This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug dynamic-link/21598] i386 _dl_runtime_resolve/_dl_runtime_profile is incompatible with shadow stack
- From: "cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sourceware dot org
- Date: Mon, 11 Dec 2017 13:18:16 +0000
- Subject: [Bug dynamic-link/21598] i386 _dl_runtime_resolve/_dl_runtime_profile is incompatible with shadow stack
- Auto-submitted: auto-generated
- References: <bug-21598-131@http.sourceware.org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=21598
--- Comment #58 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, hjl/cet/master has been created
at 95b620d8194ad04c156c3cbcf06f0f444d44436b (commit)
- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=95b620d8194ad04c156c3cbcf06f0f444d44436b
commit 95b620d8194ad04c156c3cbcf06f0f444d44436b
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Fri Dec 8 04:47:49 2017 -0800
x86: Check GNU_PROPERTY_X86_FEATURE_1_SHSTK isn't set
-fcf-protection -mcet is incompatible with makecontext family functions
since they can't properly set up and destroy shadow stack pointer. When
they are used, GNU_PROPERTY_X86_FEATURE_1_SHSTK shouldn't be set on the
program. Add a test to check it, which is expected to fail until the
GCC bug:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81842
is fixed.
* sysdeps/unix/sysv/linux/x86/Makefile (tests-special): Add
$(objpfx)tst-setcontext3-shstk.out.
($(objpfx)tst-setcontext3-shstk.out): New target.
* sysdeps/unix/sysv/linux/x86/tst-setcontext3-shstk.sh: New file.
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ce5b2a948dc99e420b4caf60d4e214549d51fb78
commit ce5b2a948dc99e420b4caf60d4e214549d51fb78
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Tue Dec 5 11:58:23 2017 -0800
Linux/x86: Support shadow stack pointer in setjmp/longjmp
Save and restore shadow stack pointer in setjmp and longjmp to support
shadow stack in Intel CET. Use feature_1 in tcbhead_t to check if
shadow stack is enabled before saving and restoring shadow stack
pointer so that it works with the old smaller cancel_jmp_buf which
doesn't have space for shadow stack pointer.
2017-12-07 Igor Tsimbalist <igor.v.tsimbalist@intel.com>
H.J. Lu <hongjiu.lu@intel.com>
* sysdeps/unix/sysv/linux/i386/____longjmp_chk.S: Include
<jmp_buf-ssp.h>. Restore shadow stack pointer if shadow
stack is enabled.
* sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S: Likewise.
* sysdeps/unix/sysv/linux/i386/__longjmp.S: New file.
* sysdeps/unix/sysv/linux/i386/bsd-_setjmp.S: Likewise.
* sysdeps/unix/sysv/linux/i386/bsd-setjmp.S: Likewise.
* sysdeps/unix/sysv/linux/i386/setjmp.S: Likewise.
* sysdeps/unix/sysv/linux/x86_64/__longjmp.S: Likewise.
* sysdeps/unix/sysv/linux/x86_64/setjmp.S: Likewise.
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6f7c383fd66c64aba729d9fb1649b7ea51fddfb3
commit 6f7c383fd66c64aba729d9fb1649b7ea51fddfb3
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Thu Jun 22 04:15:39 2017 -0700
x86: Support IBT and SHSTK in Intel CET [BZ #21598]
Intel Control-flow Enforcement Technology (CET) instructions:
https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-en
forcement-technology-preview.pdf
includes Indirect Branch Tracking (IBT) and Shadow Stack (SHSTK).
GNU_PROPERTY_X86_FEATURE_1_IBT is added to GNU program property to
indicate that all executable sections are compatible with IBT when
ENDBR instruction starts each valid target where an indirect branch
instruction can land. Linker sets GNU_PROPERTY_X86_FEATURE_1_IBT on
output only if it is set on all relocatable inputs.
On an IBT capable processor, the following steps should be taken:
1. When loading an executable without an interpreter, enable IBT and
lock IBT if GNU_PROPERTY_X86_FEATURE_1_IBT is set on the executable.
2. When loading an executable with an interpreter, enable IBT if
GNU_PROPERTY_X86_FEATURE_1_IBT is set on the interpreter.
a. If GNU_PROPERTY_X86_FEATURE_1_IBT isn't set on the executable,
disable IBT.
b. Lock IBT.
3. If IBT is enabled, when loading a shared object without
GNU_PROPERTY_X86_FEATURE_1_IBT:
a. If legacy interwork is allowed, then mark all pages in executable
PT_LOAD segments in legacy code page bitmap. Failure of legacy code
page bitmap allocation causes an error.
b. If legacy interwork isn't allowed, it causes an error.
GNU_PROPERTY_X86_FEATURE_1_SHSTK is added to GNU program property to
indicate that all executable sections are compatible with SHSTK where
return address popped from shadow stack always matches return address
popped from normal stack. Linker sets GNU_PROPERTY_X86_FEATURE_1_SHSTK
on output only if it is set on all relocatable inputs.
