lkml.org 
[lkml]   [2023]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[tip: x86/shstk] x86: Introduce userspace API for shadow stack
    The following commit has been merged into the x86/shstk branch of tip:

    Commit-ID: 98cfa4630912a80a575277d1bf193376ba66116a
    Gitweb: https://git.kernel.org/tip/98cfa4630912a80a575277d1bf193376ba66116a
    Author: Rick Edgecombe <rick.p.edgecombe@intel.com>
    AuthorDate: Mon, 12 Jun 2023 17:10:52 -07:00
    Committer: Dave Hansen <dave.hansen@linux.intel.com>
    CommitterDate: Wed, 02 Aug 2023 15:01:50 -07:00

    x86: Introduce userspace API for shadow stack

    Add three new arch_prctl() handles:

    - ARCH_SHSTK_ENABLE/DISABLE enables or disables the specified
    feature. Returns 0 on success or a negative value on error.

    - ARCH_SHSTK_LOCK prevents future disabling or enabling of the
    specified feature. Returns 0 on success or a negative value
    on error.

    The features are handled per-thread and inherited over fork(2)/clone(2),
    but reset on exec().

    Co-developed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
    Tested-by: Pengfei Xu <pengfei.xu@intel.com>
    Tested-by: John Allen <john.allen@amd.com>
    Tested-by: Kees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/all/20230613001108.3040476-27-rick.p.edgecombe%40intel.com
    ---
    arch/x86/include/asm/processor.h | 6 ++++-
    arch/x86/include/asm/shstk.h | 21 ++++++++++++++-
    arch/x86/include/uapi/asm/prctl.h | 6 ++++-
    arch/x86/kernel/Makefile | 2 +-
    arch/x86/kernel/process_64.c | 6 ++++-
    arch/x86/kernel/shstk.c | 44 ++++++++++++++++++++++++++++++-
    6 files changed, 85 insertions(+)
    create mode 100644 arch/x86/include/asm/shstk.h
    create mode 100644 arch/x86/kernel/shstk.c

    diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
    index d46300e..4e35f40 100644
    --- a/arch/x86/include/asm/processor.h
    +++ b/arch/x86/include/asm/processor.h
    @@ -28,6 +28,7 @@ struct vm86;
    #include <asm/unwind_hints.h>
    #include <asm/vmxfeatures.h>
    #include <asm/vdso/processor.h>
    +#include <asm/shstk.h>

    #include <linux/personality.h>
    #include <linux/cache.h>
    @@ -475,6 +476,11 @@ struct thread_struct {
    */
    u32 pkru;

    +#ifdef CONFIG_X86_USER_SHADOW_STACK
    + unsigned long features;
    + unsigned long features_locked;
    +#endif
    +
    /* Floating point and extended processor state */
    struct fpu fpu;
    /*
    diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h
    new file mode 100644
    index 0000000..ec75380
    --- /dev/null
    +++ b/arch/x86/include/asm/shstk.h
    @@ -0,0 +1,21 @@
    +/* SPDX-License-Identifier: GPL-2.0 */
    +#ifndef _ASM_X86_SHSTK_H
    +#define _ASM_X86_SHSTK_H
    +
    +#ifndef __ASSEMBLY__
    +#include <linux/types.h>
    +
    +struct task_struct;
    +
    +#ifdef CONFIG_X86_USER_SHADOW_STACK
    +long shstk_prctl(struct task_struct *task, int option, unsigned long features);
    +void reset_thread_features(void);
    +#else
    +static inline long shstk_prctl(struct task_struct *task, int option,
    + unsigned long arg2) { return -EINVAL; }
    +static inline void reset_thread_features(void) {}
    +#endif /* CONFIG_X86_USER_SHADOW_STACK */
    +
    +#endif /* __ASSEMBLY__ */
    +
    +#endif /* _ASM_X86_SHSTK_H */
    diff --git a/arch/x86/include/uapi/asm/prctl.h b/arch/x86/include/uapi/asm/prctl.h
    index e8d7ebb..1cd44ec 100644
    --- a/arch/x86/include/uapi/asm/prctl.h
    +++ b/arch/x86/include/uapi/asm/prctl.h
    @@ -23,9 +23,15 @@
    #define ARCH_MAP_VDSO_32 0x2002
    #define ARCH_MAP_VDSO_64 0x2003

