From patchwork Thu Oct 11 15:15:04 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 10636851 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 47B1817E1 for ; Thu, 11 Oct 2018 15:21:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3695F2B9BF for ; Thu, 11 Oct 2018 15:21:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2A7962B9FE; Thu, 11 Oct 2018 15:21:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AB35D2BA08 for ; Thu, 11 Oct 2018 15:21:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6FEF16B000D; Thu, 11 Oct 2018 11:20:48 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 4EED26B000E; Thu, 11 Oct 2018 11:20:48 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 22BF16B000A; Thu, 11 Oct 2018 11:20:48 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by kanga.kvack.org (Postfix) with ESMTP id A83916B000E for ; Thu, 11 Oct 2018 11:20:47 -0400 (EDT) Received: by mail-pl1-f200.google.com with SMTP id f5-v6so6468235plf.11 for ; Thu, 11 Oct 2018 08:20:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references; bh=McdE7yR3ZVq5AQz5HphRhWAyx0AF717bYF00gYIP8+Y=; b=S8/wqDnv2OQO4aosRM0P0Dw8jEcANJ6h2GyxDAQbN+Vp6GojBpBR7a9dfUYfLxjnch FquMD8I4dQRznj6IVoqUUy1ICUT2sQjiLYAi7BnrG2Cz5yNVaSqu1RbZzSiwalO21PBs zoUUWuSfFR/9bKCC6r5Z/AFBZf89ieqmICH5bmEciGezgy8RNZMneeG/wvdvjUN0/i19 HMTjU6R/3Poc9WSzNZwqP0vaVb5S8AzfgFEqsbpmXFwlBFZyuQbouPrmmMwjKRGzbMXb Q04CUwNuNvIToVDPTZSWB1b7HF6yjj9+b7IKnnAItdnMBWYWnyLXr6cEvAc3UZRzs/Vm 0cRQ== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Gm-Message-State: ABuFfogmowKqf1NTebsV+g0RcUrP6UkYOKUAV6Dl+9ZAkZ2JcLOhMM6/ HEiq2023YyYZr+JZUAvrUaxAuYas/DDtFlmwlUUX5lgOmT3G6GkKiGyXijuRbUXIsw9KAsCwLv0 9RaXprowgmjzRSzcTBvyMdMjnao48ibrFB+LnqWfe9Q9jUkqu5dlaKsSVDk68uz+arQ== X-Received: by 2002:a17:902:5a4d:: with SMTP id f13-v6mr2019861plm.114.1539271247351; Thu, 11 Oct 2018 08:20:47 -0700 (PDT) X-Google-Smtp-Source: ACcGV62RxXIB6XrEgpLZOu+a9g/RmepsJyic05+lbSb36SX+hXYG5f0f6KWYhNfaNC9fqikmlUWc X-Received: by 2002:a17:902:5a4d:: with SMTP id f13-v6mr2019830plm.114.1539271246653; Thu, 11 Oct 2018 08:20:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1539271246; cv=none; d=google.com; s=arc-20160816; b=K5Z2KKRdhBi/zoPQ+JsAnHUSvHxlNgqwAPQoxk/oJjRj0w2NNEsX4ZRd4jJkzltGOM 45tNBmo+GuX99EmcOUCzXB0KpO4ssL3UOwYzvwNoQLWFtRcXq5I+lyg/u7hEHtLZx/XX XcYRa+xQGjUsrSxwPYQKDFUv5cEqZ7kV+LRCawf0Ya5zfFZY11sp8nFUzXcg5km4IuOX 8spq04BBJwF6RfG9N0Bpfm4PsGgxDVxlv76fu1CfPdbF1FCM03s4AqGXwBdVhMFG88sw +tg7nHxkYJDtMIjesfVDRig3H0hll2hVg15CG0ExzAM0nuYsv9Ye24lxMB/bQIy6R7Ms 79jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=references:in-reply-to:message-id:date:subject:cc:to:from; bh=McdE7yR3ZVq5AQz5HphRhWAyx0AF717bYF00gYIP8+Y=; b=WBdihsHmHayv+39ESHJY9jl/D7myJNslSrBIP5dpHkBQtc6HAIWTt+nQGfUfN6tdnb Z9hPLsfNDjKz/RumG48sKFZBn/N/PERPKd+aKd5g4sG44Q9ZpnAs+AhSrP+6J6gRo4JO e+r/c+KcVRWHJpUGqg5SY1EInF0lON6ee0nYpGZn89uCyTXXlqbvi64Rde02VYEzYWIM dE0F/F0waV4sAXwsRkIQsE132BL9aOD3q0LynMKzbCdrSG4qFoIWmGdXdsItrhWl5GFz BvKDs88Ia4yjmGYmEllW1K5Rh2WsQvd+3fyAR92JGyZPZMws9r2FMcRGvHL1LS2W2F3W ktTw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from mga09.intel.com (mga09.intel.com. [134.134.136.24]) by mx.google.com with ESMTPS id m7-v6si30485701pfi.286.2018.10.11.08.20.46 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 11 Oct 2018 08:20:46 -0700 (PDT) Received-SPF: pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) client-ip=134.134.136.24; Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 134.134.136.24 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Oct 2018 08:20:44 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,368,1534834800"; d="scan'208";a="78019102" Received: from 2b52.sc.intel.com ([143.183.136.147]) by fmsmga008.fm.intel.com with ESMTP; 11 Oct 2018 08:20:44 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue Cc: Yu-cheng Yu Subject: [PATCH v5 08/27] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Date: Thu, 11 Oct 2018 08:15:04 -0700 Message-Id: <20181011151523.27101-9-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181011151523.27101-1-yu-cheng.yu@intel.com> References: <20181011151523.27101-1-yu-cheng.yu@intel.com> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Introduce Kconfig option X86_INTEL_SHADOW_STACK_USER. An application has shadow stack protection when all the following are true: (1) The kernel has X86_INTEL_SHADOW_STACK_USER enabled, (2) The running processor supports the shadow stack, (3) The application is built with shadow stack enabled tools & libs and, and at runtime, all dependent shared libs can support shadow stack. If this kernel config option is enabled, but (2) or (3) above is not true, the application runs without the shadow stack protection. Existing legacy applications will continue to work without the shadow stack protection. The user-mode shadow stack protection is only implemented for the 64-bit kernel. Thirty-two bit applications are supported under the compatibility mode. Signed-off-by: Yu-cheng Yu --- arch/x86/Kconfig | 26 ++++++++++++++++++++++++++ arch/x86/Makefile | 7 +++++++ 2 files changed, 33 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 1a0be022f91d..5f73335b7a3a 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1913,6 +1913,32 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS If unsure, say y. +config X86_INTEL_CET + def_bool n + +config ARCH_HAS_SHSTK + def_bool n + +config X86_INTEL_SHADOW_STACK_USER + prompt "Intel Shadow Stack for user-mode" + def_bool n + depends on CPU_SUP_INTEL && X86_64 + select ARCH_USES_HIGH_VMA_FLAGS + select X86_INTEL_CET + select ARCH_HAS_SHSTK + select VM_AREA_GUARD + ---help--- + Shadow stack provides hardware protection against program stack + corruption. Only when all the following are true will an application + have the shadow stack protection: the kernel supports it (i.e. this + feature is enabled), the application is compiled and linked with + shadow stack enabled, and the processor supports this feature. + When the kernel has this configuration enabled, existing non shadow + stack applications will continue to work, but without shadow stack + protection. + + If unsure, say y. + config EFI bool "EFI runtime service support" depends on ACPI diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 8f6e7eb8ae9f..b28842b80295 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -152,6 +152,13 @@ ifdef CONFIG_X86_X32 endif export CONFIG_X86_X32_ABI +# Check assembler shadow stack suppot +ifdef CONFIG_X86_INTEL_SHADOW_STACK_USER + ifeq ($(call as-instr, saveprevssp, y),) + $(error CONFIG_X86_INTEL_SHADOW_STACK_USER not supported by the assembler) + endif +endif + # # If the function graph tracer is used with mcount instead of fentry, # '-maccumulate-outgoing-args' is needed to prevent a GCC bug