From nobody Sun Feb 8 18:43:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45B02EB64D9 for ; Mon, 10 Jul 2023 08:15:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232995AbjGJIPh (ORCPT ); Mon, 10 Jul 2023 04:15:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38682 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232678AbjGJIOA (ORCPT ); Mon, 10 Jul 2023 04:14:00 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FDD7EB; Mon, 10 Jul 2023 01:13:59 -0700 (PDT) Date: Mon, 10 Jul 2023 08:13:57 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1688976838; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MAG37qGGr89k2BFEqvKK2pP+ysq9/blpIRKXNezQDpM=; b=YNegB55Q8trvUS38HZRYSvqMvSXKrFhEG4PHFl8JQ0NgY0VTqXDSkcLAWLkKb9CPa+xhLt tSmuxE/ghtPc+SkR35LMdrm0DKkHNz+WYgw1A98dzGD9Of5M+Is99tPqojL/rDzqXqcD3A hi/o8ArTdqpv9M5sQJdFi65kLqEDCtmCii1+lgQDwVFGh7geIIm3kvmVhJaJyq2R15P4Er li7ikxcDj5JSjW1fURi63PS8M8Gr/NNgCvXmpA1bWkBbhy0ZRe9vQ1uG2yk6FgFST4Mhy3 KNfPZm65rq5Qq+TTtmgkZRQ2i6Dn/wFnlIfBbdRXvAsezbM592R3+3lzR63tyA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1688976838; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MAG37qGGr89k2BFEqvKK2pP+ysq9/blpIRKXNezQDpM=; b=e5z/H/Bhv0y1UXvQf3ylLo14qnwFwhuP7KD3INIQYOVt5LLjSwzKnAavHNpBIrEAVengz+ 0ZhamlCiz+4/bZDQ== From: "tip-bot2 for Peter Zijlstra" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] x86/cfi: Extend ENDBR sealing to kCFI Cc: Kees Cook , "Peter Zijlstra (Intel)" , Sami Tolvanen , x86@kernel.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Message-ID: <168897683742.404.15642618384381262204.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 9831c6253ace48051189f6d18a15f658f94babc2 Gitweb: https://git.kernel.org/tip/9831c6253ace48051189f6d18a15f658f= 94babc2 Author: Peter Zijlstra AuthorDate: Wed, 21 Jun 2023 22:17:12 +02:00 Committer: Peter Zijlstra CommitterDate: Mon, 10 Jul 2023 09:52:24 +02:00 x86/cfi: Extend ENDBR sealing to kCFI Kees noted that IBT sealing could be extended to kCFI. Fundamentally it is the list of functions that do not have their address taken and are thus never called indirectly. It doesn't matter that objtool uses IBT infrastructure to determine this list, once we have it it can also be used to clobber kCFI hashes and avoid kCFI indirect calls. Suggested-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lkml.kernel.org/r/20230622144321.494426891%40infradead.org --- arch/x86/kernel/alternative.c | 44 +++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index 27e0cb4..04b25a2 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -778,6 +778,8 @@ void __init_or_module noinline apply_returns(s32 *start= , s32 *end) { } =20 #ifdef CONFIG_X86_KERNEL_IBT =20 +static void poison_cfi(void *addr); + static void __init_or_module poison_endbr(void *addr, bool warn) { u32 endbr, poison =3D gen_endbr_poison(); @@ -802,6 +804,9 @@ static void __init_or_module poison_endbr(void *addr, b= ool warn) =20 /* * Generated by: objtool --ibt + * + * Seal the functions for indirect calls by clobbering the ENDBR instructi= ons + * and the kCFI hash value. */ void __init_or_module noinline apply_seal_endbr(s32 *start, s32 *end) { @@ -812,7 +817,7 @@ void __init_or_module noinline apply_seal_endbr(s32 *st= art, s32 *end) =20 poison_endbr(addr, true); if (IS_ENABLED(CONFIG_FINEIBT)) - poison_endbr(addr - 16, false); + poison_cfi(addr - 16); } } =20 @@ -1177,6 +1182,41 @@ err: pr_err("Something went horribly wrong trying to rewrite the CFI implement= ation.\n"); } =20 +static inline void poison_hash(void *addr) +{ + *(u32 *)addr =3D 0; +} + +static void poison_cfi(void *addr) +{ + switch (cfi_mode) { + case CFI_FINEIBT: + /* + * __cfi_\func: + * osp nopl (%rax) + * subl $0, %r10d + * jz 1f + * ud2 + * 1: nop + */ + poison_endbr(addr, false); + poison_hash(addr + fineibt_preamble_hash); + break; + + case CFI_KCFI: + /* + * __cfi_\func: + * movl $0, %eax + * .skip 11, 0x90 + */ + poison_hash(addr + 1); + break; + + default: + break; + } +} + #else =20 static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline, @@ -1184,6 +1224,8 @@ static void __apply_fineibt(s32 *start_retpoline, s32= *end_retpoline, { } =20 +static void poison_cfi(void *addr) { } + #endif =20 void apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,