    +/* Don't use 0x3001-0x3004 because of old glibcs */
    +
    #define ARCH_GET_UNTAG_MASK 0x4001
    #define ARCH_ENABLE_TAGGED_ADDR 0x4002
    #define ARCH_GET_MAX_TAG_BITS 0x4003
    #define ARCH_FORCE_TAGGED_SVA 0x4004

    +#define ARCH_SHSTK_ENABLE 0x5001
    +#define ARCH_SHSTK_DISABLE 0x5002
    +#define ARCH_SHSTK_LOCK 0x5003
    +
    #endif /* _ASM_X86_PRCTL_H */
    diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
    index abee056..6b6bf47 100644
    --- a/arch/x86/kernel/Makefile
    +++ b/arch/x86/kernel/Makefile
    @@ -147,6 +147,8 @@ obj-$(CONFIG_CALL_THUNKS) += callthunks.o

    obj-$(CONFIG_X86_CET) += cet.o

    +obj-$(CONFIG_X86_USER_SHADOW_STACK) += shstk.o
    +
    ###
    # 64 bit specific files
    ifeq ($(CONFIG_X86_64),y)
    diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
    index 3d181c1..0f89aa0 100644
    --- a/arch/x86/kernel/process_64.c
    +++ b/arch/x86/kernel/process_64.c
    @@ -515,6 +515,8 @@ start_thread_common(struct pt_regs *regs, unsigned long new_ip,
    load_gs_index(__USER_DS);
    }

    + reset_thread_features();
    +
    loadsegment(fs, 0);
    loadsegment(es, _ds);
    loadsegment(ds, _ds);
    @@ -894,6 +896,10 @@ long do_arch_prctl_64(struct task_struct *task, int option, unsigned long arg2)
    else
    return put_user(LAM_U57_BITS, (unsigned long __user *)arg2);
    #endif
    + case ARCH_SHSTK_ENABLE:
    + case ARCH_SHSTK_DISABLE:
    + case ARCH_SHSTK_LOCK:
    + return shstk_prctl(task, option, arg2);
    default:
    ret = -EINVAL;
    break;
    diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
    new file mode 100644
    index 0000000..41ed655
    --- /dev/null
    +++ b/arch/x86/kernel/shstk.c
    @@ -0,0 +1,44 @@
    +// SPDX-License-Identifier: GPL-2.0
    +/*
    + * shstk.c - Intel shadow stack support
    + *
    + * Copyright (c) 2021, Intel Corporation.
    + * Yu-cheng Yu <yu-cheng.yu@intel.com>
    + */
    +
    +#include <linux/sched.h>
    +#include <linux/bitops.h>
    +#include <asm/prctl.h>
    +
    +void reset_thread_features(void)
    +{
    + current->thread.features = 0;
    + current->thread.features_locked = 0;
    +}
    +
    +long shstk_prctl(struct task_struct *task, int option, unsigned long features)
    +{
    + if (option == ARCH_SHSTK_LOCK) {
    + task->thread.features_locked |= features;
    + return 0;
    + }
    +
    + /* Don't allow via ptrace */
    + if (task != current)
    + return -EINVAL;
    +
    + /* Do not allow to change locked features */
    + if (features & task->thread.features_locked)
    + return -EPERM;
    +
    + /* Only support enabling/disabling one feature at a time. */
    + if (hweight_long(features) > 1)
    + return -EINVAL;
    +
    + if (option == ARCH_SHSTK_DISABLE) {
    + return -EINVAL;
    + }
    +
    + /* Handle ARCH_SHSTK_ENABLE */
    + return -EINVAL;
    +}
    \
     
     \ /
      Last update: 2023-08-03 00:22    [W:2.753 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site