From patchwork Tue Jul 10 22:26:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yu-cheng Yu X-Patchwork-Id: 10518139 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3FDCE6032A for ; Tue, 10 Jul 2018 22:31:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2FEDA28F39 for ; Tue, 10 Jul 2018 22:31:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2289D28F59; Tue, 10 Jul 2018 22:31:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ABE2328F39 for ; Tue, 10 Jul 2018 22:31:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1985F6B0010; Tue, 10 Jul 2018 18:31:14 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 0F3396B000E; Tue, 10 Jul 2018 18:31:14 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EAD7D6B0269; Tue, 10 Jul 2018 18:31:13 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pf0-f199.google.com (mail-pf0-f199.google.com [209.85.192.199]) by kanga.kvack.org (Postfix) with ESMTP id 9E7AD6B0010 for ; Tue, 10 Jul 2018 18:31:13 -0400 (EDT) Received: by mail-pf0-f199.google.com with SMTP id u8-v6so7428573pfn.18 for ; Tue, 10 Jul 2018 15:31:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references; bh=pw6se1aGC/J5C9lGb7l2IqvbhF5S3W91ECTKFGwdCIk=; b=UsnhEe/aE2rs5AshM6ON5c0aOhjtf1KtEUU6uwL3oqnWWodE5YFqui9Ypwg/pKay07 HukwSBvpgSyhsGdO9Ci+I6hvcAqdpHFzVyFObjb+WYiybPZHtkwskGHdcZy21TyQMskT fkWWv82FOA+4/C8hIdSeNObpgy/KubqBZtEl33DilD7DgzYreCcKb3sLWBGm53VwoPMi P8tvOCIaUD/l4S+PHf5lmppDD/LPofZMm8UVJZAasPPzz5yY/LRQtGtzIStjnC9AqL1Q 0RWX1JyqvLuu45mQ9TlSJ6vkUZpA/79vMYwmKaK+IL/xVxbs/qYtKiTjdRRmd8eeoQCT 4xPQ== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Gm-Message-State: APt69E0uS18sbUNHqp77rLVT6SG5twB7pwCIMMj+FQHeM7rvxJMdmM5h 2EMkI18vZt2/xrZgVqXN0zaupNFUuctuHInjQT6zbnLxF1U77mUR7nPc4VBGb3ociyBJb+lJuu/ fNEgnYkAdjxIqCDiTpqte0O7+eLbg2MT4dxAddKnnTRt9O9XNUJk7hV5kUGroOVPAUw== X-Received: by 2002:a65:6102:: with SMTP id z2-v6mr24625165pgu.46.1531261873300; Tue, 10 Jul 2018 15:31:13 -0700 (PDT) X-Google-Smtp-Source: AAOMgpfyATFJRQoObnE5MFNBIYA1v9KrW/RUvg769RgsyG9aAv4uKJDzZ7DtL158dsJ//eUHth0B X-Received: by 2002:a65:6102:: with SMTP id z2-v6mr24625127pgu.46.1531261872480; Tue, 10 Jul 2018 15:31:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1531261872; cv=none; d=google.com; s=arc-20160816; b=nDFzVJpddF24KMOPpb24AvddxkVR2wZU3yWx5hlAl3tTzsNlnwc/9CGpbSPrN4THbq dA9jbUXK6CtFzWV4tgT0pS9+OYZdbMB2Jq8wRmHtizmL8KzfbozoZMWXk+la/hStYQ/N iQxrYSTg2KhQyxOZ1HyOy+DyqmZiqk1oF7GUdpTSnhjsnSRpkotDtFJ6LkD/nHF+QYG2 odnZzSgZePqztvimWlSkP/WB9SOO8kx+7MQzn8ZfY4WR0fMSeGutUEeTbNv17ZOsj1bZ vUu51VKzf887piREyJsOpKwONR5UwN70+6uFRBexUs+Gxj3W+AZY9KNmfvcuOyGrT1bd ouJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=references:in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=pw6se1aGC/J5C9lGb7l2IqvbhF5S3W91ECTKFGwdCIk=; b=LIDX1CollSt+xWohnrSR5GPXkgxP1f+87bWE07v5oROFRSTwnFWBQzHEUjrdGCswjQ WaAX1XP7+mDHfadgwSsEVwSzaaNGwFiT7dXtnNfR1pgP2MuUEj6FsML9CEa1NLJcaXjC oPMDLqUrMaCipPFCwk6t1sA8th9fh8q4sYHpz0iG6q8sip7rUhRRMsLD0BsT3iOtl1Bq TxVZT3Dr4qMRespvBYxv5KfqPsDeiutBeWQoRhRcxr/AjJz4/EtxCbjzPaT8ZalqyafM RI871gAlqxGeVJf1RxLxNm8xHYYvScX/E/jN3q7KHONhmNm6n5fNHZobXT9IjboyQFz+ qduw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from mga11.intel.com (mga11.intel.com. [192.55.52.93]) by mx.google.com with ESMTPS id z10-v6si17009124pgo.412.2018.07.10.15.31.12 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 10 Jul 2018 15:31:12 -0700 (PDT) Received-SPF: pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) client-ip=192.55.52.93; Authentication-Results: