From patchwork Tue Jun 13 00:11:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 106989 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp222713vqr; Mon, 12 Jun 2023 17:45:52 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6TNj2SZ6EB2FS4kuKL+zspRrrahdgRQalCJsDbZUavYMUBbPK2Ph5ygkInBWeoAJppSVYc X-Received: by 2002:aa7:c1c3:0:b0:514:ae6d:dc24 with SMTP id d3-20020aa7c1c3000000b00514ae6ddc24mr6538198edp.8.1686617152034; Mon, 12 Jun 2023 17:45:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686617152; cv=none; d=google.com; s=arc-20160816; b=trd8xPOm7qnfcrMW/5dtK1Ne4b1lIEj/wH3RPr9W3hWet7OsqqPnXdE95FokkUpgFN QQyV7UQA39Qmu2Ucd2lgBGL9hOuSlikNBVvmmv+DStUj3zX/A9LRD/+ZTs6myw67Z8Uz lHjnNpymVZi8FLB/d/04uI08GQ3FDsflWnJlG066YKXpzTYAivqNFoos6Ai1IB7qP+8W VBPrhtNnd7Jt9zDqi6C9wIFACRbdZAkzwxs10LI46z89i77EuYxBypHzOIoqh+P5Et2Y au3YGLN3dzVlKlteUJacSzi3/Jh4DSxgOdTYk23WK+/RGy4o0TEnk9Se+MGBknQXcbr+ 4lLw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=DsGV+FArnCWzPmUm3Iwim6nAv4YxSXJQs9pogdjIv6c=; b=NDCtJzdJ55+GOSiNe/eilNUGWnm309+7OQVYX/mRO11PTUSYTwQw/2k3dThzsyG4Nu 0uz0+1sJ6uPIplz2HqWlLJS8vmsBM7Uiaoz9ZD+tZSNEp61RfYxdXT08hX/F9Ti4sQTu cmv7uDB+ER8ZJwynQk9dt6iZTYCiSqn8Nb4HgdL+28tnyjq+qWab7pUnDVRv5UxB25BU rfZudQdJagfAi90xQiy6GQb6om58IlgPnuGFF1SZFOMnd8eJtEPFGouUK9rARpgYVhOL wG8URNadS53BCKlUnJ0jv/YXJyC9I+fM9xNMKGtHELbLH3MC467Cuf9YT69TkIo4mWC0 4R5A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=QgMsEJA5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e4-20020a056402088400b0050489449e77si2706010edy.569.2023.06.12.17.44.50; Mon, 12 Jun 2023 17:45:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=QgMsEJA5; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239541AbjFMASw (ORCPT + 99 others); Mon, 12 Jun 2023 20:18:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239081AbjFMARe (ORCPT ); Mon, 12 Jun 2023 20:17:34 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B91AF0; Mon, 12 Jun 2023 17:14:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1686615247; x=1718151247; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Src9+kIB+Tfk1ReeJh4vEiYrNG1G01r+lIh28P15+jA=; b=QgMsEJA5QLErJ9NSGDjEfYUTb4UJdi6QHUJiFIV9ZPaamI/8fZoskvLg EGQkV6D6Ons2i/3Cbxa7uKZlv9LPdIZjFiOdUs/8zMth95uT2TEQ40Cdm jGvsuKB04wUHNK/CQKlLUE/gICny38QWl8ekxu+jSYNRshJLPzpHyfvz6 AWC6oSsbGWDydV0BrjfOcSOPafkmiVh1nB/6uBcV8M3S9KEmkDuTJ9pV+ bz59jqqvK1l8jYtqIIjXCtknhx9mckcllIReBjBUaPEKa/JkGZPCIQ2+c kIw91sYppsJeoQu6M2r+25HotvQFjSKE2un8UpoVJrgitrljEUU3SCWME w==; X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="361557487" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="361557487" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:38 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="835671131" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="835671131" Received: from almeisch-mobl1.amr.corp.intel.com (HELO rpedgeco-desk4.amr.corp.intel.com) ([10.209.42.242]) by orsmga004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:37 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com, szabolcs.nagy@arm.com, torvalds@linux-foundation.org, broonie@kernel.org Cc: rick.p.edgecombe@intel.com, Pengfei Xu Subject: [PATCH v9 35/42] x86/shstk: Support WRSS for userspace Date: Mon, 12 Jun 2023 17:11:01 -0700 Message-Id: <20230613001108.3040476-36-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> References: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768546267007126329?= X-GMAIL-MSGID: =?utf-8?q?1768546267007126329?= For the current shadow stack implementation, shadow stacks contents can't easily be provisioned with arbitrary data. This property helps apps protect themselves better, but also restricts any potential apps that may want to do exotic things at the expense of a little security. The x86 shadow stack feature introduces a new instruction, WRSS, which can be enabled to write directly to shadow stack memory from userspace. Allow it to get enabled via the prctl interface. Only enable the userspace WRSS instruction, which allows writes to userspace shadow stacks from userspace. Do not allow it to be enabled independently of shadow stack, as HW does not support using WRSS when shadow stack is disabled. >From a fault handler perspective, WRSS will behave very similar to WRUSS, which is treated like a user access from a #PF err code perspective. Signed-off-by: Rick Edgecombe Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Kees Cook Acked-by: Mike Rapoport (IBM) Tested-by: Pengfei Xu Tested-by: John Allen Tested-by: Kees Cook --- arch/x86/include/uapi/asm/prctl.h | 1 + arch/x86/kernel/shstk.c | 43 ++++++++++++++++++++++++++++++- 2 files changed, 43 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/uapi/asm/prctl.h b/arch/x86/include/uapi/asm/prctl.h index 6a8e0e1bff4a..eedfde3b63be 100644 --- a/arch/x86/include/uapi/asm/prctl.h +++ b/arch/x86/include/uapi/asm/prctl.h @@ -36,5 +36,6 @@ /* ARCH_SHSTK_ features bits */ #define ARCH_SHSTK_SHSTK (1ULL << 0) +#define ARCH_SHSTK_WRSS (1ULL << 1) #endif /* _ASM_X86_PRCTL_H */ diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index 04c37b33a625..ea0bf113f9cf 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -390,6 +390,47 @@ void shstk_free(struct task_struct *tsk) unmap_shadow_stack(shstk->base, shstk->size); } +static int wrss_control(bool enable) +{ + u64 msrval; + + if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) + return -EOPNOTSUPP; + + /* + * Only enable WRSS if shadow stack is enabled. If shadow stack is not + * enabled, WRSS will already be disabled, so don't bother clearing it + * when disabling. + */ + if (!features_enabled(ARCH_SHSTK_SHSTK)) + return -EPERM; + + /* Already enabled/disabled? */ + if (features_enabled(ARCH_SHSTK_WRSS) == enable) + return 0; + + fpregs_lock_and_load(); + rdmsrl(MSR_IA32_U_CET, msrval); + + if (enable) { + features_set(ARCH_SHSTK_WRSS); + msrval |= CET_WRSS_EN; + } else { + features_clr(ARCH_SHSTK_WRSS); + if (!(msrval & CET_WRSS_EN)) + goto unlock; + + msrval &= ~CET_WRSS_EN; + } + + wrmsrl(MSR_IA32_U_CET, msrval); + +unlock: + fpregs_unlock(); + + return 0; +} + static int shstk_disable(void) { if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) @@ -406,7 +447,7 @@ static int shstk_disable(void) fpregs_unlock(); shstk_free(current); - features_clr(ARCH_SHSTK_SHSTK); + features_clr(ARCH_SHSTK_SHSTK | ARCH_SHSTK_WRSS); return 0; }