OFFSET == 72, "FEATURE_1_OFFSET != 72"); +# else +_Static_assert (FEATURE_1_OFFSET == 40, "FEATURE_1_OFFSET != 40"); +# endif +#endif + const struct cpuid_feature * __x86_get_cpuid_feature_leaf (unsigned int leaf) { diff --git a/sysdeps/x86/sys/platform/x86.h b/sysdeps/x86/sys/platform/x86.h index 1ea2c5fc0b..89b1b16f22 100644 --- a/sysdeps/x86/sys/platform/x86.h +++ b/sysdeps/x86/sys/platform/x86.h @@ -45,6 +45,23 @@ x86_cpu_present (unsigned int __index) static __inline__ _Bool x86_cpu_active (unsigned int __index) { + if (__index == x86_cpu_IBT || __index == x86_cpu_SHSTK) + { +#ifdef __x86_64__ + unsigned int __feature_1; +# ifdef __LP64__ + __asm__ ("mov %%fs:72, %0" : "=r" (__feature_1)); +# else + __asm__ ("mov %%fs:40, %0" : "=r" (__feature_1)); +# endif + if (__index == x86_cpu_IBT) + return __feature_1 & x86_feature_1_ibt; + else + return __feature_1 & x86_feature_1_shstk; +#else + return false; +#endif + } const struct cpuid_feature *__ptr = __x86_get_cpuid_feature_leaf (__index / (8 * sizeof (unsigned int) * 4)); unsigned int __reg From patchwork Tue Dec 19 16:07:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878058 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=GdctIqXL; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhTL5VF5z1ydc for ; Wed, 20 Dec 2023 03:09:10 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 86D62386181D for ; Tue, 19 Dec 2023 16:09:08 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x42f.google.com (mail-pf1-x42f.google.com [IPv6:2607:f8b0:4864:20::42f]) by sourceware.org (Postfix) with ESMTPS id 94EA43860750 for ; Tue, 19 Dec 2023 16:08:33 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 94EA43860750 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 94EA43860750 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::42f ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002115; cv=none; b=VTQmwZNu00l+g3qb+/l5sE43a1mr7EOb/8oQv4XRo5BSG4zTDfKc7u0hZSaHgwqNUX1R0lJRi2mz9ySfhpaa+nxMT3YKoeAr+zE+dMTf+blHrH1uimGdLURaDSjMn5Itrkf6DzTQHguMKXM+Lmydp7nBB6PRjNpNDF1dZrZtRmE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002115; c=relaxed/simple; bh=ig8yVNS33DSIzZRILpAAcWGpEK8ng+DxJGNxxwkVbxA=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=mhG3I5poFIPiTf+Or4+CIgVNVYpOPvWdinsbBzPnYPjt0unN9W3KytOzXVLswOwBBxIWJ8eonaWPmg30EkzMEOK2fsGoweug8K+9Cs37heQA8+VAU6z+WPzNeXDhiGzgQd2CmYpdAoztq0cbd8nIqe3q1/ktrXFkAiQ4P9vKFwA= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x42f.google.com with SMTP id d2e1a72fcca58-6d7609cb6d2so1394692b3a.1 for ; Tue, 19 Dec 2023 08:08:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002112; x=1703606912; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=8TjL1hT0UjJW4esKgCnzilwhWmAYiLuD2V973GWJvac=; b=GdctIqXLg5H1hwgE4GpY1TUSFKvQu25eKQ7dtSMsN9XPPKRQCIa6LX6FldAVO/J18u hRinYyfNgRa0X/l0tCYxeL49HNJQ3A/6UvgbZP3vU/uCfXvTLE/r7pv3ymKToept9fZ6 9xfSMnz8Fna2S+Yu5ld4QErkbkLsnXPBdnjBqDpbsNE5PagvunVCcznjSs/ULKyZNB4a asvNMqWjr1CVeUHON3Cbn5QfzbfVL5lUfJwgatsPgj08qGSF77PbL87Wvrylj8arhQNV ZEnIEsWMVIRSid8lY7hQ6oEfP0+ex8FeBK3zHnP2ATJy9QiPb1H3HfHy39ROXpi342Y1 ggLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002112; x=1703606912; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=8TjL1hT0UjJW4esKgCnzilwhWmAYiLuD2V973GWJvac=; b=KCd0mhNw0IWryRfLdKSNEeX+1b6oQz2aTceYnmssiUHsiYAfrF9CKvefwH2CESFJjb IEDoyaelOIXRLMfFyQ2Ur2nOcbtpZvrckh3+Ddw4OcZICMHid1h/QxngayyR1pMrAQK5 