lkml.org 
[lkml]   [2018]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [RFC PATCH v3 18/24] x86/cet/shstk: User-mode shadow stack support
    From
    Date
    On Thu, 2018-08-30 at 18:10 +0200, Jann Horn wrote:
    > On Thu, Aug 30, 2018 at 4:44 PM Yu-cheng Yu <yu-cheng.yu@intel.com>
    > wrote:
    > >
    > >
    > > This patch adds basic shadow stack enabling/disabling routines.
    > > A task's shadow stack is allocated from memory with VM_SHSTK
    > > flag set and read-only protection.  The shadow stack is
    > > allocated to a fixed size of RLIMIT_STACK.
    > >
    > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
    > [...]
    > >
    > > +static int set_shstk_ptr(unsigned long addr)
    > > +{
    > > +       u64 r;
    > > +
    > > +       if (!cpu_feature_enabled(X86_FEATURE_SHSTK))
    > > +               return -1;
    > > +
    > > +       if ((addr >= TASK_SIZE_MAX) || (!IS_ALIGNED(addr, 4)))
    > > +               return -1;
    > > +
    > > +       rdmsrl(MSR_IA32_U_CET, r);
    > > +       wrmsrl(MSR_IA32_PL3_SSP, addr);
    > > +       wrmsrl(MSR_IA32_U_CET, r | MSR_IA32_CET_SHSTK_EN);
    > > +       return 0;
    > > +}
    > Here's a really stupid question: Where is the logic for switching
    > those MSRs on task switch? MSR_IA32_PL3_SSP contains a userspace
    > pointer, so it has to be switched on task switch, right? I'm sure
    > I'm
    > missing something obvious, but grepping for places that set
    > MSR_IA32_PL3_SSP to nonzero values through the entire patchset, I
    > only
    > see set_shstk_ptr(), which is called from:
    >
    >  - cet_setup_shstk() (called from arch_setup_features(), which is
    > called from load_elf_binary())
    >  - cet_restore_signal() (called on signal handler return)
    >  - cet_setup_signal() (called from signal handling code)

    The MSR is in the XSAVES buffer and switched by XSAVES/XRSTORS.

    Yu-cheng

    \
     
     \ /
      Last update: 2018-08-30 20:09    [W:3.504 / U:1.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site