When an indirect CALL/JMP instruction is executed and before it reaches the target, it is in 'WAIT_ENDBR' status, which can be read from MSR_IA32_U_CET. The status is part of a task's status before a signal is raised and preserved in the signal frame. It is restored for sigreturn.
IBT state machine is described in Intel SDM Vol. 1, Sec. 18.3. Signed-off-by: Yu-cheng Yu <[email protected]> Cc: Kees Cook <[email protected]> --- v24: - Update for changes from splitting shadow stack and ibt. arch/x86/kernel/fpu/signal.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index 2e56f2fe8be0..1f54c18607c9 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -71,16 +71,32 @@ int save_extra_state_to_sigframe(int ia32, void __user *fp, unsigned long restor return err; ext.ssp = token_addr; + } + if (new_ssp || cet->ibt_enabled) { fpregs_lock(); if (test_thread_flag(TIF_NEED_FPU_LOAD)) __fpregs_load_activate(); + if (new_ssp) wrmsrl(MSR_IA32_PL3_SSP, new_ssp); + + if (cet->ibt_enabled) { + u64 r; + + rdmsrl(MSR_IA32_U_CET, r); + + if (r & CET_WAIT_ENDBR) { + ext.wait_endbr = 1; + r &= ~CET_WAIT_ENDBR; + wrmsrl(MSR_IA32_U_CET, r); + } + } + fpregs_unlock(); } - if (ext.ssp) { + if (ext.ssp || cet->ibt_enabled) { void __user *p = fp; ext.total_size = sizeof(ext); @@ -110,7 +126,8 @@ static int get_extra_state_from_sigframe(int ia32, void __user *fp, struct sc_ex if (!cpu_feature_enabled(X86_FEATURE_CET)) return 0; - if (!cet->shstk_size) + if (!cet->shstk_size && + !cet->ibt_enabled) return 0; memset(ext, 0, sizeof(*ext)); @@ -162,6 +179,13 @@ void restore_extra_state(struct sc_ext *sc_ext) msr_val |= CET_SHSTK_EN; } + if (cet->ibt_enabled) { + msr_val |= (CET_ENDBR_EN | CET_NO_TRACK_EN); + + if (sc_ext->wait_endbr) + msr_val |= CET_WAIT_ENDBR; + } + if (test_thread_flag(TIF_NEED_FPU_LOAD)) cet_user_state->user_cet = msr_val; else @@ -626,7 +650,7 @@ static unsigned long fpu__alloc_sigcontext_ext(unsigned long sp) * sigcontext_ext is at: fpu + fpu_user_xstate_size + * FP_XSTATE_MAGIC2_SIZE, then aligned to 8. */ - if (cet->shstk_size) + if (cet->shstk_size || cet->ibt_enabled) sp -= (sizeof(struct sc_ext) + 8); #endif return sp; -- 2.21.0
