FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=stable%2F13 2023-08-23T17:43:20Z 2023-08-23T17:43:20Z Warner Losh imp@FreeBSD.org 2023-08-22T01:31:02Z urn:sha1:f8167e0404dab9ffeaca95853dd237ab7c587f82 Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/ Similar commit in current: (cherry picked from commit 95ee2897e98f) 2019-08-06T16:53:25Z Konstantin Belousov kib@FreeBSD.org 2019-08-06T16:53:25Z urn:sha1:90e35b0a987f8e61ea5682b951c771b6f9dd5b63 Such speculations could use user-controlled %gs base, esp. since FreeBSD supports WRGSBASE instructions. Place LFENCEs on entry for each basic block after the test for previous kernel/user mode on the kernel entry, which prevents the speculation. Code accesses %gs-based PCPU before any serialization instructions are executed, like %cr3 reload for KPTI. With pti disabled, on haswell i7-4770S machine, "syscall_timings getppid" shows when no lfence is added to syscall path: test loop time iterations periteration getppid 0 1.040918865 4643611 0.000000224 getppid 1 1.004985962 4481816 0.000000224 getppid 2 1.005196483 4482363 0.000000224 with lfence: getppid 0 1.043701091 4554779 0.000000229 getppid 1 1.016930328 4438094 0.000000229 getppid 2 1.023223117 4466640 0.000000229 and ministat reports 'No difference proven at 95.0% confidence.' Security: CVE-2019-1125 Sponsored by: The FreeBSD Foundation MFC after: 1 week 2019-08-03T17:07:04Z Konstantin Belousov kib@FreeBSD.org 2019-08-03T17:07:04Z urn:sha1:1947b29861d0187b59b0d665e6976b735fa868be PTI-mode entry points were coded to set up the environment identical to non-PTI entry and then fall-through to non-PTI handlers, mostly. This has the drawback of requiring two more SWAPGS, first to access PCPU, and then to return to the state expected by the non-PTI entry point. Eliminate the duplication by doing more in entry stubs both for PTI and non-PTI, and adjusting the common code to expect that SWAPGS and some minimal registers saving is done by entries. Some less often used entries, in particular, #GP, #NP, and #SS, which can fault on doreti, are left as is because there are basically four variants of entrance, and they are not performance-critical, esp. comparing with e.g. #PF or interrupts. Reviewed by: markj (previous version) Tested by: pho (previous version) MFC after: 1 week Sponsored by: The FreeBSD Foundation 2018-07-29T20:47:00Z Konstantin Belousov kib@FreeBSD.org 2018-07-29T20:47:00Z urn:sha1:b3a7db3b066386957607fe3e5db2a4c617d4f9bc Ifuncs selectors dispatch copyin(9) family to the suitable variant, to set rflags.AC around userspace access. Rflags.AC bit is cleared in all kernel entry points unconditionally even on machines not supporting SMAP. Reviewed by: jhb Sponsored by: The FreeBSD Foundation Differential revision: https://reviews.freebsd.org/D13838 2018-06-25T11:29:04Z Konstantin Belousov kib@FreeBSD.org 2018-06-25T11:29:04Z urn:sha1:7f12ebe58305d37fd1f8fb5583bf046c1f0bf51f without error code. Doing so it mis-aligned the stack. Since the only consumer of the SSE instructions with the alignment requirements is AES-NI module, and since the FPU context cannot be accessed in interrupts, the only situation where the alignment matter are the compat32 syscalls, as reported in the PR. PR: 229222 Reported and tested by: dewayne@heuristicsystems.com.au Sponsored by: The FreeBSD Foundation MFC after: 1 week 2018-05-22T13:25:15Z Konstantin Belousov kib@FreeBSD.org 2018-05-22T13:25:15Z urn:sha1:14f7050dbab9c21ec7f18b3a015641e722ea6b9d Sponsored by: The FreeBSD Foundation MFC after: 1 week 2018-05-14T17:27:53Z John Baldwin jhb@FreeBSD.org 2018-05-14T17:27:53Z urn:sha1:0b3e6e4c50b2dc1301cb18cec14e0a0a88f13c54 Kernel debuggers depend on symbol names to find stack frames with a trapframe rather than a normal stack frame. The labels used for the shared interrupt entry point for the PTI and non-PTI cases did not match the existing patterns confusing debuggers. Add the '.L' prefix to mark these symbols as local so they are not visible in the symbol table. Reviewed by: kib MFC after: 1 week Sponsored by: Chelsio Communications 2018-04-27T12:44:20Z Tycho Nightingale tychon@FreeBSD.org 2018-04-27T12:44:20Z urn:sha1:27275f8a5240f6c644cc3341b4efda3695d97620 excluded from PTI. Reviewed by: kib Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D15100 2018-02-16T13:32:46Z Konstantin Belousov kib@FreeBSD.org 2018-02-16T13:32:46Z urn:sha1:13cad9af827b37c22d6bc0da4787aba0a005ca8d Small global symbols confuse ddb which matches them against small unrelated displacements and makes the disassembly ugly. Reported by: bde Sponsored by: The FreeBSD Foundation MFC after: 1 week 2018-01-19T22:10:29Z Konstantin Belousov kib@FreeBSD.org 2018-01-19T22:10:29Z urn:sha1:b4dfc9d7ad9c54e990088f9abdb1a4f2f820feb1 still active. Map userspace portion of VA in the PTI kernel-mode page table as non-executable. This way, if we ever miss reloading ucr3 into %cr3 on the return to usermode, the process traps instead of executing in potentially vulnerable setup. Catch the condition of such trap and verify user-mode %cr3, which is saved by page fault handler. I peek this trick in some article about Linux implementation. Reviewed by: alc, markj (previous version) Sponsored by: The FreeBSD Foundation MFC after: 12 days DIfferential revision: https://reviews.freebsd.org/D13956