From patchwork Mon Nov 19 21:47:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 10689527 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CD2C714BD for ; Mon, 19 Nov 2018 21:54:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C15302A583 for ; Mon, 19 Nov 2018 21:54:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B58312A6EC; Mon, 19 Nov 2018 21:54:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 451702A583 for ; Mon, 19 Nov 2018 21:54:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 968C16B1C90; Mon, 19 Nov 2018 16:54:20 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 8C3436B1C91; Mon, 19 Nov 2018 16:54:20 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7422E6B1C92; Mon, 19 Nov 2018 16:54:20 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by kanga.kvack.org (Postfix) with ESMTP id 248DF6B1C90 for ; Mon, 19 Nov 2018 16:54:20 -0500 (EST) Received: by mail-pf1-f200.google.com with SMTP id g63-v6so27543281pfc.9 for ; Mon, 19 Nov 2018 13:54:20 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references; bh=Kue5H9yCIZODI4T4AifLYhnGwkJ2G/QsVSJ2CiNfkS8=; b=KzgStzho1FihS1yyHSygQai/7B8F0TIbC+nUExLtQF2mxnHSbH1osQWDlLsmx2MG24 a18dOXZn3I2uHDXTd1YiRd8hbMCNS3ENqLmOQU4A8dSU3sec6339d192E5OnfbBtS455 iffpFgGZKVCfk30hy+Fy9cXsR9PvT/FxJbLcnxTX8rgx6oDHMUXjgfnEXVKo1k/ofWg4 ot5FZd4wfwEMqboD0vfgdCKbtmfcEOxpSvyE2lZJYCBA3v2UgTCT+qnfYwEvR0aHcwnf uBLa2lOmZrMB9CkJNPxEIp12/ObMhXURINlgLhgquQRvGG8SAVaCC/lEMhjZglPrISri d4HQ== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Gm-Message-State: AGRZ1gKNcCiRRLp7raAII3mYlnraRRYsGunCC2mhC9BPwO0lkCrCgBPg CeR3B3iJ/zTss2srrTr4rjQ8CiK7nrP+p1PAJofk2H2YR0csziR/c9bDRDr+PROGVFok5VGb/DX wc5gxfca2uIoQ2pn7DGp8sa578Z4PjNLfac/6LDOz7+a5/J4Anp9snZRw2hYPKPrPXA== X-Received: by 2002:a63:2315:: with SMTP id j21mr21864958pgj.297.1542664459815; Mon, 19 Nov 2018 13:54:19 -0800 (PST) X-Google-Smtp-Source: AJdET5dGLKHfnMlQ+TckKfPmmcErz67Fs3YMgZpLmaGkiVjTLWwIAcokZInbmqAGCEUACyD8QdiS X-Received: by 2002:a63:2315:: with SMTP id j21mr21864922pgj.297.1542664458989; Mon, 19 Nov 2018 13:54:18 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1542664458; cv=none; d=google.com; s=arc-20160816; b=WPRQI1bbj6zZ7I93mveUbLFIQz14mS4Z365nmqahEhUaWLsW2CQCcQ4RzEEutrpnkU nZh+/kIiIJRWL4q5JBcAlyd7O6UtNAlgX6snAVPzqDXCOEvdot8b5dLWTOc4wgVFdF1Q Rd835hNkkaMHamuGyH9Ct/zSZmIy6SKYgSq/filNYF2BfqNshMSrIuhf94LQkLxZf9iy 2892qtpJDhTyEm9idGXX5SnkaqAsKSV5ObVA9MgcioLQejy2GEpNWqkqSHCx4anQn0sF 0iffn2SWl67e/8g7JR1G+5aexFfGxDtILBbnmRsJA6nTaOfM4dKyXr+lv9cUcAOSrYqh cwsQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=references:in-reply-to:message-id:date:subject:cc:to:from; bh=Kue5H9yCIZODI4T4AifLYhnGwkJ2G/QsVSJ2CiNfkS8=; b=gGLepAgJrLBoBdee7sCRoNtnLTcqoLMDZmYDwuVI2ruQYd2MNuZYkA3PD0S9plgh9K ef3bKV02hsvXV/fmtZ5exuyEfxQTikEfKSr0itKQfU0mKdzeWplGTjk/2yS1/7g1M5nU 5Utqh6vEVSJwItPMoei3HsaA1Sz6oJkkQtvl+hnlEClN7pzBwKfU6Lm6rt3FHvSnhEVi GN8m5nWmnwkh3g4fFbKIUXmhWSNs1x0FAxlud5BYEWl2v9b8pCsV//FypCgU0eWKA5Kr AQpSkuAVCqueg4gWMaq8coO4dDpFgCWODgx4qVkWQTEN5YJgWHbv+QMx5v4Yt+AVqaBU 1A+Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from mga11.intel.com (mga11.intel.com. [192.55.52.93]) by mx.google.com with ESMTPS id o12-v6si32492543plg.114.2018.11.19.13.54.18 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Nov 2018 13:54:18 -0800 (PST) Received-SPF: pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) client-ip=192.55.52.93; Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Nov 2018 13:54:18 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,254,1539673200"; d="scan'208";a="93319849" Received: from yyu32-desk1.sc.intel.com ([143.183.136.147]) by orsmga008.jf.intel.com with ESMTP; 19 Nov 2018 13:54:17 -0800 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue Cc: Yu-cheng Yu Subject: [RFC PATCH v6 07/26] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Date: Mon, 19 Nov 2018 13:47:50 -0800 Message-Id: <20181119214809.6086-8-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181119214809.6086-1-yu-cheng.yu@intel.com> References: <20181119214809.6086-1-yu-cheng.yu@intel.com> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Introduce Kconfig option X86_INTEL_SHADOW_STACK_USER. An application has shadow stack protection when all the following are true: (1) The kernel has X86_INTEL_SHADOW_STACK_USER enabled, (2) The running processor supports the shadow stack, (3) The application is built with shadow stack enabled tools & libs and, and at runtime, all dependent shared libs can support shadow stack. If this kernel config option is enabled, but (2) or (3) above is not true, the application runs without the shadow stack protection. Existing legacy applications will continue to work without the shadow stack protection. The user-mode shadow stack protection is only implemented for the 64-bit kernel. Thirty-two bit applications are supported under the compatibility mode. Signed-off-by: Yu-cheng Yu --- arch/x86/Kconfig | 25 +++++++++++++++++++++++++ arch/x86/Makefile | 7 +++++++ 2 files changed, 32 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 9d734f3c8234..86fb68f496a6 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1919,6 +1919,31 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS If unsure, say y. +config X86_INTEL_CET + def_bool n + +config ARCH_HAS_SHSTK + def_bool n + +config X86_INTEL_SHADOW_STACK_USER + prompt "Intel Shadow Stack for user-mode" + def_bool n + depends on CPU_SUP_INTEL && X86_64 + select ARCH_USES_HIGH_VMA_FLAGS + select X86_INTEL_CET + select ARCH_HAS_SHSTK + ---help--- + Shadow stack provides hardware protection against program stack + corruption. Only when all the following are true will an application + have the shadow stack protection: the kernel supports it (i.e. this + feature is enabled), the application is compiled and linked with + shadow stack enabled, and the processor supports this feature. + When the kernel has this configuration enabled, existing non shadow + stack applications will continue to work, but without shadow stack + protection. + + If unsure, say y. + config EFI bool "EFI runtime service support" depends on ACPI diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 88398fdf8129..0e4746814452 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -152,6 +152,13 @@ ifdef CONFIG_X86_X32 endif export CONFIG_X86_X32_ABI +# Check assembler shadow stack suppot +ifdef CONFIG_X86_INTEL_SHADOW_STACK_USER + ifeq ($(call as-instr, saveprevssp, y),) + $(error CONFIG_X86_INTEL_SHADOW_STACK_USER not supported by the assembler) + endif +endif + # # If the function graph tracer is used with mcount instead of fentry, # '-maccumulate-outgoing-args' is needed to prevent a GCC bug