UaILLSkx81P/OmoJABBgW1KWIKYdtv01lLspSwGYGJndfq4Tmhqum8xnwSpgQ/cRSOoX BDzNPM07f0YozyRTmXAzF0R8r6mWiSBjHWd8uDwQ3i4zJNzRgoO0lPQYkgQ1FeBZMkvm ao7Qw/fkac18croK7cHLvdaIlpI6ywoR6l9RpnOnhbQ2FyINnAyiID7oWmNa/sn7XUVA vixA== X-Gm-Message-State: AOJu0YyhvQOvP3WE0PmY3CSa/cuuzRt5XeT7QgsaTSoTUmHtd08rZwMk TAS6BXAFlG8Ljjfy0THhWWXUF0SqC7U= X-Google-Smtp-Source: AGHT+IEQbm4YKVBFX/betX04kOjdvHrsC3GdMJtH5+W9FQcP94ao3AeDuL0Qut10pVF5d+yTRGP05Q== X-Received: by 2002:a05:6a20:b289:b0:194:4cae:5eb1 with SMTP id ei9-20020a056a20b28900b001944cae5eb1mr1954493pzb.99.1703002112545; Tue, 19 Dec 2023 08:08:32 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id x1-20020a63db41000000b005cdad153d84sm2516419pgi.90.2023.12.19.08.08.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:08:19 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 6434D740640; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 7/9] x86/cet: Don't disable CET if not single threaded Date: Tue, 19 Dec 2023 08:07:38 -0800 Message-ID: <20231219160740.3079330-8-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org In permissive mode, don't disable IBT nor SHSTK when dlopening a legacy shared library if not single threaded since IBT and SHSTK may be still enabled in other threads. Other threads with IBT or SHSTK enabled will crash when calling functions in the legacy shared library. Instead, an error will be issued. --- sysdeps/x86/dl-cet.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/sysdeps/x86/dl-cet.c b/sysdeps/x86/dl-cet.c index f40f8e17b0..25add215f2 100644 --- a/sysdeps/x86/dl-cet.c +++ b/sysdeps/x86/dl-cet.c @@ -20,6 +20,7 @@ #include #include #include +#include /* GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK are defined in , which are only available for C sources. @@ -204,7 +205,10 @@ dl_cet_check_dlopen (struct link_map *m, struct dl_cet_info *info) && (info->feature_1_legacy & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0) { - if (info->enable_ibt_type != cet_permissive) + /* Don't disable IBT if not single threaded since IBT may be still + enabled in other threads. */ + if (info->enable_ibt_type != cet_permissive + || !SINGLE_THREAD_P) { legacy_obj = info->feature_1_legacy_ibt; msg = N_("rebuild shared object with IBT support enabled"); @@ -220,7 +224,10 @@ dl_cet_check_dlopen (struct link_map *m, struct dl_cet_info *info) && (info->feature_1_legacy & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0) { - if (info->enable_shstk_type != cet_permissive) + /* Don't disable SHSTK if not single threaded since SHSTK may be + still enabled in other threads. */ + if (info->enable_shstk_type != cet_permissive + || !SINGLE_THREAD_P) { legacy_obj = info->feature_1_legacy_shstk; msg = N_("rebuild shared object with SHSTK support enabled"); From patchwork Tue Dec 19 16:07:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878060 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=Ll3Kse7+; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=8.43.85.97; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhTR3J2Dz20Gb for ; Wed, 20 Dec 2023 03:09:15 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id DD27C3864C5D for ; Tue, 19 Dec 2023 16:09:12 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com [IPv6:2607:f8b0:4864:20::1031]) by sourceware.org (Postfix) with ESMTPS id DFB7F3861824 for ; Tue, 19 Dec 2023 16:08:31 