Fedora Account System
Red Hat Associate
Red Hat Customer
Created attachment 1662993 [details] Replace ARCH_CET_LEGACY_BITMAP with ARCH_CET_MARK_LEGACY_CODE The current CET kernel on cet branch at: https://github.com/yyu168/linux_cet replaced ARCH_CET_LEGACY_BITMAP with ARCH_CET_MARK_LEGACY_CODE to mark legacy code region. This patch updates glibc with: /* Mark legacy code region in legacy bitmap with unsigned long long *addr: address: addr[0]. size: addr[1]. set: addr[2]. */ # define ARCH_CET_MARK_LEGACY_CODE 0x3007 It uses ARCH_CET_MARK_LEGACY_CODE to mark legacy code region when mmapping executable PT_LOAD segments and clear the region when munmapping them.
What's the timeline for the upstream kernel merge? We want to switch to the final ABI in all Fedora releases once that becomes available upstream. My feeling was that shipping draft APIs would just create duplicate work. Please let me know if you disagree.
H.J, Do you want a Fedora Rawhide patched glibc with this fix? We can do that if you want to test things out with more-or-less official packages. Are you using Fedora Rawhide or do you want this in other Fedora releases for testing?
(In reply to Florian Weimer from comment #1) > What's the timeline for the upstream kernel merge? > > We want to switch to the final ABI in all Fedora releases once that becomes > available upstream. My feeling was that shipping draft APIs would just > create duplicate work. Please let me know if you disagree. We have been testing this kernel interface, based on feedbacks from kernel developers, for more than 6 months. Without this glibc change, we can't test CET kernel on Tiger Lake. We hope to upstream CET kernel support to kernel 5.8. Yu-cheng, our CET kernel developer, would like to get some help on kernel patch review.
(In reply to Carlos O'Donell from comment #2) > H.J, > > Do you want a Fedora Rawhide patched glibc with this fix? Yes. Please also include CET kernel patches. > We can do that if you want to test things out with more-or-less official > packages. This sounds good. > Are you using Fedora Rawhide or do you want this in other Fedora releases > for testing? I am using Fedora 31 + patched rpms to test CET. I can use Rawhide if CET is enabled in its libffi.
This bug is fixed by the following commit: commit 1fabdb99084df004f7f4cdc7068d1be209a258be Author: H.J. Lu <hjl.tools> Date: Wed Mar 18 04:35:54 2020 -0700 x86: Remove ARCH_CET_LEGACY_BITMAP [BZ #25397] Since legacy bitmap doesn't cover jitted code generated by legacy JIT engine, it isn't very useful. This patch removes ARCH_CET_LEGACY_BITMAP and treats indirect branch tracking similar to shadow stack by removing legacy bitmap support. Tested on CET Linux/x86-64 and non-CET Linux/x86-64. Reviewed-by: Carlos O'Donell <carlos> Legacy bitmap support has been removed because it doesn't cover JIT'd code. The legacy bitmap was envisioned as way to allow legacy code to be inter-mixed with hardened code, but this mixed state turns out to be more difficult to manage than it's worth. Thus we simplify the implementation to just hardened or non-hardened by CET. Legacy JIT's cannot run with Intel CET turned on, they must be fixed first to use the appropriate ENDBR and then everything will work.