On a SHSTK capable processor, the following steps should be taken:
1. When loading an executable without an interpreter, enable SHSTK if
GNU_PROPERTY_X86_FEATURE_1_SHSTK is set on the executable.
2. When loading an executable with an interpreter, enable SHSTK if
GNU_PROPERTY_X86_FEATURE_1_SHSTK is set on interpreter.
a. If GNU_PROPERTY_X86_FEATURE_1_SHSTK isn't set on the executable
or any shared objects loaded via the DT_NEEDED tag, disable SHSTK.
b. Otherwise lock SHSTK.
3. After SHSTK is enabled, it is an error to load a shared object
without GNU_PROPERTY_X86_FEATURE_1_SHSTK.
When glibc is built with a CET-enabled compiler, CET is enabled by
default, unless --disable-cet is used to configure glibc. When CET is
enabled, both compiler and assembler must support CET. Otherwise, it
is a configure-time error.
To support CET run-time control,
1. _dl_x86_feature_1 is added to the writable ld.so namespace to indicate
if IBT or SHSTK are enabled at run-time. It should be initialized by
init_cpu_features.
2. For dynamic executables:
a. A l_cet field is added to struct link_map to indicate if IBT or
SHSTK is enabled in an ELF module. The optional DL_PROCESS_PT_NOTE
is called to process PT_NOTE segment for GNU program property and
set l_cet.
b. _dl_start_user calls _dl_cet_init, instead of _dl_init, which sets
up IBT and SHSTK.
c. DL_OPEN_CHECK is added to check IBT and SHSTK compatibilty when
dlopening a shared object.
3. Replace i386 _dl_runtime_resolve and _dl_runtime_profile with
_dl_runtime_resolve_shstk and _dl_runtime_profile_shstk, respectively if
SHSTK is enabled.
<cet.h> from CET-enabled GCC is automatically included by assembly codes
to add GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK
to GNU program property. _CET_ENDBR is added at the entrance of all
assembly functions whose address may be taken.
[BZ #21598]
* config.h.in (ENABLE_CET): New #undef.
* configure.ac: Add --enable-cet.
* configure: Regenerated.
* elf/dl-load.c (filebuf): Moved before "dynamic-link.h".
(_dl_map_object_from_fd): Call DL_PROCESS_PT_NOTE on PT_NOTE
segment if DL_PROCESS_PT_NOTE is defined.
* elf/rtld.c (dl_main): Likewise.
* elf/dl-open.c (dl_open_worker): Call DL_OPEN_CHECK if it is
defined.
* elf/dl-support.c: Include <dl-procruntime.c>.
* include/link.h: Include <link_map.h>.
* sysdeps/generic/dl-procruntime.c: New file.
* sysdeps/generic/link_map.h: Likewise.
* sysdeps/unix/sysv/linux/i386/dl-cet.c: Likewise.
* sysdeps/unix/sysv/linux/i386/dl-machine.h: Likewise.
* sysdeps/unix/sysv/linux/x86/check-cet.awk: Likewise.
* sysdeps/unix/sysv/linux/x86/configure: Likewise.
* sysdeps/unix/sysv/linux/x86/configure.ac: Likewise.
* sysdeps/unix/sysv/linux/x86/dl-cet.c: Likewise.
* sysdeps/unix/sysv/linux/x86/dl-cet.h: Likewise.
* sysdeps/unix/sysv/linux/x86/dl-procruntime.c: Likewise.
* sysdeps/unix/sysv/linux/x86/link_map.h: Likewise.
* sysdeps/unix/sysv/linux/x86_64/dl-machine.h: Likewise.
* sysdeps/generic/ldsodefs.h: Include <dl-procruntime.c> in
the writable ld.so namespace.
* sysdeps/i386/dl-machine.h (DL_INIT): New.
(_dl_start_user): Replace _dl_init with DL_INIT.
* sysdeps/i386/dl-trampoline.S (_dl_runtime_resolve): Add
_CET_ENDBR.
(_dl_runtime_profile): Likewise.
(_dl_runtime_resolve_shstk): New.
(_dl_runtime_profile_shstk): Likewise.
* sysdeps/unix/sysv/linux/x86/Makefile (sysdep_routines): Add
dl-cet-nonshared if CET is enabled.
(sysdep-dl-routines): Add dl-cet if CET is enabled.
(CFLAGS-.o): Add -fcf-protection -mcet if CET is enabled.
(CFLAGS-.os): Likewise.
(CFLAGS-.op): Likewise.
(CFLAGS-.oS): Likewise.
(asm-CPPFLAGS): Add -fcf-protection -mcet -include cet.h if CET
is enabled.
* sysdeps/unix/sysv/linux/x86/Makefile (CFLAGS-tst-context1.c):
Add -fcf-protection=branch -mno-shstk -mibt.
(CFLAGS-bug-getcontext.c): Likewise.