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DFB7F3861824 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org DFB7F3861824 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::1031 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002115; cv=none; b=p4ywhCh4hAfZZebnOfzHxPM9koU0YR/rH4s80AuOgdZSpudTiY3CU1blLKZ1eD1kiK4jSMuXOeB8dcExvomtirw3OinQpXGhIcg6gciOw3omNXp81EoKjlOE0CCe1UouyaIQuQWmYn6k95A3ZnP5cIryqvNh51MkE3jHHA8M2G4= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002115; c=relaxed/simple; bh=gR6QyUCQ5OMmT+W9sFsE9mMHpSS82h6yuYpb3Zra2wg=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=mXls81Iw6KLhQs8OZhLfZsG2HRl3SNZaNPNQRStB/1XhVVzrvVwkqiZ3gu2+6xtGzTtUsc9ZbAugdaN6Y6ruemC1MnogL03W7M8qaBvqF3uudZDxvFMfw+Q9Nsv7OEcalZnwVsiZOnxjaJ78YJj1LYQUtNt6EREc3w7rkBLBIU4= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pj1-x1031.google.com with SMTP id 98e67ed59e1d1-28b4d7bf8bdso1387961a91.3 for ; Tue, 19 Dec 2023 08:08:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002111; x=1703606911; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=02wFt/hupQSOa0L6pMUGdQzAi2lHuhmlk5WjJ8O6HvU=; b=Ll3Kse7+JKkVXkmfFoL/Ei9zIw2uQvPv+X6r3sklXRsRvc+LKMm9dcbDEzJMjPmzqi u6P8N4uUZrdhkg4Pq/Ze9LuJNPanmuXNOJxRG44GUSn1Zd63JOA5TsJeiGYXOLCa+wQh Q4JrXMamvKJkb7/0Agr0obnH2M6glTnk5gTP/ohFmb4kV4aqQudt/NNjev9CSBL9Xt1D wdjPTcmNNCAaHzcZKZa5j7I3h5T/qvBT0MCkj4kP7N3nYPm7L8DNFVDOKAEWuQoV4sAR kui7LDBuOHN/RGm5j4IJFyzZySWFqoDa+qNZkAVoCB9tixbevQDyRVAoK5+T4r87lJeu mQ3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002111; x=1703606911; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=02wFt/hupQSOa0L6pMUGdQzAi2lHuhmlk5WjJ8O6HvU=; b=obKeH3gyMfzJjQYSQYqiNB9Mpcd8fNxatk10gt7C+J3r/2jwy9nz6kdmdxD5pN3Dly GOcUcUFHdzOtKHC2W9kpfGRw2j6s2z0HUymi89nLdHmeXmpM09dt4DPz8fSzSaSupM7w uhmznMSaMPdM80/z08B8M8oES+8KOeV73Dc5Mm6vhGADkLwMHJhEeGmR/qzHgCi2tSjI wJovTYYSvIddL/BcSPOpzhicuA4ZFK7kPgBx3aeaBcbLKOs9cB2CS4HOcaJ1p0UZ5Jrv 9nmsBt74OnwQ/vAM6r/XRIZ0/FkBNlO4r2CTSMJFRlIGdVomEtDdB+1TEqJAesgvrIMW vNsw== X-Gm-Message-State: AOJu0YzCL0mRb9dJZ475mlRFEOA4DAI1OScOG6PqzP50bPuGowECmlvi 1KQoWGSipsFYNIwcU+a/HYU= X-Google-Smtp-Source: AGHT+IH6YWGDJe3Zz3AhrJmu+cSKqeSPfWLgOyWcK0n5ygzmWrwwz6TMmOelok94iqdw3mpuxDfqsQ== X-Received: by 2002:a17:90a:7343:b0:286:6afe:63d1 with SMTP id j3-20020a17090a734300b002866afe63d1mr8773220pjs.11.1703002110914; Tue, 19 Dec 2023 08:08:30 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id j5-20020a17090adc8500b0028b66796002sm1753404pjv.6.2023.12.19.08.08.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:08:18 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 70E47740641; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 8/9] x86/cet: Don't set CET active by default Date: Tue, 19 Dec 2023 08:07:39 -0800 Message-ID: <20231219160740.3079330-9-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org Not all CET enabled applications and libraries have been properly tested in CET enabled environments. Some CET enabled applications or libraries will crash or misbehave when CET is enabled. Don't set CET active by default so that all applications and libraries will run normally regardless of whether CET is active or not. Shadow stack can be enabled by $ export GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK at run-time if shadow stack can be enabled by kernel. NB: This commit can be reverted if it is OK to enable CET by