From: Eugene Syromiatnikov <esyr@redhat.com> To: Yu-cheng Yu <yu-cheng.yu@intel.com> Cc: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@amacapital.net>, Balbir Singh <bsingharora@gmail.com>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Florian Weimer <fweimer@redhat.com>, "H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>Peter Subject: Re: [RFC PATCH v4 20/27] x86/cet/shstk: Signal handling for shadow stack Date: Wed, 3 Oct 2018 16:36:10 +0200 [thread overview] Message-ID: <20181003143610.GC22724@asgard.redhat.com> (raw) In-Reply-To: <20180921150351.20898-21-yu-cheng.yu@intel.com> On Fri, Sep 21, 2018 at 08:03:44AM -0700, Yu-cheng Yu wrote: > When setting up a signal, the kernel creates a shadow stack > restore token at the current SHSTK address and then stores the > token's address in the signal frame, right after the FPU state. > Before restoring a signal, the kernel verifies and then uses the > restore token to set the SHSTK pointer. > diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c > index ec256ae27a31..5cc4be6e0982 100644 > --- a/arch/x86/kernel/cet.c > +++ b/arch/x86/kernel/cet.c > @@ -46,6 +47,69 @@ static unsigned long get_shstk_addr(void) > return ptr; > } > > +/* > + * Verify the restore token at the address of 'ssp' is > + * valid and then set shadow stack pointer according to the > + * token. > + */ > +static int verify_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long token; > + > + *new_ssp = 0; > + > + if (!IS_ALIGNED(ssp, 8)) > + return -EINVAL; > + > + if (get_user(token, (unsigned long __user *)ssp)) > + return -EFAULT; > + > + /* Is 64-bit mode flag correct? */ > + if (ia32 && (token & 3) != 0) > + return -EINVAL; > + else if ((token & 3) != 1) > + return -EINVAL; It is probably worth adding constant names for these flags, example, there's Section 2.4 in the currently available description[1], and it took some time before I decided to look into other patches and find the patch with the documentation (or finally notice section 2.7). [1] https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf > + token &= ~(1UL); > + > + if ((!ia32 && !IS_ALIGNED(token, 8)) || !IS_ALIGNED(token, 4)) > + return -EINVAL; > + > + if ((ALIGN_DOWN(token, 8) - 8) != ssp) > + return -EINVAL; > + > + *new_ssp = token; > + return 0; > +} > + > +/* > + * Create a restore token on the shadow stack. > + * A token is always 8-byte and aligned to 8. > + */ > +static int create_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long addr; > + > + *new_ssp = 0; > + > + if ((!ia32 && !IS_ALIGNED(ssp, 8)) || !IS_ALIGNED(ssp, 4)) > + return -EINVAL; Maybe refactor this check into a separate function/macro? > + > + addr = ALIGN_DOWN(ssp, 8) - 8; > + > + /* Is the token for 64-bit? */ > + if (!ia32) > + ssp |= 1; Again, usage of a named constant might document it better. > + > + if (write_user_shstk_64(addr, ssp)) This function is defined in "[RFC PATCH v4 19/27] x86/cet/shstk: Introduce WRUSS instruction" > + return -EFAULT; > + > + *new_ssp = addr; > + return 0; > +} > + > int cet_setup_shstk(void) > { > unsigned long addr, size; > @@ -107,3 +171,54 @@ void cet_disable_free_shstk(struct task_struct *tsk) > > tsk->thread.cet.shstk_enabled = 0; > } > + > +int cet_restore_signal(unsigned long ssp) > +{ > + unsigned long new_ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + err = verify_rstor_token(in_ia32_syscall(), ssp, &new_ssp); > + > + if (err) > + return err; > + > + return set_shstk_ptr(new_ssp); > +} > + > +/* > + * Setup the shadow stack for the signal handler: first, > + * create a restore token to keep track of the current ssp, > + * and then the return address of the signal handler. > + */ > +int cet_setup_signal(bool ia32, unsigned long rstor_addr, > + unsigned long *new_ssp) > +{ > + unsigned long ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + ssp = get_shstk_addr(); > + err = create_rstor_token(ia32, ssp, new_ssp); > + > + if (err) > + return err; > + > + if (ia32) { > + ssp = *new_ssp - sizeof(u32); > + err = write_user_shstk_32(ssp, (unsigned int)rstor_addr); > + } else { > + ssp = *new_ssp - sizeof(u64); > + err = write_user_shstk_64(ssp, rstor_addr); > + } > + > + if (err) > + return err; > + > + set_shstk_ptr(ssp); > + return 0; > +} > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index 92a3b312a53c..e9a85689143f 