(CFLAGS-tst-makecontext.c): Likewise.
(CFLAGS-tst-makecontext2.c): Likewise.
(CFLAGS-tst-makecontext3.c): Likewise.
(CFLAGS-tst-setcontext.c): Likewise.
(CFLAGS-tst-setcontext2.c): Likewise.
(CFLAGS-tst-setcontext3.c): Likewise.
(CFLAGS-tst-xbzero-opt.c): Likewise.
(tests-special): Add $(objpfx)check-cet.out.
(cet-built-dso): New.
(+$(cet-built-dso:=.note)): Likewise.
(common-generated): Add $(cet-built-dso:$(common-objpfx)%=%.note).
($(objpfx)check-cet.out): New.
(generated): Add check-cet.out.
* sysdeps/x86/sysdep.h (_CET_ENDBR): Define if not defined.
(ENTRY): Add _CET_ENDBR.
* sysdeps/x86_64/dl-machine.h (DL_INIT): New.
(_dl_start_user): Replace _dl_init with DL_INIT.
* sysdeps/x86_64/x32/dl-machine.h (_dl_start_user): Likewise.
* sysdeps/x86_64/dl-trampoline.h (_dl_runtime_resolve): Add
_CET_ENDBR.
(_dl_runtime_profile): Likewise.
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6c48e554a2a15638033c7990a7df8f9b377db1ff
commit 6c48e554a2a15638033c7990a7df8f9b377db1ff
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Thu Dec 7 05:47:21 2017 -0800
x86: Add feature_1 to tcbhead_t [BZ #22563]
On x86, padding in struct __jmp_buf_tag is used for shadow stack pointer
to support Shadow Stack in Intel Control-flow Enforcemen Technology.
cancel_jmp_buf has been updated to include saved_mask so that it is as
large as struct __jmp_buf_tag. We must suport the old cancel_jmp_buf
in existing binaries. Since symbol versioning doesn't work on
cancel_jmp_buf, feature_1 is added to tcbhead_t so that setjmp and
longjmp can check if shadow stack is enabled. NB: Shadow stack is
enabled only if all modules are shadow stack enabled.
[BZ #22563]
* sysdeps/i386/nptl/tcb-offsets.sym (FEATURE_1_OFFSET): New.
* sysdeps/i386/nptl/tls.h (tcbhead_t): Add feature_1.
* sysdeps/x86_64/nptl/tcb-offsets.sym (FEATURE_1_OFFSET): New.
* sysdeps/x86_64/nptl/tls.h (tcbhead_t): Rename __glibc_unused1
to feature_1.
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c05d4fb7e9af0eb8e59f653d1151a33cf165cf5b
commit c05d4fb7e9af0eb8e59f653d1151a33cf165cf5b
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Wed Dec 6 15:00:46 2017 -0800
Linux/x86: Update cancel_jmp_buf to match __jmp_buf_tag [BZ #22563]
On x86, padding in struct __jmp_buf_tag is used for shadow stack pointer
to support shadow stack in Intel Control-flow Enforcemen Technology.
Since the cancel_jmp_buf array is passed to setjmp and longjmp by
casting it to pointer to struct __jmp_buf_tag, it should be as large
as struct __jmp_buf_tag.
This patch adds bits/types/__cancel_jmp_buf_tag.h to define struct
__cancel_jmp_buf_tag so that Linux/x86 can add saved_mask to
cancel_jmp_buf.
[BZ #22563]
* bits/types/__cancel_jmp_buf_tag.h: New file.
* sysdeps/unix/sysv/linux/x86/bits/types/__cancel_jmp_buf_tag.h
* sysdeps/unix/sysv/linux/x86/pthreaddef.h: Likewise.
* sysdeps/unix/sysv/linux/x86/nptl/pthreadP.h: Likewise.
* nptl/Makefile (headers): Add
bits/types/__cancel_jmp_buf_tag.h.
* nptl/descr.h [NEED_SAVED_MASK_IN_CANCEL_JMP_BUF]
(pthread_unwind_buf): Add saved_mask to cancel_jmp_buf.
* sysdeps/nptl/pthread.h: Include
<bits/types/__cancel_jmp_buf_tag.h>.
(__pthread_unwind_buf_t): Use struct __cancel_jmp_buf_tag with
__cancel_jmp_buf.
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a7f412f14cd90401a0301cae7af5b7ca3e181c99
commit a7f412f14cd90401a0301cae7af5b7ca3e181c99
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Mon Dec 11 04:18:24 2017 -0800
string: Replace = with += in CFLAGS-tst-xbzero-opt.c
Replace = with += in CFLAGS-tst-xbzero-opt.c to allow sysdeps Makefile
to define CFLAGS-tst-xbzero-opt.c.
* string/Makefile (CFLAGS-tst-xbzero-opt.c): Replace = with +=.
-----------------------------------------------------------------------
--
You are receiving this mail because:
You are on the CC list for the bug.