default for all applications and libraries. --- sysdeps/x86/cpu-features.c | 2 +- sysdeps/x86/cpu-tunables.c | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c index 097868c1d9..80a07ac589 100644 --- a/sysdeps/x86/cpu-features.c +++ b/sysdeps/x86/cpu-features.c @@ -110,7 +110,7 @@ update_active (struct cpu_features *cpu_features) if (!CPU_FEATURES_CPU_P (cpu_features, RTM_ALWAYS_ABORT)) CPU_FEATURE_SET_ACTIVE (cpu_features, RTM); -#if CET_ENABLED +#if CET_ENABLED && 0 CPU_FEATURE_SET_ACTIVE (cpu_features, IBT); CPU_FEATURE_SET_ACTIVE (cpu_features, SHSTK); #endif diff --git a/sysdeps/x86/cpu-tunables.c b/sysdeps/x86/cpu-tunables.c index 5697885226..8f4f25efb0 100644 --- a/sysdeps/x86/cpu-tunables.c +++ b/sysdeps/x86/cpu-tunables.c @@ -34,6 +34,18 @@ break; \ } +#define CHECK_GLIBC_IFUNC_CPU_BOTH(f, cpu_features, name, \ + disable, len) \ + _Static_assert (sizeof (#name) - 1 == len, #name " != " #len); \ + if (memcmp (f, #name, len) == 0) \ + { \ + if (disable) \ + CPU_FEATURE_UNSET (cpu_features, name) \ + else \ + CPU_FEATURE_SET_ACTIVE (cpu_features, name) \ + break; \ + } + /* Disable a preferred feature NAME. We don't enable a preferred feature which isn't available. */ #define CHECK_GLIBC_IFUNC_PREFERRED_OFF(f, cpu_features, name, len) \ @@ -149,11 +161,14 @@ TUNABLE_CALLBACK (set_hwcaps) (tunable_val_t *valp) } break; case 5: + { + CHECK_GLIBC_IFUNC_CPU_BOTH (n, cpu_features, SHSTK, disable, + 5); + } if (disable) { CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, LZCNT, 5); CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, MOVBE, 5); - CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, SHSTK, 5); CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, SSSE3, 5); CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, XSAVE, 5); } From patchwork Tue Dec 19 16:07:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1878059 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=LsWcnzEK; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=8.43.85.97; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SvhTP1bQVz1ydc for ; Wed, 20 Dec 2023 03:09:13 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 21DF1385E83D for ; Tue, 19 Dec 2023 16:09:11 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by sourceware.org (Postfix) with ESMTPS id 7C97F3861883 for ; Tue, 19 Dec 2023 16:08:35 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7C97F3861883 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7C97F3861883 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::1036 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002117; cv=none; b=eZHS6vkky4Keki/SqxYaZWBPk/6RoSShxd34Uyc/WetfFh/5l35qEVQV/JyDRhtbqWkfnT7mWOBkratP3nA4fl62w3bn7MIEnJ95qCGgX5BG0RIvbyqyMPEp4rztP5UfgRoestFjlkDpztLOgfBv/lL/EvZxIhFTfZsV6HZgajM= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1703002117; c=relaxed/simple; bh=Firs2vtPaO3PKpysQgLiOzcQl5hNwlbOXzdtHcqOjpM=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=UH1/VebGk5D9ahJ4qy/qIPS4E8IFQoH1I89qxh9oidGQyC4wO8PQ49FtWp08fKLywTVyp8htO+0sTdXElw6aJ/+LpbUe2meFTds8QPtfnqgdsXJQOZwFh2/cerPloK3ZZcaCW9HW7f00+whHeWTf7Tz2iWmMuV0YxDZfE8NSvOs= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pj1-x1036.google.com with SMTP id 98e67ed59e1d1-28bcc273833so18956a91.1 for ; Tue, 19 Dec 2023 