mx.google.com; spf=pass (google.com: domain of yu-cheng.yu@intel.com designates 192.55.52.93 as permitted sender) smtp.mailfrom=yu-cheng.yu@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 10 Jul 2018 15:31:11 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,335,1526367600"; d="scan'208";a="70305384" Received: from 2b52.sc.intel.com ([143.183.136.52]) by fmsmga004.fm.intel.com with ESMTP; 10 Jul 2018 15:31:11 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , "Ravi V. Shankar" , Vedvyas Shanbhogue Cc: Yu-cheng Yu Subject: [RFC PATCH v2 07/27] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Date: Tue, 10 Jul 2018 15:26:19 -0700 Message-Id: <20180710222639.8241-8-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180710222639.8241-1-yu-cheng.yu@intel.com> References: <20180710222639.8241-1-yu-cheng.yu@intel.com> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Introduce Kconfig option X86_INTEL_SHADOW_STACK_USER. An application has shadow stack protection when all the following are true: (1) The kernel has X86_INTEL_SHADOW_STACK_USER enabled, (2) The running processor supports the shadow stack, (3) The application is built with shadow stack enabled tools & libs and, and at runtime, all dependent shared libs can support shadow stack. If this kernel config option is enabled, but (2) or (3) above is not true, the application runs without the shadow stack protection. Existing legacy applications will continue to work without the shadow stack protection. The user-mode shadow stack protection is only implemented for the 64-bit kernel. Thirty-two bit applications are supported under the compatibility mode. Signed-off-by: Yu-cheng Yu --- arch/x86/Kconfig | 24 ++++++++++++++++++++++++ arch/x86/Makefile | 7 +++++++ 2 files changed, 31 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f1dbb4ee19d7..44af5e1aaa4a 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1917,6 +1917,30 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS If unsure, say y. +config X86_INTEL_CET + def_bool n + +config ARCH_HAS_SHSTK + def_bool n + +config X86_INTEL_SHADOW_STACK_USER + prompt "Intel Shadow Stack for user-mode" + def_bool n + depends on CPU_SUP_INTEL && X86_64 + select X86_INTEL_CET + select ARCH_HAS_SHSTK + ---help--- + Shadow stack provides hardware protection against program stack + corruption. Only when all the following are true will an application + have the shadow stack protection: the kernel supports it (i.e. this + feature is enabled), the application is compiled and linked with + shadow stack enabled, and the processor supports this feature. + When the kernel has this configuration enabled, existing non shadow + stack applications will continue to work, but without shadow stack + protection. + + If unsure, say y. + config EFI bool "EFI runtime service support" depends on ACPI diff --git a/arch/x86/Makefile b/arch/x86/Makefile index a08e82856563..ad1314e5ef65 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -157,6 +157,13 @@ ifdef CONFIG_X86_X32 endif export CONFIG_X86_X32_ABI +# Check assembler shadow stack suppot +ifdef CONFIG_X86_INTEL_SHADOW_STACK_USER + ifeq ($(call as-instr, saveprevssp, y),) + $(error CONFIG_X86_INTEL_SHADOW_STACK_USER not supported by the assembler) + endif +endif + # # If the function graph tracer is used with mcount instead of fentry, # '-maccumulate-outgoing-args' is needed to prevent a GCC bug