From patchwork Wed Jan 27 21:24:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 12051049 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80E7EC433DB for ; Wed, 27 Jan 2021 21:26:02 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0564064DC4 for ; Wed, 27 Jan 2021 21:26:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0564064DC4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C10D66B0071; Wed, 27 Jan 2021 16:25:58 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B2F4C6B0073; Wed, 27 Jan 2021 16:25:58 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 901746B0072; Wed, 27 Jan 2021 16:25:58 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0160.hostedemail.com [216.40.44.160]) by kanga.kvack.org (Postfix) with ESMTP id 745EE6B0070 for ; Wed, 27 Jan 2021 16:25:58 -0500 (EST) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 3656D181AEF21 for ; Wed, 27 Jan 2021 21:25:58 +0000 (UTC) X-FDA: 77752837596.05.walk63_260d2232759a Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 1ACC91826B6BF for ; Wed, 27 Jan 2021 21:25:58 +0000 (UTC) X-HE-Tag: walk63_260d2232759a X-Filterd-Recvd-Size: 10009 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by imf27.hostedemail.com (Postfix) with ESMTP for ; Wed, 27 Jan 2021 21:25:56 +0000 (UTC) IronPort-SDR: VIuJbUahbK6MZ8G5Aj1s5XU57ajjcHFQhQvtQWI/FpOPAosEvfX5mxOYoFdFtOTSuX6GKMvBHW tHRVFLROIDgg== X-IronPort-AV: E=McAfee;i="6000,8403,9877"; a="180281087" X-IronPort-AV: E=Sophos;i="5.79,380,1602572400"; d="scan'208";a="180281087" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Jan 2021 13:25:48 -0800 IronPort-SDR: 8trR+rP6FBYVAeO/Acc8g+pD1YyZiwbF2EBPTkYOqpCxHqAWh1EQxUYIqIgSYSDxMUEtP5FL/j m8CU9MtEGM0A== X-IronPort-AV: E=Sophos;i="5.79,380,1602572400"; d="scan'208";a="353948183" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Jan 2021 13:25:47 -0800 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu Cc: Yu-cheng Yu Subject: [PATCH v18 00/25] Control-flow Enforcement: Shadow Stack Date: Wed, 27 Jan 2021 13:24:59 -0800 Message-Id: <20210127212524.10188-1-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Control-flow Enforcement (CET) is a new Intel processor feature that blocks return/jump-oriented programming attacks. Details are in "Intel 64 and IA-32 Architectures Software Developer's Manual" [1]. CET can protect applications and the kernel. This series enables only application-level protection, and has three parts: - Shadow stack [2], - Indirect branch tracking [3], and - Selftests [4]. I have run tests on these patches for quite some time, and they have been very stable. Linux distributions with CET are available now, and Intel processors with CET are already on the market. It would be nice if CET support can be accepted into the kernel. I will be working to address any issues should they come up. Changes in v18: - Patch #2: change X86_CET_USER to X86_CET - Patch #4: move setting of X86_FEATURE_CET from get_cpu_cap() to bsp_init_intel(). - Patch #6: change printk_ratelimit() to __ratelimit(), pr_info() to pr_emerg(), and do panic() for kernel-mode control protection fault. - patch #8: make p*_wrprotect() more readable by using p*_set_flags()/ p*_clear_flags() directly. - patch #11: move reading old_pte out of while() loop. Update comments. - patch #22: merge GNU_PROPERTY_* definitions and arch_setup_elf_property() into one patch. - Rebase to v5.11-rc5 [1] Intel 64 and IA-32 Architectures Software Developer's Manual: https://software.intel.com/en-us/download/intel-64-and-ia-32- architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4 [2] CET Shadow Stack patches v17: https://lkml.kernel.org/r/20201229213053.16395-1-yu-cheng.yu@intel.com/ [3] Indirect Branch Tracking patches v17. https://lkml.kernel.org/r/20201229213350.17010-1-yu-cheng.yu@intel.com/ [4] I am holding off the selftests changes and working to get Reviewed-by's. The earlier version of the selftests patches: https://lkml.kernel.org/r/20200521211720.20236-1-yu-cheng.yu@intel.com/ [5] The kernel ptrace patch is tested with an Intel-internal updated GDB. I am holding off the kernel ptrace patch to re-test it with my earlier patch for fixing regset holes. Yu-cheng Yu (25): Documentation/x86: Add CET description x86/cet/shstk: Add Kconfig option for user-mode control-flow protection x86/cpufeatures: Add CET CPU feature flags for Control-flow Enforcement Technology (CET) x86/cpufeatures: Introduce X86_FEATURE_CET and setup functions x86/fpu/xstate: Introduce CET MSR and XSAVES supervisor states x86/cet: Add control-protection fault handler x86/mm: Remove _PAGE_DIRTY from kernel RO pages x86/mm: Introduce _PAGE_COW drm/i915/gvt: Change _PAGE_DIRTY to _PAGE_DIRTY_BITS x86/mm: Update pte_modify for _PAGE_COW x86/mm: Update ptep_set_wrprotect() and pmdp_set_wrprotect() for transition from _PAGE_DIRTY to _PAGE_COW mm: Introduce VM_SHSTK for shadow stack memory x86/mm: Shadow Stack page fault error checking x86/mm: Update maybe_mkwrite() for shadow stack mm: Fixup places that call pte_mkwrite() directly mm: Add guard pages around a shadow stack. mm/mmap: Add shadow stack pages to memory accounting mm: Update can_follow_write_pte() for shadow stack mm: Re-introduce vm_flags to do_mmap() x86/cet/shstk: User-mode shadow stack support x86/cet/shstk: Handle signals for shadow stack ELF: Introduce arch_setup_elf_property() x86/cet/shstk: Handle thread shadow stack x86/cet/shstk: Add arch_prctl functions for shadow stack mm: Introduce PROT_SHSTK for shadow stack .../admin-guide/kernel-parameters.txt | 6 + Documentation/x86/index.rst | 1 + Documentation/x86/intel_cet.rst | 136 +++++++ arch/arm64/include/asm/elf.h | 5 + arch/x86/Kconfig | 28 ++ arch/x86/Kconfig.assembler | 5 + arch/x86/ia32/ia32_signal.c | 17 + arch/x86/include/asm/cet.h | 42 +++ arch/x86/include/asm/cpufeatures.h | 4 +- arch/x86/include/asm/disabled-features.h | 17 +- arch/x86/include/asm/elf.h | 13 + arch/x86/include/asm/fpu/internal.h | 10 + arch/x86/include/asm/fpu/types.h | 23 +- arch/x86/include/asm/fpu/xstate.h | 6 +- arch/x86/include/asm/idtentry.h | 4 + arch/x86/include/asm/mman.h | 85 +++++ arch/x86/include/asm/mmu_context.h | 3 + arch/x86/include/asm/msr-index.h | 19 + arch/x86/include/asm/page_64_types.h | 10 + arch/x86/include/asm/pgtable.h | 194 +++++++++- arch/x86/include/asm/pgtable_types.h | 48 ++- arch/x86/include/asm/processor.h | 5 + arch/x86/include/asm/special_insns.h | 32 ++ arch/x86/include/asm/trap_pf.h | 2 + arch/x86/include/uapi/asm/mman.h | 28 +- arch/x86/include/uapi/asm/prctl.h | 4 + arch/x86/include/uapi/asm/processor-flags.h | 2 + arch/x86/include/uapi/asm/sigcontext.h | 9 + arch/x86/kernel/Makefile | 2 + arch/x86/kernel/cet.c | 343 ++++++++++++++++++ arch/x86/kernel/cet_prctl.c | 68 ++++ arch/x86/kernel/cpu/common.c | 16 + arch/x86/kernel/cpu/cpuid-deps.c | 2 + arch/x86/kernel/cpu/intel.c | 3 + arch/x86/kernel/fpu/signal.c | 100 +++++ arch/x86/kernel/fpu/xstate.c | 10 +- arch/x86/kernel/idt.c | 4 + arch/x86/kernel/process.c | 14 +- arch/x86/kernel/process_64.c | 32 ++ arch/x86/kernel/signal.c | 10 + arch/x86/kernel/signal_compat.c | 2 +- arch/x86/kernel/traps.c | 60 +++ arch/x86/mm/fault.c | 19 + arch/x86/mm/mmap.c | 2 + arch/x86/mm/pat/set_memory.c | 2 +- arch/x86/mm/pgtable.c | 25 ++ drivers/gpu/drm/i915/gvt/gtt.c | 2 +- fs/aio.c | 2 +- fs/binfmt_elf.c | 4 + fs/proc/task_mmu.c | 3 + include/linux/elf.h | 6 + include/linux/mm.h | 38 +- include/linux/pgtable.h | 35 ++ include/uapi/asm-generic/siginfo.h | 3 +- include/uapi/linux/elf.h | 9 + ipc/shm.c | 2 +- mm/gup.c | 8 +- mm/huge_memory.c | 10 +- mm/memory.c | 5 +- mm/migrate.c | 3 +- mm/mmap.c | 23 +- mm/mprotect.c | 2 +- mm/nommu.c | 4 +- mm/util.c | 2 +- 64 files changed, 1549 insertions(+), 84 deletions(-) create mode 100644 Documentation/x86/intel_cet.rst create mode 100644 arch/x86/include/asm/cet.h create mode 100644 arch/x86/include/asm/mman.h create mode 100644 arch/x86/kernel/cet.c create mode 100644 arch/x86/kernel/cet_prctl.c