lkml.org 
[lkml]   [2021]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v26 02/30] x86/cet/shstk: Add Kconfig option for Shadow Stack
    Date
    Shadow Stack provides protection against function return address
    corruption. It is active when the processor supports it, the kernel has
    CONFIG_X86_SHADOW_STACK enabled, and the application is built for the
    feature. This is only implemented for the 64-bit kernel. When it is
    enabled, legacy non-Shadow Stack applications continue to work, but without
    protection.

    Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
    Cc: Kees Cook <keescook@chromium.org>
    ---
    v25:
    - Remove X86_CET and use X86_SHADOW_STACK directly.

    v24:
    - Update for the splitting X86_CET to X86_SHADOW_STACK and X86_IBT.

    arch/x86/Kconfig | 22 ++++++++++++++++++++++
    arch/x86/Kconfig.assembler | 5 +++++
    2 files changed, 27 insertions(+)

    diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
    index 2792879d398e..41283f82fd87 100644
    --- a/arch/x86/Kconfig
    +++ b/arch/x86/Kconfig
    @@ -28,6 +28,7 @@ config X86_64
    select ARCH_HAS_GIGANTIC_PAGE
    select ARCH_SUPPORTS_INT128 if CC_HAS_INT128
    select ARCH_USE_CMPXCHG_LOCKREF
    + select ARCH_HAS_SHADOW_STACK
    select HAVE_ARCH_SOFT_DIRTY
    select MODULES_USE_ELF_RELA
    select NEED_DMA_MAP_STATE
    @@ -1941,6 +1942,27 @@ config X86_SGX

    If unsure, say N.

    +config ARCH_HAS_SHADOW_STACK
    + def_bool n
    +
    +config X86_SHADOW_STACK
    + prompt "Intel Shadow Stack"
    + def_bool n
    + depends on AS_WRUSS
    + depends on ARCH_HAS_SHADOW_STACK
    + select ARCH_USES_HIGH_VMA_FLAGS
    + help
    + Shadow Stack protection is a hardware feature that detects function
    + return address corruption. This helps mitigate ROP attacks.
    + Applications must be enabled to use it, and old userspace does not
    + get protection "for free".
    + Support for this feature is present on Tiger Lake family of
    + processors released in 2020 or later. Enabling this feature
    + increases kernel text size by 3.7 KB.
    + See Documentation/x86/intel_cet.rst for more information.
    +
    + If unsure, say N.
    +
    config EFI
    bool "EFI runtime service support"
    depends on ACPI
    diff --git a/arch/x86/Kconfig.assembler b/arch/x86/Kconfig.assembler
    index 26b8c08e2fc4..00c79dd93651 100644
    --- a/arch/x86/Kconfig.assembler
    +++ b/arch/x86/Kconfig.assembler
    @@ -19,3 +19,8 @@ config AS_TPAUSE
    def_bool $(as-instr,tpause %ecx)
    help
    Supported by binutils >= 2.31.1 and LLVM integrated assembler >= V7
    +
    +config AS_WRUSS
    + def_bool $(as-instr,wrussq %rax$(comma)(%rbx))
    + help
    + Supported by binutils >= 2.31 and LLVM integrated assembler
    --
    2.21.0
    \
     
     \ /
      Last update: 2021-04-27 22:47    [W:4.950 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site