Messages in this thread |  | | Subject | Re: [PATCH v15 05/26] x86/cet/shstk: Add Kconfig option for user-mode Shadow Stack | From | "Yu, Yu-cheng" <> | Date | Sat, 28 Nov 2020 08:23:59 -0800 |
| |
On 11/27/2020 9:10 AM, Borislav Petkov wrote: > On Tue, Nov 10, 2020 at 08:21:50AM -0800, Yu-cheng Yu wrote: >> +config X86_CET >> + def_bool n >> + >> +config ARCH_HAS_SHADOW_STACK >> + def_bool n >> + >> +config X86_SHADOW_STACK_USER > > Is X86_SHADOW_STACK_KERNEL coming too? > > Regardless, you can add it when it comes and you can use only X86_CET > for now and drop this one and simplify this pile of Kconfig symbols.
We have X86_BRANCH_TRACKING_USER too. My thought was, X86_CET means any of kernel/user shadow stack/ibt.
> >> + prompt "Intel Shadow Stacks for user-mode" >> + def_bool n >> + depends on CPU_SUP_INTEL && X86_64 >> + depends on AS_HAS_SHADOW_STACK >> + select ARCH_USES_HIGH_VMA_FLAGS >> + select X86_CET >> + select ARCH_HAS_SHADOW_STACK >> + help >> + Shadow Stacks provides protection against program stack >> + corruption. It's a hardware feature. This only matters >> + if you have the right hardware. It's a security hardening >> + feature and apps must be enabled to use it. You get no >> + protection "for free" on old userspace. The hardware can >> + support user and kernel, but this option is for user space >> + only. >> + Support for this feature is only known to be present on >> + processors released in 2020 or later. CET features are also >> + known to increase kernel text size by 3.7 KB. > > This help text needs some rewriting. You can find an inspiration about > more adequate style in that same Kconfig file. >
I will work on it.
>> + >> + If unsure, say N. >> + >> config EFI >> bool "EFI runtime service support" >> depends on ACPI >> diff --git a/scripts/as-x86_64-has-shadow-stack.sh b/scripts/as-x86_64-has-shadow-stack.sh >> new file mode 100755 >> index 000000000000..fac1d363a1b8 >> --- /dev/null >> +++ b/scripts/as-x86_64-has-shadow-stack.sh >> @@ -0,0 +1,4 @@ >> +#!/bin/sh >> +# SPDX-License-Identifier: GPL-2.0 >> + >> +echo "wrussq %rax, (%rbx)" | $* -x assembler -c - > > 2> /dev/null > > otherwise you get > > {standard input}: Assembler messages: > {standard input}:1: Error: no such instruction: `wrussq %rax,(%rbx) > > on non-enlightened toolchains during build. >
Yes, I will fix this in the next revision.
Yu-cheng
> Thx. >
|  |