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -46,6 +46,7 @@ > > #include <asm/sigframe.h> > #include <asm/signal.h> > +#include <asm/cet.h> > > #define COPY(x) do { \ > get_user_ex(regs->x, &sc->x); \ > @@ -152,6 +153,10 @@ static int restore_sigcontext(struct pt_regs *regs, > > err |= fpu__restore_sig(buf, IS_ENABLED(CONFIG_X86_32)); > > +#ifdef CONFIG_X86_64 > + err |= restore_sigcontext_ext(buf); > +#endif > + > force_iret(); > > return err; > @@ -266,6 +271,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > } > > if (fpu->initialized) { > +#ifdef CONFIG_X86_64 > + /* sigcontext extension */ > + if (boot_cpu_has(X86_FEATURE_SHSTK)) > + sp -= sizeof(struct sc_ext) + 8; > +#endif > sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32), > &buf_fx, &math_size); That might be refactored in a separate function. Also, it looks like that possible padding for 8-byte alignment (copy_ext_{to,from}_user) is not accounted here. > *fpstate = (void __user *)sp; > @@ -493,6 +503,9 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig, > err |= setup_sigcontext(&frame->uc.uc_mcontext, fp, regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fp); > + Why is this not in setup_sigcontext, for example? > if (err) > return -EFAULT; > > @@ -576,6 +589,9 @@ static int x32_setup_rt_frame(struct ksignal *ksig, > regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fpstate); > + > if (err) > return -EFAULT; > > @@ -707,6 +723,86 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs) > } > } > > +#ifdef CONFIG_X86_64 > +static int copy_ext_from_user(struct sc_ext *ext, void __user *fpu) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_READ, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_from_user(ext, p, sizeof(*ext))) > + return -EFAULT; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + return 0; > +} > + > +static int copy_ext_to_user(void __user *fpu, struct sc_ext *ext) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_WRITE, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_to_user(p, ext, sizeof(*ext))) > + return -EFAULT; > + > + return 0; > +} > + > +int restore_sigcontext_ext(void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + > + err = copy_ext_from_user(&ext, fp); > + > + if (!err) > + err = cet_restore_signal(ext.ssp); > + } > + > + return err; > +} > + > +int setup_sigcontext_ext(struct ksignal *ksig, void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + unsigned long rstor; > + > + rstor = (unsigned long)ksig->ka.sa.sa_restorer; > + err = cet_setup_signal(is_ia32_frame(ksig), rstor, &ext.ssp); > + if (!err) { > + ext.total_size = sizeof(ext); > + err = copy_ext_to_user(fp, &ext); > + } > + } > + > + return err; > +} > +#endif > + > static void > handle_signal(struct ksignal *ksig, struct pt_regs *regs) > { > -- > 2.17.1 >
WARNING: multiple messages have this Message-ID (diff)
From: Eugene Syromiatnikov <esyr@redhat.com> To: Yu-cheng Yu <yu-cheng.yu@intel.com> Cc: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@amacapital.net>, Balbir Singh <bsingharora@gmail.com>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Florian Weimer <fweimer@redhat.com>, "H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>, Peter Zijlstra <peterz@infradead.org>, Randy Dunlap <rdunlap@infradead.org>, "Ravi V. Shankar" <ravi.v.shankar@intel.com>, Vedvyas Shanbhogue <vedvyas.shanbhogue@intel.com> Subject: Re: [RFC PATCH v4 20/27] x86/cet/shstk: Signal handling for shadow stack Date: Wed, 3 Oct 2018 16:36:10 +0200 [thread overview] Message-ID: <20181003143610.GC22724@asgard.redhat.com> (raw) Message-ID: <20181003143610.g7FmLlv8n8k0-Oo3A-QafoH-X5uWU1-Jbm9AQgkfmmk@z> (raw) In-Reply-To: <20180921150351.20898-21-yu-cheng.yu@intel.com> On Fri, Sep 21, 2018 at 08:03:44AM -0700, Yu-cheng Yu wrote: > When setting up a signal, the kernel creates a shadow stack > restore token at the current SHSTK address and then stores the > token's address in the signal frame, right after the FPU state. > Before restoring a signal, the kernel verifies and then uses the > restore token to set the SHSTK pointer. > diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c > index ec256ae27a31..5cc4be6e0982 100644 > --- a/arch/x86/kernel/cet.c > +++ b/arch/x86/kernel/cet.c > @@ -46,6 +47,69 @@ static unsigned long get_shstk_addr(void) > return ptr; > } > > +/* > + * Verify the restore token