From patchwork Sun Jan 30 21:18:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 12730164 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC407C4332F for ; Sun, 30 Jan 2022 21:22:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 577F26B00C3; Sun, 30 Jan 2022 16:22:16 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 500176B00C5; Sun, 30 Jan 2022 16:22:16 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 303C36B00C6; Sun, 30 Jan 2022 16:22:16 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0187.hostedemail.com [216.40.44.187]) by kanga.kvack.org (Postfix) with ESMTP id 1B1DC6B00C3 for ; Sun, 30 Jan 2022 16:22:16 -0500 (EST) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id CB0248249980 for ; Sun, 30 Jan 2022 21:22:15 +0000 (UTC) X-FDA: 79088226630.27.6B705BB Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by imf23.hostedemail.com (Postfix) with ESMTP id 430E2140006 for ; Sun, 30 Jan 2022 21:22:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1643577735; x=1675113735; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=s08st2zzx9YvkrATdX2s27PCtQcWcePp2JHFEXn/D9c=; b=JFJqG2p5J79KG+eEAig45HnS/LzrAUoS8TLTYPdhWwOHUtAsPOkPHlHM R8vRKg+XKKby48Pen6TshIowUt+lyfiR/jdRbXsEN0ZY1CQ2YhDFI+lKT 4YQ5FELkuNGkdsOIXhGrDw9rd1+DDtPanSLWYRGgrXCYy/YvvNuHsHewl teC3U8n7rAZw01hopaPAWwSAExiH3ET8/8OkA1MJKAe56OCtomutFMSK8 WMIV788GtjK5XgYY3BhKXaia/5egcfx1DWN2UdbVq8GtHmQK5vQmBo2T2 vVOqJnDpZU8jY99xFzL+Kmfh/Uje4YiYy8SMcTdttCISGevjvdO5p59kZ w==; X-IronPort-AV: E=McAfee;i="6200,9189,10243"; a="244970237" X-IronPort-AV: E=Sophos;i="5.88,329,1635231600"; d="scan'208";a="244970237" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jan 2022 13:22:14 -0800 X-IronPort-AV: E=Sophos;i="5.88,329,1635231600"; d="scan'208";a="536857021" Received: from avmallar-mobl1.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.209.123.171]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jan 2022 13:22:13 -0800 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V . Shankar" , Dave Martin , Weijiang Yang , "Kirill A . Shutemov" , joao.moreira@intel.com, John Allen , kcc@google.com, eranian@google.com Cc: rick.p.edgecombe@intel.com Subject: [PATCH 34/35] x86/cet/shstk: Support wrss for userspace Date: Sun, 30 Jan 2022 13:18:37 -0800 Message-Id: <20220130211838.8382-35-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220130211838.8382-1-rick.p.edgecombe@intel.com> References: <20220130211838.8382-1-rick.p.edgecombe@intel.com> X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 430E2140006 X-Stat-Signature: 3rsazmeyctoh9dh4az4dndnifydnimwn Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=JFJqG2p5; dmarc=pass (policy=none) header.from=intel.com; spf=none (imf23.hostedemail.com: domain of rick.p.edgecombe@intel.com has no SPF policy when checking 192.55.52.93) smtp.mailfrom=rick.p.edgecombe@intel.com X-Rspam-User: nil X-HE-Tag: 1643577735-378077 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: For the current shadow stack implementation, shadow stacks contents cannot be arbitrarily provisioned with data. This property helps apps protect themselves better, but also restricts any potential apps that may want to do exotic things at the expense of a little security. The x86 shadow stack feature introduces a new instruction, wrss, which can be enabled to write directly to shadow stack permissioned memory from userspace. Allow it to get enabled via the prctl interface. Only enable the userspace wrss instruction, which allows writes to userspace shadow stacks from userspace. Do not allow it to be enabled independently of shadow stack, as HW does not support using WRSS when shadow stack is disabled. Prevent shadow stack's from becoming executable to assist apps who want W^X enforced. Add an arch_validate_flags() implementation to handle the check. Rename the uapi/asm/mman.h header guard to be able to use it for arch/x86/include/asm/mman.h where the arch_validate_flags() will be. From a fault handler perspective, WRSS will behave very similar to WRUSS, which is treated like a user access from a PF err code perspective. Signed-off-by: Rick Edgecombe --- v1: - New patch. arch/x86/include/asm/cet.h | 3 +++ arch/x86/include/asm/mman.h | 5 ++++- arch/x86/include/uapi/asm/prctl.h | 2 +- arch/x86/kernel/elf_feature_prctl.c | 6 +++++ arch/x86/kernel/shstk.c | 35 ++++++++++++++++++++++++++++- 5 files changed, 48 insertions(+), 3 deletions(-) diff --git a/arch/x86/include/asm/cet.h b/arch/x86/include/asm/cet.h index cbc7cfcba5dc..c8ff0bd5f5bc 100644 --- a/arch/x86/include/asm/cet.h +++ b/arch/x86/include/asm/cet.h @@ -10,6 +10,7 @@ struct task_struct; struct thread_shstk { u64 base; u64 size; + bool wrss; }; #ifdef CONFIG_X86_SHADOW_STACK @@ -19,6 +20,7 @@ int shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags, void shstk_free(struct task_struct *p); int shstk_disable(void); void reset_thread_shstk(void); +int wrss_control(bool enable); int shstk_setup_rstor_token(bool proc32, unsigned long restorer, unsigned long *new_ssp); int shstk_check_rstor_token(bool proc32, unsigned long *new_ssp); @@ -32,6 +34,7 @@ static inline int shstk_alloc_thread_stack(struct task_struct *p, static inline void shstk_free(struct task_struct *p) {} static inline void shstk_disable(void) {} static inline void reset_thread_shstk(void) {} +static inline void wrss_control(bool enable) {} static inline int shstk_setup_rstor_token(bool proc32, unsigned long restorer, unsigned long *new_ssp) { return 0; } static inline int shstk_check_rstor_token(bool proc32, diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h index b44fe31deb3a..c05951a36d93 100644 --- a/arch/x86/include/asm/mman.h +++ b/arch/x86/include/asm/mman.h @@ -8,7 +8,10 @@ #ifdef CONFIG_X86_SHADOW_STACK static inline bool arch_validate_flags(unsigned long vm_flags) { - if ((vm_flags & VM_SHADOW_STACK) && (vm_flags & VM_WRITE)) + /* + * Shadow stack must not be executable, to help with W^X due to wrss. + */ + if ((vm_flags & VM_SHADOW_STACK) && (vm_flags & (VM_WRITE | VM_EXEC))) return false; return true; diff --git a/arch/x86/include/uapi/asm/prctl.h b/arch/x86/include/uapi/asm/prctl.h index aa294c7bcf41..210976925325 100644 --- a/arch/x86/include/uapi/asm/prctl.h +++ b/arch/x86/include/uapi/asm/prctl.h @@ -28,6 +28,6 @@ /* x86 feature bits to be used with ARCH_X86_FEATURE arch_prctl()s */ #define LINUX_X86_FEATURE_IBT 0x00000001 #define LINUX_X86_FEATURE_SHSTK 0x00000002 - +#define LINUX_X86_FEATURE_WRSS 0x00000010 #endif /* _ASM_X86_PRCTL_H */ diff --git a/arch/x86/kernel/elf_feature_prctl.c b/arch/x86/kernel/elf_feature_prctl.c index 47de201db3f7..ecad6ebeb4dd 100644 --- a/arch/x86/kernel/elf_feature_prctl.c +++ b/arch/x86/kernel/elf_feature_prctl.c @@ -21,6 +21,8 @@ static int elf_feat_copy_status_to_user(struct thread_shstk *shstk, u64 __user * buf[1] = shstk->base; buf[2] = shstk->size; } + if (shstk->wrss) + buf[0] |= LINUX_X86_FEATURE_WRSS; return copy_to_user(ubuf, buf, sizeof(buf)); } @@ -40,6 +42,8 @@ int prctl_elf_feature(int option, u64 arg2) if (arg2 & thread->feat_prctl_locked) return -EPERM; + if (arg2 & LINUX_X86_FEATURE_WRSS && !wrss_control(false)) + feat_succ |= LINUX_X86_FEATURE_WRSS; if (arg2 & LINUX_X86_FEATURE_SHSTK && !shstk_disable()) feat_succ |= LINUX_X86_FEATURE_SHSTK; @@ -52,6 +56,8 @@ int prctl_elf_feature(int option, u64 arg2) if (arg2 & LINUX_X86_FEATURE_SHSTK && !shstk_setup()) feat_succ |= LINUX_X86_FEATURE_SHSTK; + if (arg2 & LINUX_X86_FEATURE_WRSS && !wrss_control(true)) + feat_succ |= LINUX_X86_FEATURE_WRSS; if (feat_succ != arg2) return -ECANCELED; diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index 53be5d5539d4..92612236b4ef 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -230,6 +230,36 @@ void shstk_free(struct task_struct *tsk) shstk->size = 0; } +int wrss_control(bool enable) +{ + struct thread_shstk *shstk = ¤t->thread.shstk; + void *xstate; + int err; + + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return 1; + /* + * Only enable wrss if shadow stack is enabled. If shadow stack is not + * enabled, wrss will already be disabled, so don't bother clearing it + * when disabling. + */ + if (!shstk->size || shstk->wrss == enable) + return 1; + + xstate = start_update_xsave_msrs(XFEATURE_CET_USER); + if (enable) + err = xsave_set_clear_bits_msrl(xstate, MSR_IA32_U_CET, CET_WRSS_EN, 0); + else + err = xsave_set_clear_bits_msrl(xstate, MSR_IA32_U_CET, 0, CET_WRSS_EN); + end_update_xsave_msrs(); + + if (err) + return 1; + + shstk->wrss = enable; + return 0; +} + int shstk_disable(void) { struct thread_shstk *shstk = ¤t->thread.shstk; @@ -242,7 +272,9 @@ int shstk_disable(void) return 1; xstate = start_update_xsave_msrs(XFEATURE_CET_USER); - err = xsave_set_clear_bits_msrl(xstate, MSR_IA32_U_CET, 0, CET_SHSTK_EN); + /* Disable WRSS too when disabling shadow stack */ + err = xsave_set_clear_bits_msrl(xstate, MSR_IA32_U_CET, 0, + CET_SHSTK_EN | CET_WRSS_EN); if (!err) err = xsave_wrmsrl(xstate, MSR_IA32_PL3_SSP, 0); end_update_xsave_msrs(); @@ -251,6 +283,7 @@ int shstk_disable(void) return 1; shstk_free(current); + shstk->wrss = 0; return 0; }