From patchwork Fri Sep 21 15:03:31 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 10610223 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C45EC15A6 for ; Fri, 21 Sep 2018 15:08:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 622982E421 for ; Fri, 21 Sep 2018 15:08:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 55B822E423; Fri, 21 Sep 2018 15:08:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D39A32E421 for ; Fri, 21 Sep 2018 15:08:58 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A6A878E0011; Fri, 21 Sep 2018 11:08:51 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 9B3668E0010; Fri, 21 Sep 2018 11:08:51 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7B4938E000F; Fri, 21 Sep 2018 11:08:51 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by kanga.kvack.org (Postfix) with ESMTP id 2E55B8E000A for ; Fri, 21 Sep 2018 11:08:51 -0400 (EDT) Received: by mail-pf1-f199.google.com with SMTP id o27-v6so6714618pfj.6 for ; Fri, 21 Sep 2018 08:08:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references; bh=SrAoz3B3fVnohd0Wm1rBW1k5UQJ9ZmOZzebnbQuoFhw=; b=idqY6PsIOGJXnPWLoGN9MQ+MFGuA+8+3qWk3eHYsr4VHRi3lQ60PvchEPPUz/cMN/b DP3qi8cf0L7wmj+4rUeXvNJlFJqDgZfKdy+3Jtj/UqvTzJNsAVA3SRnt1r1wSnL12dYJ wbypJzz89Vczc9kJx8hE01DLXUu8iwCHkFXn50+0y/fQ7C2VM0B+gGP2o2N+yikDVHlk 5TjoNTQUNqn4sC5HE6oH+LLwwtarKfNRhvdDzZSa76nn1iFLLJ4o0W77oCDLzGT8LT4K qxv4XWbEZ8qZ/JbxGYzzcQ0ktipvJ9ji+ioG3Kx8PZyMHhDT4i7+93zEY7DSE/Z6GfqK /iGQ== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Gm-Message-State: APzg51BY5BD5gSmDoBbTVlO5o1/K5Tpg3+5W9SSMhu1++HDNFcJj+gTI njZ7Sz2MS8IGrpgGW1FTK+ch5tHHaGiMzkqU8khWLrk9BuTIEHuasGSwYNueOP+rNb4aVK7rlEG p181dydBZZY+ySHqhOSF1BrE7R6SAVyUv7rn8THSZPhYsBsbyHXDeSUqOjeo+Jpx/Rw== X-Received: by 2002:a62:45d2:: with SMTP id n79-v6mr46933593pfi.137.1537542530813; Fri, 21 Sep 2018 08:08:50 -0700 (PDT) X-Google-Smtp-Source: ANB0VdaMnD/Vnlk02IPv2B+UG0t7G9V0tUWw3q92nzCkAFIZSognSICZdXhaPI+bN2s3yEMyq0j7 X-Received: by 2002:a62:45d2:: with SMTP id n79-v6mr46933523pfi.137.1537542529808; Fri, 21 Sep 2018 08:08:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1537542529; cv=none; d=google.com; s=arc-20160816; b=A0DqJQpjqSuY+ri5OX6gtfzqDJuQn79M6m80SwNrr8BfRoGsmpuV/8rSBxia+XWFE8 12fs0bFCeNZQXLkNO0IdnDDrFJAfPCCNN9rNV//vo1uTGhzAkWFVTMECiiaFS1A/J3dr exRAWtDjt/wPzMfofmk8Edo5elJ564NgE5vna4Yq7nwhWBNws2YUvbNy5iAUUSypVlG/ lLudQseqX2xbTYFvBe7D/Kv+K3t41NYK54+5QKHQsl0ph2i7TdmC3bJ9CTOqB6b/Gzq0 pM/3q1YR6aW+ka4BuGjs8/4P2RgE1DRjejsNUIBOen+2sXJjmEMyfpxBA7G4yV0vAfbq a+4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=references:in-reply-to:message-id:date:subject:cc:to:from; bh=SrAoz3B3fVnohd0Wm1rBW1k5UQJ9ZmOZzebnbQuoFhw=; b=nnRrKyTeu07VTO8E5kcjWPI3sody2PAofIuL+z/9LF+nkrCg6hcNBLp/ILnHxoz1qU 64PSG4hkYDDspJ2BS0/waLYB6RqKx2vAP8RDhi7yIvopFKTom7Jb484mfI/hWX19vB1H NsEaq1wbpwyc1EQzMO+P0+uwyC0gmHiRNRcMXVn/B3iQfIC8NUz0EDlRua6C2LV7/fHq ieCeErhJdU94XHfZtmaT1RZeVCmzZ6BFMZ38bTEIoA5/j/oyVUtsUM7cWpfjC7HT8+v0 uJphzrY0S2+aaco+VUf/vlWzkvGISDZW2MHPTscCMymI3kZWDxIkPBPGDZjq1g7nVjkL tCIw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from mga09.intel.com (mga09.intel.com. [134.134.136.24]) by mx.google.com with ESMTPS id z1-v6si5733063pfc.97.2018.09.21.08.08.49 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 21 Sep 2018 08:08:49 -0700 (PDT) Received-SPF: pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) client-ip=134.134.136.24; Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Sep 2018 08:08:48 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,285,1534834800"; d="scan'208";a="71856549" Received: from 2b52.sc.intel.com ([143.183.136.51]) by fmsmga007.fm.intel.com with ESMTP; 21 Sep 2018 08:08:48 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue Cc: Yu-cheng Yu Subject: [RFC PATCH v4 07/27] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Date: Fri, 21 Sep 2018 08:03:31 -0700 Message-Id: <20180921150351.20898-8-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180921150351.20898-1-yu-cheng.yu@intel.com> References: <20180921150351.20898-1-yu-cheng.yu@intel.com> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Introduce Kconfig option X86_INTEL_SHADOW_STACK_USER. An application has shadow stack protection when all the following are true: (1) The kernel has X86_INTEL_SHADOW_STACK_USER enabled, (2) The running processor supports the shadow stack, (3) The application is built with shadow stack enabled tools & libs and, and at runtime, all dependent shared libs can support shadow stack. If this kernel config option is enabled, but (2) or (3) above is not true, the application runs without the shadow stack protection. Existing legacy applications will continue to work without the shadow stack protection. The user-mode shadow stack protection is only implemented for the 64-bit kernel. Thirty-two bit applications are supported under the compatibility mode. Signed-off-by: Yu-cheng Yu --- arch/x86/Kconfig | 24 ++++++++++++++++++++++++ arch/x86/Makefile | 7 +++++++ 2 files changed, 31 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 1a0be022f91d..808aa3aecf3c 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1913,6 +1913,30 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS If unsure, say y. +config X86_INTEL_CET + def_bool n + +config ARCH_HAS_SHSTK + def_bool n + +config X86_INTEL_SHADOW_STACK_USER + prompt "Intel Shadow Stack for user-mode" + def_bool n + depends on CPU_SUP_INTEL && X86_64 + select X86_INTEL_CET + select ARCH_HAS_SHSTK + ---help--- + Shadow stack provides hardware protection against program stack + corruption. Only when all the following are true will an application + have the shadow stack protection: the kernel supports it (i.e. this + feature is enabled), the application is compiled and linked with + shadow stack enabled, and the processor supports this feature. + When the kernel has this configuration enabled, existing non shadow + stack applications will continue to work, but without shadow stack + protection. + + If unsure, say y. + config EFI bool "EFI runtime service support" depends on ACPI diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 8f6e7eb8ae9f..b28842b80295 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -152,6 +152,13 @@ ifdef CONFIG_X86_X32 endif export CONFIG_X86_X32_ABI +# Check assembler shadow stack suppot +ifdef CONFIG_X86_INTEL_SHADOW_STACK_USER + ifeq ($(call as-instr, saveprevssp, y),) + $(error CONFIG_X86_INTEL_SHADOW_STACK_USER not supported by the assembler) + endif +endif + # # If the function graph tracer is used with mcount instead of fentry, # '-maccumulate-outgoing-args' is needed to prevent a GCC bug