lkml.org 
[lkml]   [2022]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v3 30/37] x86/shstk: Support wrss for userspace
    Date
    For the current shadow stack implementation, shadow stacks contents can't
    easily be provisioned with arbitrary data. This property helps apps
    protect themselves better, but also restricts any potential apps that may
    want to do exotic things at the expense of a little security.

    The x86 shadow stack feature introduces a new instruction, wrss, which
    can be enabled to write directly to shadow stack permissioned memory from
    userspace. Allow it to get enabled via the prctl interface.

    Only enable the userspace wrss instruction, which allows writes to
    userspace shadow stacks from userspace. Do not allow it to be enabled
    independently of shadow stack, as HW does not support using WRSS when
    shadow stack is disabled.

    From a fault handler perspective, WRSS will behave very similar to WRUSS,
    which is treated like a user access from a #PF err code perspective.

    Tested-by: Pengfei Xu <pengfei.xu@intel.com>
    Tested-by: John Allen <john.allen@amd.com>
    Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>

    ---

    v3:
    - Make wrss_control() static
    - Fix verbiage in commit log (Kees)

    v2:
    - Add some commit log verbiage from (Dave Hansen)

    v1:
    - New patch.

    arch/x86/include/uapi/asm/prctl.h | 1 +
    arch/x86/kernel/shstk.c | 33 +++++++++++++++++++++++++++++--
    2 files changed, 32 insertions(+), 2 deletions(-)

    diff --git a/arch/x86/include/uapi/asm/prctl.h b/arch/x86/include/uapi/asm/prctl.h
    index dad5288bf086..5f1d3181e4a1 100644
    --- a/arch/x86/include/uapi/asm/prctl.h
    +++ b/arch/x86/include/uapi/asm/prctl.h
    @@ -28,5 +28,6 @@

    /* ARCH_CET_ features bits */
    #define CET_SHSTK (1ULL << 0)
    +#define CET_WRSS (1ULL << 1)

    #endif /* _ASM_X86_PRCTL_H */
    diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
    index 9a025eea520f..cbd0970b26d7 100644
    --- a/arch/x86/kernel/shstk.c
    +++ b/arch/x86/kernel/shstk.c
    @@ -364,6 +364,35 @@ void shstk_free(struct task_struct *tsk)
    unmap_shadow_stack(shstk->base, shstk->size);
    }

    +static int wrss_control(bool enable)
    +{
    + if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK))
    + return -EOPNOTSUPP;
    +
    + /*
    + * Only enable wrss if shadow stack is enabled. If shadow stack is not
    + * enabled, wrss will already be disabled, so don't bother clearing it
    + * when disabling.
    + */
    + if (!features_enabled(CET_SHSTK))
    + return -EPERM;
    +
    + /* Already enabled/disabled? */
    + if (features_enabled(CET_WRSS) == enable)
    + return 0;
    +
    + fpregs_lock_and_load();
    + if (enable) {
    + set_clr_bits_msrl(MSR_IA32_U_CET, CET_WRSS_EN, 0);
    + features_set(CET_WRSS);
    + } else {
    + set_clr_bits_msrl(MSR_IA32_U_CET, 0, CET_WRSS_EN);
    + features_clr(CET_WRSS);
    + }
    + fpregs_unlock();
    +
    + return 0;
    +}

    static int shstk_disable(void)
    {
    @@ -376,12 +405,12 @@ static int shstk_disable(void)

    fpregs_lock_and_load();
    /* Disable WRSS too when disabling shadow stack */
    - set_clr_bits_msrl(MSR_IA32_U_CET, 0, CET_SHSTK_EN);
    + set_clr_bits_msrl(MSR_IA32_U_CET, 0, CET_SHSTK_EN | CET_WRSS_EN);
    wrmsrl(MSR_IA32_PL3_SSP, 0);
    fpregs_unlock();

    shstk_free(current);
    - features_clr(CET_SHSTK);
    + features_clr(CET_SHSTK | CET_WRSS);

    return 0;
    }
    --
    2.17.1
    \
     
     \ /
      Last update: 2022-11-04 23:45    [W:4.481 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site