From: Eugene Syromiatnikov <esyr@redhat.com> To: Yu-cheng Yu <yu-cheng.yu@intel.com> Cc: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@amacapital.net>, Balbir Singh <bsingharora@gmail.com>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Florian Weimer <fweimer@redhat.com>, "H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>, Peter Zijlstra <peterz@infradead.org>, Randy Dunlap <rdunlap@infradead.org>, "Ravi V. Shankar" <ravi.v.shankar@intel.com>, Vedvyas Shanbhogue <vedvyas.shanbhogue@intel.com> Subject: Re: [RFC PATCH v4 20/27] x86/cet/shstk: Signal handling for shadow stack Date: Wed, 3 Oct 2018 16:36:10 +0200 [thread overview] Message-ID: <20181003143610.GC22724@asgard.redhat.com> (raw) In-Reply-To: <20180921150351.20898-21-yu-cheng.yu@intel.com> On Fri, Sep 21, 2018 at 08:03:44AM -0700, Yu-cheng Yu wrote: > When setting up a signal, the kernel creates a shadow stack > restore token at the current SHSTK address and then stores the > token's address in the signal frame, right after the FPU state. > Before restoring a signal, the kernel verifies and then uses the > restore token to set the SHSTK pointer. > diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c > index ec256ae27a31..5cc4be6e0982 100644 > --- a/arch/x86/kernel/cet.c > +++ b/arch/x86/kernel/cet.c > @@ -46,6 +47,69 @@ static unsigned long get_shstk_addr(void) > return ptr; > } > > +/* > + * Verify the restore token at the address of 'ssp' is > + * valid and then set shadow stack pointer according to the > + * token. > + */ > +static int verify_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long token; > + > + *new_ssp = 0; > + > + if (!IS_ALIGNED(ssp, 8)) > + return -EINVAL; > + > + if (get_user(token, (unsigned long __user *)ssp)) > + return -EFAULT; > + > + /* Is 64-bit mode flag correct? */ > + if (ia32 && (token & 3) != 0) > + return -EINVAL; > + else if ((token & 3) != 1) > + return -EINVAL; It is probably worth adding constant names for these flags, example, there's Section 2.4 in the currently available description[1], and it took some time before I decided to look into other patches and find the patch with the documentation (or finally notice section 2.7). [1] https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf > + token &= ~(1UL); > + > + if ((!ia32 && !IS_ALIGNED(token, 8)) || !IS_ALIGNED(token, 4)) > + return -EINVAL; > + > + if ((ALIGN_DOWN(token, 8) - 8) != ssp) > + return -EINVAL; > + > + *new_ssp = token; > + return 0; > +} > + > +/* > + * Create a restore token on the shadow stack. > + * A token is always 8-byte and aligned to 8. > + */ > +static int create_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long addr; > + > + *new_ssp = 0; > + > + if ((!ia32 && !IS_ALIGNED(ssp, 8)) || !IS_ALIGNED(ssp, 4)) > + return -EINVAL; Maybe refactor this check into a separate function/macro? > + > + addr = ALIGN_DOWN(ssp, 8) - 8; > + > + /* Is the token for 64-bit? */ > + if (!ia32) > + ssp |= 1; Again, usage of a named constant might document it better. > + > + if (write_user_shstk_64(addr, ssp)) This function is defined in "[RFC PATCH v4 19/27] x86/cet/shstk: Introduce WRUSS instruction" > + return -EFAULT; > + > + *new_ssp = addr; > + return 0; > +} > + > int cet_setup_shstk(void) > { > unsigned long addr, size; > @@ -107,3 +171,54 @@ void cet_disable_free_shstk(struct task_struct *tsk) > > tsk->thread.cet.shstk_enabled = 0; > } > + > +int cet_restore_signal(unsigned long ssp) > +{ > + unsigned long new_ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + err = verify_rstor_token(in_ia32_syscall(), ssp, &new_ssp); > + > + if (err) > + return err; > + > + return set_shstk_ptr(new_ssp); > +} > + > +/* > + * Setup the shadow stack for the signal handler: first, > + * create a restore token to keep track of the current ssp, > + * and then the return address of the signal handler. > + */ > +int cet_setup_signal(bool ia32, unsigned long rstor_addr, > + unsigned long *new_ssp) > +{ > + unsigned long ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + ssp = get_shstk_addr(); > + err = create_rstor_token(ia32, ssp, new_ssp); > + > + if (err) > + return err; > + > + if (ia32) { > + ssp = *new_ssp - sizeof(u32); > + err = write_user_shstk_32(ssp, (unsigned int)rstor_addr); > + } else { > + ssp = *new_ssp - sizeof(u64); > + err = write_user_shstk_64(ssp, rstor_addr); > + } > + > + if (err) > + return err; > + > + set_shstk_ptr(ssp); > + return 0; > +} > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index 92a3b312a53c..e9a85689143f 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -46,6 +46,7 @@ > > #include <asm/sigframe.h> > #include <asm/signal.h> > +#include <asm/cet.h> > > #define COPY(x) do { \ > get_user_ex(regs->x, &sc->x); \ > @@ -152,6 +153,10 @@ static int restore_sigcontext(struct pt_regs *regs, > > err |= fpu__restore_sig(buf, IS_ENABLED(CONFIG_X86_32)); > > +#ifdef CONFIG_X86_64 > + err |= restore_sigcontext_ext(buf); > +#endif > + > force_iret(); > > return err; > @@ -266,6 +271,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > } > > if (fpu->initialized) { > +#ifdef CONFIG_X86_64 > + /* sigcontext extension */ > + if (boot_cpu_has(X86_FEATURE_SHSTK)) > + sp -= sizeof(struct sc_ext) + 8; > +#endif > sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32), > &buf_fx, &math_size); That might be refactored in a separate function. Also, it looks like that possible padding for 8-byte alignment (copy_ext_{to,from}_user) is not accounted here. > *fpstate = (void __user *)sp; > @@ -493,6 +503,9 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig, > err |= setup_sigcontext(&frame->uc.uc_mcontext, fp, regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fp); > + Why is this not in setup_sigcontext, for example? > if (err) > return -EFAULT; > > @@ -576,6 +589,9 @@ static int x32_setup_rt_frame(struct ksignal *ksig, > regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fpstate); > + > if (err) > return -EFAULT; > > @@ -707,6 +723,86 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs) > } > } > > +#ifdef CONFIG_X86_64 > +static int copy_ext_from_user(struct sc_ext *ext, void __user *fpu) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_READ, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_from_user(ext, p, sizeof(*ext))) > + return -EFAULT; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + return 0; > +} > + > +static int copy_ext_to_user(void __user *fpu, struct sc_ext *ext) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_WRITE, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_to_user(p, ext, sizeof(*ext))) > + return -EFAULT; > + > + return 0; > +} > + > +int restore_sigcontext_ext(void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + > + err = copy_ext_from_user(&ext, fp); > + > + if (!err) > + err = cet_restore_signal(ext.ssp); > + } > + > + return err; > +} > + > +int setup_sigcontext_ext(struct ksignal *ksig, void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + unsigned long rstor; > + > + rstor = (unsigned long)ksig->ka.sa.sa_restorer; > + err = cet_setup_signal(is_ia32_frame(ksig), rstor, &ext.ssp); > + if (!err) { > + ext.total_size = sizeof(ext); > + err = copy_ext_to_user(fp, &ext); > + } > + } > + > + return err; > +} > +#endif > + > static void > handle_signal(struct ksignal *ksig, struct pt_regs *regs) > { > -- > 2.17.1 >
WARNING: multiple messages have this Message-ID (diff)
From: Eugene Syromiatnikov <esyr@redhat.com> To: Yu-cheng Yu <yu-cheng.yu@intel.com> Cc: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@amacapital.net>, Balbir Singh <bsingharora@gmail.com>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Florian Weimer <fweimer@redhat.com>, "H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>Peter Subject: Re: [RFC PATCH v4 20/27] x86/cet/shstk: Signal handling for shadow stack Date: Wed, 3 Oct 2018 16:36:10 +0200 [thread overview] Message-ID: <20181003143610.GC22724@asgard.redhat.com> (raw) In-Reply-To: <20180921150351.20898-21-yu-cheng.yu@intel.com> On Fri, Sep 21, 2018 at 08:03:44AM -0700, Yu-cheng Yu wrote: > When setting up a signal, the kernel creates a shadow