08:08:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1703002114; x=1703606914; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=929ZGvdUFAKvxIj+iZVtCt4zlFAzvqMB684rflN/xpQ=; b=LsWcnzEKUqs1NcHGJS/z3rk1u10FWRQlo48L/WI818DTEomJ1ie6fFPZ0GaSnLv7Nr j3+imQ8prSx37ezT2nN/QHrC/cdaDJOv00Uig0uz+Nt1N78sCrAx0IlQJqPUVrZalFlA luEDOf2qLM2aR2L0D+5bW4Wp5DS6WwWP2g/WAhrbweGSYjslhKJoQc2V88CDL6CD+zev CmQIhk30GcQ+eumFf1hVzrYyKsv8hifsCCpXwXJN9mAUEE5SQ6J6JeeHG/Rphm0CQHem Tv0qiz9ZpVcVWIAGJd3wgM/4NOcBegn+9tRbhPXy9c16wJD1pAu9dQk4HDFufDNSy989 yTxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703002114; x=1703606914; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=929ZGvdUFAKvxIj+iZVtCt4zlFAzvqMB684rflN/xpQ=; b=DRRSps9lacTQhbAfkDdlW/M6qGjf9TKEkTCkYI+UWP0kukjIlb7kWpY7hDWKDhxQDM p3ZQ/m+uWsYU1cIDCSLcAj8gSxIxxhgJb/iFRXeJFpRRUAUr6M/BR+uGMtvR4LXuWRnI QPJRc/kV4Ut0XhMmbw1XCn+H2yfVG3Z9cC8Ofc/vg2coCYk1kMmH6Co559fCmg3iJxwW CLihKZBK3QksJ8ruLhqBdkg9jkoYp0nd594PFbuFSa+AIxXFZavKRc4EO1qW29LS4ucI odqn3FYBcYieSyuJVAGmxElDJK+FCdl50TypKYxHrZOGxb3XMexLHjwyT4I9f94SYmju BF/w== X-Gm-Message-State: AOJu0Yxe5h/UWSl5cmW+t7qw5xAL8nScLDxI/87hZjUmvzwqQtqdeYut TduZgMP6PMkpJFzFYZ0a2EqKVYh3xKs= X-Google-Smtp-Source: AGHT+IGIrdtBDCEmWi+khkxroSAYpFPXRoHRpdSsf6V7HIGfWlYYPCIfvq8ZK3laFZD55YqHtoOO2A== X-Received: by 2002:a17:90a:4d8f:b0:28b:98b1:b95b with SMTP id m15-20020a17090a4d8f00b0028b98b1b95bmr2110786pjh.10.1703002114453; Tue, 19 Dec 2023 08:08:34 -0800 (PST) Received: from gnu-cfl-3.localdomain ([172.59.129.147]) by smtp.gmail.com with ESMTPSA id r16-20020a17090ad41000b0028b03f9107asm1761487pju.55.2023.12.19.08.08.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 08:08:24 -0800 (PST) Received: from gnu-cfl-3.. (localhost [IPv6:::1]) by gnu-cfl-3.localdomain (Postfix) with ESMTP id 7DAC9740642; Tue, 19 Dec 2023 08:07:41 -0800 (PST) From: "H.J. Lu" To: libc-alpha@sourceware.org Cc: goldstein.w.n@gmail.com, rick.p.edgecombe@intel.com Subject: [PATCH v3 9/9] x86/cet: Run some CET tests with shadow stack Date: Tue, 19 Dec 2023 08:07:40 -0800 Message-ID: <20231219160740.3079330-10-hjl.tools@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231219160740.3079330-1-hjl.tools@gmail.com> References: <20231219160740.3079330-1-hjl.tools@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-3024.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org When CET is disabled by default, run some CET tests with shadow stack enabled using $ export GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK --- sysdeps/x86/Makefile | 14 ++++++++++++++ sysdeps/x86/tst-shstk-legacy-1e-static.sh | 1 + sysdeps/x86/tst-shstk-legacy-1e.sh | 1 + sysdeps/x86/tst-shstk-legacy-1g.sh | 1 + 4 files changed, 17 insertions(+) diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index 6911a07a87..d751eaedf4 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -247,6 +247,13 @@ CFLAGS-tst-cet-legacy-10-static.c += -mshstk CFLAGS-tst-cet-legacy-10a.c += -fcf-protection=none CFLAGS-tst-cet-legacy-10a-static.c += -fcf-protection=none +tst-cet-legacy-4-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-cet-legacy-6-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-cet-legacy-10-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-cet-legacy-10-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-cet-legacy-10a-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-cet-legacy-10a-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK + CFLAGS-tst-shstk-legacy-1a.c += -fcf-protection=none CFLAGS-tst-shstk-legacy-1a-static.c += -fcf-protection=none CFLAGS-tst-shstk-legacy-1d.c += -fcf-protection=none @@ -286,14 +293,20 @@ tst-cet-legacy-6b-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK tst-cet-legacy-9-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK tst-cet-legacy-9-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK +tst-shstk-legacy-1a-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-shstk-legacy-1a-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK $(objpfx)tst-shstk-legacy-1a: $(objpfx)tst-shstk-legacy-1-extra.o $(objpfx)tst-shstk-legacy-1a-static: $(objpfx)tst-shstk-legacy-1-extra.o +tst-shstk-legacy-1b-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-shstk-legacy-1b-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK $(objpfx)tst-shstk-legacy-1b: $(objpfx)tst-shstk-legacy-1-extra.o $(objpfx)tst-shstk-legacy-1b-static: $(objpfx)tst-shstk-legacy-1-extra.o tst-shstk-legacy-1c-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=-SHSTK tst-shstk-legacy-1c-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=-SHSTK $(objpfx)tst-shstk-legacy-1c: $(objpfx)tst-shstk-legacy-1-extra.o $(objpfx)tst-shstk-legacy-1c-static: $(objpfx)tst-shstk-legacy-1-extra.o +tst-shstk-legacy-1d-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK +tst-shstk-legacy-1d-static-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK $(objpfx)tst-shstk-legacy-1d: $(objpfx)tst-shstk-legacy-1-extra.o $(objpfx)tst-shstk-legacy-1d-static: $(objpfx)tst-shstk-legacy-1-extra.o $(objpfx)tst-shstk-legacy-1e: $(objpfx)tst-shstk-legacy-1-extra.o @@ -307,6 +320,7 @@ $(objpfx)tst-shstk-legacy-1e-static.out: \ $(objpfx)tst-shstk-legacy-1e-static $(SHELL) $< $(common-objpfx) 2> $@; \ $(evaluate-test) +tst-shstk-legacy-1f-ENV = GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK $(objpfx)tst-shstk-legacy-1f: $(objpfx)tst-shstk-legacy-mod-1.so $(objpfx)tst-shstk-legacy-mod-1.so: \ $(objpfx)tst-shstk-legacy-mod-1.os \ diff --git a/sysdeps/x86/tst-shstk-legacy-1e-static.sh b/sysdeps/x86/tst-shstk-legacy-1e-static.sh index e943aec70e..008c50dae3 100755 --- a/sysdeps/x86/tst-shstk-legacy-1e-static.sh +++ b/sysdeps/x86/tst-shstk-legacy-1e-static.sh @@ -20,6 +20,7 @@ common_objpfx=$1; shift +GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK \ ${common_objpfx}elf/tst-shstk-legacy-1e-static # The exit status should only be unsupported (77) or segfault (139). status=$? diff --git a/sysdeps/x86/tst-shstk-legacy-1e.sh b/sysdeps/x86/tst-shstk-legacy-1e.sh index b0467aa899..82f2acbf75 100755 --- a/sysdeps/x86/tst-shstk-legacy-1e.sh +++ b/sysdeps/x86/tst-shstk-legacy-1e.sh @@ -21,6 +21,7 @@ common_objpfx=$1; shift test_program_prefix=$1; shift +GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK \ ${test_program_prefix} \ ${common_objpfx}elf/tst-shstk-legacy-1e # The exit status should only be unsupported (77) or segfault (139). diff --git a/sysdeps/x86/tst-shstk-legacy-1g.sh b/sysdeps/x86/tst-shstk-legacy-1g.sh index c112bf6d8d..261eef7cac 100755 --- a/sysdeps/x86/tst-shstk-legacy-1g.sh +++ b/sysdeps/x86/tst-shstk-legacy-1g.sh @@ -21,6 +21,7 @@ common_objpfx=$1; shift test_program_prefix=$1; shift +GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK \ ${test_program_prefix} \ ${common_objpfx}elf/tst-shstk-legacy-1g # The exit status should only be unsupported (77) or segfault (139).