at the address of 'ssp' is > + * valid and then set shadow stack pointer according to the > + * token. > + */ > +static int verify_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long token; > + > + *new_ssp = 0; > + > + if (!IS_ALIGNED(ssp, 8)) > + return -EINVAL; > + > + if (get_user(token, (unsigned long __user *)ssp)) > + return -EFAULT; > + > + /* Is 64-bit mode flag correct? */ > + if (ia32 && (token & 3) != 0) > + return -EINVAL; > + else if ((token & 3) != 1) > + return -EINVAL; It is probably worth adding constant names for these flags, example, there's Section 2.4 in the currently available description[1], and it took some time before I decided to look into other patches and find the patch with the documentation (or finally notice section 2.7). [1] https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf > + token &= ~(1UL); > + > + if ((!ia32 && !IS_ALIGNED(token, 8)) || !IS_ALIGNED(token, 4)) > + return -EINVAL; > + > + if ((ALIGN_DOWN(token, 8) - 8) != ssp) > + return -EINVAL; > + > + *new_ssp = token; > + return 0; > +} > + > +/* > + * Create a restore token on the shadow stack. > + * A token is always 8-byte and aligned to 8. > + */ > +static int create_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long addr; > + > + *new_ssp = 0; > + > + if ((!ia32 && !IS_ALIGNED(ssp, 8)) || !IS_ALIGNED(ssp, 4)) > + return -EINVAL; Maybe refactor this check into a separate function/macro? > + > + addr = ALIGN_DOWN(ssp, 8) - 8; > + > + /* Is the token for 64-bit? */ > + if (!ia32) > + ssp |= 1; Again, usage of a named constant might document it better. > + > + if (write_user_shstk_64(addr, ssp)) This function is defined in "[RFC PATCH v4 19/27] x86/cet/shstk: Introduce WRUSS instruction" > + return -EFAULT; > + > + *new_ssp = addr; > + return 0; > +} > + > int cet_setup_shstk(void) > { > unsigned long addr, size; > @@ -107,3 +171,54 @@ void cet_disable_free_shstk(struct task_struct *tsk) > > tsk->thread.cet.shstk_enabled = 0; > } > + > +int cet_restore_signal(unsigned long ssp) > +{ > + unsigned long new_ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + err = verify_rstor_token(in_ia32_syscall(), ssp, &new_ssp); > + > + if (err) > + return err; > + > + return set_shstk_ptr(new_ssp); > +} > + > +/* > + * Setup the shadow stack for the signal handler: first, > + * create a restore token to keep track of the current ssp, > + * and then the return address of the signal handler. > + */ > +int cet_setup_signal(bool ia32, unsigned long rstor_addr, > + unsigned long *new_ssp) > +{ > + unsigned long ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + ssp = get_shstk_addr(); > + err = create_rstor_token(ia32, ssp, new_ssp); > + > + if (err) > + return err; > + > + if (ia32) { > + ssp = *new_ssp - sizeof(u32); > + err = write_user_shstk_32(ssp, (unsigned int)rstor_addr); > + } else { > + ssp = *new_ssp - sizeof(u64); > + err = write_user_shstk_64(ssp, rstor_addr); > + } > + > + if (err) > + return err; > + > + set_shstk_ptr(ssp); > + return 0; > +} > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index 92a3b312a53c..e9a85689143f 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -46,6 +46,7 @@ > > #include <asm/sigframe.h> > #include <asm/signal.h> > +#include <asm/cet.h> > > #define COPY(x) do { \ > get_user_ex(regs->x, &sc->x); \ > @@ -152,6 +153,10 @@ static int restore_sigcontext(struct pt_regs *regs, > > err |= fpu__restore_sig(buf, IS_ENABLED(CONFIG_X86_32)); > > +#ifdef CONFIG_X86_64 > + err |= restore_sigcontext_ext(buf); > +#endif > + > force_iret(); > > return err; > @@ -266,6 +271,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > } > > if (fpu->initialized) { > +#ifdef CONFIG_X86_64 > + /* sigcontext extension */ > + if (boot_cpu_has(X86_FEATURE_SHSTK)) > + sp -= sizeof(struct sc_ext) + 8; > +#endif > sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32), > &buf_fx, &math_size); That might be refactored in a separate function. Also, it looks like that possible padding for 8-byte alignment (copy_ext_{to,from}_user) is not accounted here. > *fpstate = (void __user *)sp; > @@ -493,6 +503,9 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig, > err |= setup_sigcontext(&frame->uc.uc_mcontext, fp, regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fp); > + Why is this not in setup_sigcontext, for example? > if (err) > return -EFAULT; > > @@ -576,6 +589,9 @@ static int x32_setup_rt_frame(struct ksignal *ksig, > regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fpstate); > + > if (err) > return -EFAULT; > > @@ -707,6 +723,86 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs) > } > } > > +#ifdef CONFIG_X86_64 > +static int copy_ext_from_user(struct sc_ext *ext, void __user *fpu) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_READ, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_from_user(ext, p, sizeof(*ext))) > + return -EFAULT; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + return 0; > +} > + > +static int copy_ext_to_user(void __user *fpu, struct sc_ext *ext) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_WRITE, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_to_user(p, ext, sizeof(*ext))) > + return -EFAULT; > + > + return 0; > +} > + > +int restore_sigcontext_ext(void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + > + err = copy_ext_from_user(&ext, fp); > + > + if (!err) > + err = cet_restore_signal(ext.ssp); > + } > + > + return err; > +} > + > +int setup_sigcontext_ext(struct ksignal *ksig, void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + unsigned long rstor; > + > + rstor = (unsigned long)ksig->ka.sa.sa_restorer; > + err = cet_setup_signal(is_ia32_frame(ksig), rstor, &ext.ssp); > + if (!err) { > + ext.total_size = sizeof(ext); > + err = copy_ext_to_user(fp, &ext); > + } > + } > + > + return err; > +} > +#endif > + > static void > handle_signal(struct ksignal *ksig, struct pt_regs *regs) > { > -- > 2.17.1 >
next prev parent reply other threads:[~2018-10-03 14:36 UTC|newest] Thread overview: 142+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-09-21 15:03 [RFC PATCH v4 00/27] Control Flow Enforcement: Shadow Stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 01/27] x86/cpufeatures: Add CPUIDs for Control-flow Enforcement Technology (CET) Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-25 16:27 ` Peter Zijlstra 2018-09-25 16:27 ` Peter Zijlstra 2018-09-25 16:29 ` Yu-cheng Yu 2018-09-25 16:29 ` Yu-cheng Yu 2018-09-28 16:51 ` Borislav Petkov 2018-09-28 16:51 ` Borislav Petkov 2018-09-28 16:56 ` Yu-cheng Yu 2018-09-28 16:56 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 02/27] x86/fpu/xstate: Change some names to separate XSAVES system and user states Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-25 16:37 ` Peter Zijlstra 2018-09-25 16:37 ` Peter Zijlstra 2018-10-02 15:29 ` Borislav Petkov 2018-10-02 15:29 ` Borislav Petkov 2018-10-02 16:21 ` Yu-cheng Yu 2018-10-02 16:21 ` Yu-cheng Yu 2018-10-02 16:30 ` Dave Hansen 2018-10-02 16:30 ` Dave Hansen 2018-10-02 16:37 ` Borislav Petkov 2018-10-02 16:37 ` Borislav Petkov 2018-10-02 16:39 ` Dave Hansen 2018-10-02 16:39 ` Dave Hansen 2018-10-02 16:43 ` Yu-cheng Yu 2018-10-02 16:43 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 03/27] x86/fpu/xstate: Enable XSAVES system states Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-25 17:03 ` Peter Zijlstra 2018-09-25 17:03 ` Peter Zijlstra 2018-09-25 17:23 ` Yu-cheng Yu 2018-09-25 17:23 ` Yu-cheng Yu 2018-10-02 17:15 ` Borislav Petkov 2018-10-02 17:15 ` Borislav Petkov 2018-10-04 15:47 ` Yu-cheng Yu 2018-10-04 15:47 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 04/27] x86/fpu/xstate: Add XSAVES system states for shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 05/27] Documentation/x86: Add CET description Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 06/27] x86/cet: Control protection exception handler Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 10:39 ` Eugene Syromiatnikov 2018-10-03 10:39 ` Eugene Syromiatnikov 2018-10-03 16:11 ` Yu-cheng Yu 2018-10-03 16:11 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 07/27] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 08/27] mm: Introduce VM_SHSTK for shadow stack memory Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 09/27] x86/mm: Change _PAGE_DIRTY to _PAGE_DIRTY_HW Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 13:38 ` Matthew Wilcox 2018-10-03 13:38 ` Matthew Wilcox 2018-10-03 14:05 ` Dave Hansen 2018-10-03 14:05 ` Dave Hansen 2018-10-03 16:07 ` Yu-cheng Yu 2018-10-03 16:07 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 10/27] drm/i915/gvt: Update _PAGE_DIRTY to _PAGE_DIRTY_BITS Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 