From patchwork Sat Nov 5 10:36:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 15947 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp918923wru; Sat, 5 Nov 2022 03:37:08 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6v2I1qCK/sEATwl8WH85cb1lJfrDTu+zjrl082ak/M2IKsSahLY9W2XApSp57fW/WFa4+A X-Received: by 2002:a63:480e:0:b0:46e:b96c:4f89 with SMTP id v14-20020a63480e000000b0046eb96c4f89mr33985158pga.201.1667644627958; Sat, 05 Nov 2022 03:37:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667644627; cv=none; d=google.com; s=arc-20160816; b=K7s7zg/5BB6xLAmNSJo/M9EA2FRJnRTeFkzC/t4ItI1aug2t+4KuQqu5DvjEH+dFYn 7mVxo1+dxkEZgELiaZw/FuTDPjsOetauirIqr5ScPLigQe6JuyBW0jtnqudtNHryr0l9 8L7rq+K9l+41UboXQk59un3PxA+T9iz/y0c1xNUMB+T+e4X0ZZmlBloMRX0RZwAFvUdo Y4RcbdF+GMXQKU1sFHP5/O3IluTx2wLhAHVBlXauL2uu5DBrTswDJ3Qus8PMgr9p9mIM /udgVDw6IK7OLBxtOe4ZTQfqTNZcmU302MNCC/QqxqZHXjhf6cex/hKeFnZj8Ph6kMK7 RW2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=AHQrl6P86xz2am5gkMQph6NleuntroolUPtqBPFpcpw=; b=br0/zMizP23JKbGaLnMl00n1/v0yvPbV0VcKAnw6f6KUzE1pxbXi1g8Hqtm/TDXaPT MAEMR2OQQlp3hYyBKke9YmIeKmz7GixaI1FKoCImgY9BEtafZA8e3vy0qAEf+XYbMdtm iYy8iKSYalcoaYiN+XGrczK+n2hyeJsvhvDDX0Ix7XIZ+cmusveuRSSIO6Ws366E+bHv ab5jLydwrmtCp73EOybVaVuDef86Kti/lwfbFbv84FayDAORfzawatY/jn5qLl0rcwX0 O0ZQIrI1Mbc40GPAdO+wgQFf8ncNPQlkGdiC+uoUqZef6KbZsqpnFDEatG1eYTAAFFOM 1Tjg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=Sbsj5FxR; dkim=neutral (no key) header.i=@linutronix.de header.b=DUHWQPQo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w6-20020a631606000000b0046ffd5dc0ccsi2776744pgl.433.2022.11.05.03.36.54; Sat, 05 Nov 2022 03:37:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=Sbsj5FxR; dkim=neutral (no key) header.i=@linutronix.de header.b=DUHWQPQo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229578AbiKEKge (ORCPT + 99 others); Sat, 5 Nov 2022 06:36:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43262 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229469AbiKEKg3 (ORCPT ); Sat, 5 Nov 2022 06:36:29 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D9F22AE3A; Sat, 5 Nov 2022 03:36:28 -0700 (PDT) Date: Sat, 05 Nov 2022 10:36:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1667644586; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AHQrl6P86xz2am5gkMQph6NleuntroolUPtqBPFpcpw=; b=Sbsj5FxRfxidqlXoqvppyqEBnGbvvmT1sCI13oTzo63LmozgdJbZl/2ax3K1dC03uhKx/k UUcfbO+HwEYEOinVe3m0i2749o5wG2uWYg9z2Xz1w1wGwbvGsThgVYQahGNNwkHVL/EkOg qP7bnh8dWiIy0BusYRZYhTbNYov26xZUzWDfnhb6QIVglvL4nrf8sWCilUqNq8ZssFwK8E 0zEy7KGC+9R2YXGf2a38Gk0GQL3Rk7HiifeKOhUy5/ln7TO1cfdPGOl3U85mtoEKl50dps ar16Sia7SYHT0K2uuEIOS2sBCrZlStBZeS9QHCfOOQujVm9+0lQa8JXOc1z82g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1667644586; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AHQrl6P86xz2am5gkMQph6NleuntroolUPtqBPFpcpw=; b=DUHWQPQoQL6cI2I7ZKDdWn01C2fvxAinvwqCg26Jqpu0ejkharNfmFTisrTyhmaQpNEw/S K3KUiOtTgl29FhCw== From: "tip-bot2 for Kees Cook" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/core] x86/Kconfig: Enable kernel IBT by default Cc: Sami Tolvanen , Kees Cook , "Peter Zijlstra (Intel)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20221101172503.gonna.094-kees@kernel.org> References: <20221101172503.gonna.094-kees@kernel.org> MIME-Version: 1.0 Message-ID: <166764458451.4906.10224019690835731804.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748315993694032559?= X-GMAIL-MSGID: =?utf-8?q?1748652133303800964?= The following commit has been merged into the x86/core branch of tip: Commit-ID: 4fd5f70ce14da230c6a29648c3d51a48ee0b4bfd Gitweb: https://git.kernel.org/tip/4fd5f70ce14da230c6a29648c3d51a48ee0b4bfd Author: Kees Cook AuthorDate: Tue, 01 Nov 2022 10:25:07 -07:00 Committer: Peter Zijlstra CommitterDate: Sat, 05 Nov 2022 11:28:03 +01:00 x86/Kconfig: Enable kernel IBT by default The kernel IBT defense strongly mitigates the common "first step" of ROP attacks, by eliminating arbitrary stack pivots (that appear either at the end of a function or in immediate values), which cannot be reached if indirect calls must be to marked function entry addresses. IBT is also required to be enabled to gain the FineIBT feature when built with Kernel Control Flow Integrity. Additionally, given that this feature is runtime enabled via CPU ID, it clearly should be built in by default; it will only be enabled if the CPU supports it. The build takes 2 seconds longer, which seems a small price to pay for gaining this coverage by default. Suggested-by: Sami Tolvanen Signed-off-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20221101172503.gonna.094-kees@kernel.org --- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 479ee63..aaf1f0f 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1856,7 +1856,7 @@ config CC_HAS_IBT config X86_KERNEL_IBT prompt "Indirect Branch Tracking" - bool + def_bool y depends on X86_64 && CC_HAS_IBT && HAVE_OBJTOOL # https://github.com/llvm/llvm-project/commit/9d7001eba9c4cb311e03cd8cdc231f9e579f2d0f depends on !LD_IS_LLD || LLD_VERSION >= 140000