Bug 1802689
| Summary: | glibc: x86/CET: Legacy bitmap doesn't cover jitted code | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | H.J. Lu <hongjiu.lu> | ||||
| Component: | glibc | Assignee: | Carlos O'Donell <codonell> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | rawhide | CC: | aoliva, arjun, codonell, dj, fweimer, law, mfabian, pfrankli, rth, siddhesh, sipoyare | ||||
| Target Milestone: | --- | Flags: | codonell:
mirror+
|
||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2020-04-07 13:23:34 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1802686, 1802674 | ||||||
| Attachments: |
|
||||||
|
Description
H.J. Lu
2020-02-13 17:37:52 UTC
What's the timeline for the upstream kernel merge? We want to switch to the final ABI in all Fedora releases once that becomes available upstream. My feeling was that shipping draft APIs would just create duplicate work. Please let me know if you disagree. H.J, Do you want a Fedora Rawhide patched glibc with this fix? We can do that if you want to test things out with more-or-less official packages. Are you using Fedora Rawhide or do you want this in other Fedora releases for testing? (In reply to Florian Weimer from comment #1) > What's the timeline for the upstream kernel merge? > > We want to switch to the final ABI in all Fedora releases once that becomes > available upstream. My feeling was that shipping draft APIs would just > create duplicate work. Please let me know if you disagree. We have been testing this kernel interface, based on feedbacks from kernel developers, for more than 6 months. Without this glibc change, we can't test CET kernel on Tiger Lake. We hope to upstream CET kernel support to kernel 5.8. Yu-cheng, our CET kernel developer, would like to get some help on kernel patch review. (In reply to Carlos O'Donell from comment #2) > H.J, > > Do you want a Fedora Rawhide patched glibc with this fix? Yes. Please also include CET kernel patches. > We can do that if you want to test things out with more-or-less official > packages. This sounds good. > Are you using Fedora Rawhide or do you want this in other Fedora releases > for testing? I am using Fedora 31 + patched rpms to test CET. I can use Rawhide if CET is enabled in its libffi. This bug is fixed by the following commit:
commit 1fabdb99084df004f7f4cdc7068d1be209a258be
Author: H.J. Lu <hjl.tools>
Date: Wed Mar 18 04:35:54 2020 -0700
x86: Remove ARCH_CET_LEGACY_BITMAP [BZ #25397]
Since legacy bitmap doesn't cover jitted code generated by legacy JIT
engine, it isn't very useful. This patch removes ARCH_CET_LEGACY_BITMAP
and treats indirect branch tracking similar to shadow stack by removing
legacy bitmap support.
Tested on CET Linux/x86-64 and non-CET Linux/x86-64.
Reviewed-by: Carlos O'Donell <carlos>
Legacy bitmap support has been removed because it doesn't cover JIT'd code.
The legacy bitmap was envisioned as way to allow legacy code to be inter-mixed with hardened code, but this mixed state turns out to be more difficult to manage than it's worth.
Thus we simplify the implementation to just hardened or non-hardened by CET.
Legacy JIT's cannot run with Intel CET turned on, they must be fixed first to use the appropriate ENDBR and then everything will work.
|