13:19 ` Eugene Syromiatnikov 2018-10-03 13:19 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 11/27] x86/mm: Introduce _PAGE_DIRTY_SW Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 12/27] x86/mm: Modify ptep_set_wrprotect and pmdp_set_wrprotect for _PAGE_DIRTY_SW Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 13/27] x86/mm: Shadow stack page fault error checking Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 14/27] mm: Handle shadow stack page fault Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 15/27] mm: Handle THP/HugeTLB " Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 16/27] mm: Update can_follow_write_pte/pmd for shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 17/27] mm: Introduce do_mmap_locked() Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 18/27] x86/cet/shstk: User-mode shadow stack support Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 15:08 ` Eugene Syromiatnikov 2018-10-03 15:08 ` Eugene Syromiatnikov 2018-10-03 15:12 ` Yu-cheng Yu 2018-10-03 15:12 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 19/27] x86/cet/shstk: Introduce WRUSS instruction Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 4:15 ` Eugene Syromiatnikov 2018-10-03 4:15 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 20/27] x86/cet/shstk: Signal handling for shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 14:36 ` Eugene Syromiatnikov [this message] 2018-10-03 14:36 ` Eugene Syromiatnikov 2018-10-03 16:46 ` Jann Horn 2018-10-03 16:46 ` Jann Horn 2018-09-21 15:03 ` [RFC PATCH v4 21/27] x86/cet/shstk: ELF header parsing of Shadow Stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 23:27 ` Eugene Syromiatnikov 2018-10-03 23:27 ` Eugene Syromiatnikov 2018-10-09 21:15 ` Yu-cheng Yu 2018-10-09 21:15 ` Yu-cheng Yu 2018-10-15 23:40 ` Kees Cook 2018-10-15 23:40 ` Kees Cook 2018-10-16 17:23 ` Yu-cheng Yu 2018-10-16 17:23 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 22/27] x86/cet/shstk: Handle thread shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 23/27] mm/map: Add Shadow stack pages to memory accounting Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 16:55 ` Randy Dunlap 2018-09-21 16:55 ` Randy Dunlap 2018-09-21 17:21 ` Yu-cheng Yu 2018-09-21 17:21 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 24/27] mm/mmap: Create a guard area between VMAs Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 4:56 ` Eugene Syromiatnikov 2018-10-03 4:56 ` Eugene Syromiatnikov 2018-10-03 5:36 ` Andy Lutomirski 2018-10-03 5:36 ` Andy Lutomirski 2018-10-03 16:00 ` Yu-cheng Yu 2018-10-03 16:00 ` Yu-cheng Yu 2018-10-03 16:18 ` Andy Lutomirski 2018-10-03 16:18 ` Andy Lutomirski 2018-10-03 16:32 ` Eugene Syromiatnikov 2018-10-03 16:32 ` Eugene Syromiatnikov 2018-10-03 16:40 ` Yu-cheng Yu 2018-10-03 16:40 ` Yu-cheng Yu 2018-10-03 16:52 ` Jann Horn 2018-10-03 16:52 ` Jann Horn 2018-10-03 21:21 ` Eugene Syromiatnikov 2018-10-03 21:21 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 25/27] mm/mmap: Prevent Shadow Stack VMA merges Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 26/27] x86/cet/shstk: Add arch_prctl functions for Shadow Stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 17:57 ` Eugene Syromiatnikov 2018-10-03 17:57 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 27/27] x86/cet/shstk: Add Shadow Stack instructions to opcode map Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 22:53 ` [RFC PATCH v4 00/27] Control Flow Enforcement: Shadow Stack Dave Hansen 2018-09-21 22:53 ` Dave Hansen 2018-09-24 15:25 ` Yu-cheng Yu 2018-09-24 15:25 ` Yu-cheng Yu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181003143610.GC22724@asgard.redhat.com \ --to=esyr@redhat.com \ --cc=arnd@arndb.de \ --cc=bsingharora@gmail.com \ --cc=corbet@lwn.net \ --cc=dave.hansen@linux.intel.com \ --cc=fweimer@redhat.com \ --cc=gorcunov@gmail.com \ --cc=hjl.tools@gmail.com \ --cc=hpa@zytor.com \ --cc=jannh@google.com \ --cc=keescook@chromium.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-arch@vger.kernel.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@amacapital.net \ --cc=mike.kravetz@oracle.com \ --cc=mingo@redhat.com \ --cc=nadav.amit@gmail.com \ --cc=oleg@redhat.com \ --cc=pavel@ucw.cz \ --cc=tglx@linutronix.de \ --cc=x86@kernel.org \ --cc=yu-cheng.yu@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).