On Tue, Mar 16, 2021 at 12:27:19PM -0700, Yu, Yu-cheng wrote: > On 3/16/2021 12:22 PM, Jarkko Sakkinen wrote: > > On Tue, Mar 16, 2021 at 08:13:19AM -0700, Yu-cheng Yu wrote: > > > ENDBR is a special new instruction for the Indirect Branch Tracking (IBT) > > > component of CET. IBT prevents attacks by ensuring that (most) indirect > > > branches and function calls may only land at ENDBR instructions. Branches > > > that don't follow the rules will result in control flow (#CF) exceptions. > > > > > > ENDBR is a noop when IBT is unsupported or disabled. Most ENDBR > > > instructions are inserted automatically by the compiler, but branch > > > targets written in assembly must have ENDBR added manually. > > > > > > Add ENDBR to __vdso_sgx_enter_enclave() branch targets. > > > > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> > > > Cc: Andy Lutomirski <luto@xxxxxxxxxx> > > > Cc: Borislav Petkov <bp@xxxxxxxxx> > > > Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx> > > > Cc: Jarkko Sakkinen <jarkko@xxxxxxxxxx> > > > Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx> > > > --- > > > arch/x86/entry/vdso/vsgx.S | 4 ++++ > > > 1 file changed, 4 insertions(+) > > > > > > diff --git a/arch/x86/entry/vdso/vsgx.S b/arch/x86/entry/vdso/vsgx.S > > > index 86a0e94f68df..1baa9b49053e 100644 > > > --- a/arch/x86/entry/vdso/vsgx.S > > > +++ b/arch/x86/entry/vdso/vsgx.S > > > @@ -6,6 +6,7 @@ > > > #include <asm/enclu.h> > > > #include "extable.h" > > > +#include "../calling.h" > > > /* Relative to %rbp. */ > > > #define SGX_ENCLAVE_OFFSET_OF_RUN 16 > > > @@ -27,6 +28,7 @@ > > > SYM_FUNC_START(__vdso_sgx_enter_enclave) > > > /* Prolog */ > > > .cfi_startproc > > > + ENDBR > > > push %rbp > > > .cfi_adjust_cfa_offset 8 > > > .cfi_rel_offset %rbp, 0 > > > @@ -62,6 +64,7 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave) > > > .Lasync_exit_pointer: > > > .Lenclu_eenter_eresume: > > > enclu > > > + ENDBR > > > /* EEXIT jumps here unless the enclave is doing something fancy. */ > > > mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx > > > @@ -91,6 +94,7 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave) > > > jmp .Lout > > > .Lhandle_exception: > > > + ENDBR > > > mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx > > > /* Set the exception info. */ > > > -- > > > 2.21.0 > > > > > > > > > > Looks good to me. > > > > Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx> > > Thanks for reviewing. In response to Dave's and Boris' comments, I will > replace ENDBR macro with _CET_ENDBR that comes from the compiler. Can I > still keep the Reviewed-by? I'll rather re-ack, thanks. Most likely give reviewed-by but I always prefer to see the code change before doing that. /Jarkko