stack > restore token at the current SHSTK address and then stores the > token's address in the signal frame, right after the FPU state. > Before restoring a signal, the kernel verifies and then uses the > restore token to set the SHSTK pointer. > diff --git a/arch/x86/kernel/cet.c b/arch/x86/kernel/cet.c > index ec256ae27a31..5cc4be6e0982 100644 > --- a/arch/x86/kernel/cet.c > +++ b/arch/x86/kernel/cet.c > @@ -46,6 +47,69 @@ static unsigned long get_shstk_addr(void) > return ptr; > } > > +/* > + * Verify the restore token at the address of 'ssp' is > + * valid and then set shadow stack pointer according to the > + * token. > + */ > +static int verify_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long token; > + > + *new_ssp = 0; > + > + if (!IS_ALIGNED(ssp, 8)) > + return -EINVAL; > + > + if (get_user(token, (unsigned long __user *)ssp)) > + return -EFAULT; > + > + /* Is 64-bit mode flag correct? */ > + if (ia32 && (token & 3) != 0) > + return -EINVAL; > + else if ((token & 3) != 1) > + return -EINVAL; It is probably worth adding constant names for these flags, example, there's Section 2.4 in the currently available description[1], and it took some time before I decided to look into other patches and find the patch with the documentation (or finally notice section 2.7). [1] https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf > + token &= ~(1UL); > + > + if ((!ia32 && !IS_ALIGNED(token, 8)) || !IS_ALIGNED(token, 4)) > + return -EINVAL; > + > + if ((ALIGN_DOWN(token, 8) - 8) != ssp) > + return -EINVAL; > + > + *new_ssp = token; > + return 0; > +} > + > +/* > + * Create a restore token on the shadow stack. > + * A token is always 8-byte and aligned to 8. > + */ > +static int create_rstor_token(bool ia32, unsigned long ssp, > + unsigned long *new_ssp) > +{ > + unsigned long addr; > + > + *new_ssp = 0; > + > + if ((!ia32 && !IS_ALIGNED(ssp, 8)) || !IS_ALIGNED(ssp, 4)) > + return -EINVAL; Maybe refactor this check into a separate function/macro? > + > + addr = ALIGN_DOWN(ssp, 8) - 8; > + > + /* Is the token for 64-bit? */ > + if (!ia32) > + ssp |= 1; Again, usage of a named constant might document it better. > + > + if (write_user_shstk_64(addr, ssp)) This function is defined in "[RFC PATCH v4 19/27] x86/cet/shstk: Introduce WRUSS instruction" > + return -EFAULT; > + > + *new_ssp = addr; > + return 0; > +} > + > int cet_setup_shstk(void) > { > unsigned long addr, size; > @@ -107,3 +171,54 @@ void cet_disable_free_shstk(struct task_struct *tsk) > > tsk->thread.cet.shstk_enabled = 0; > } > + > +int cet_restore_signal(unsigned long ssp) > +{ > + unsigned long new_ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + err = verify_rstor_token(in_ia32_syscall(), ssp, &new_ssp); > + > + if (err) > + return err; > + > + return set_shstk_ptr(new_ssp); > +} > + > +/* > + * Setup the shadow stack for the signal handler: first, > + * create a restore token to keep track of the current ssp, > + * and then the return address of the signal handler. > + */ > +int cet_setup_signal(bool ia32, unsigned long rstor_addr, > + unsigned long *new_ssp) > +{ > + unsigned long ssp; > + int err; > + > + if (!current->thread.cet.shstk_enabled) > + return 0; > + > + ssp = get_shstk_addr(); > + err = create_rstor_token(ia32, ssp, new_ssp); > + > + if (err) > + return err; > + > + if (ia32) { > + ssp = *new_ssp - sizeof(u32); > + err = write_user_shstk_32(ssp, (unsigned int)rstor_addr); > + } else { > + ssp = *new_ssp - sizeof(u64); > + err = write_user_shstk_64(ssp, rstor_addr); > + } > + > + if (err) > + return err; > + > + set_shstk_ptr(ssp); > + return 0; > +} > diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c > index 92a3b312a53c..e9a85689143f 100644 > --- a/arch/x86/kernel/signal.c > +++ b/arch/x86/kernel/signal.c > @@ -46,6 +46,7 @@ > > #include <asm/sigframe.h> > #include <asm/signal.h> > +#include <asm/cet.h> > > #define COPY(x) do { \ > get_user_ex(regs->x, &sc->x); \ > @@ -152,6 +153,10 @@ static int restore_sigcontext(struct pt_regs *regs, > > err |= fpu__restore_sig(buf, IS_ENABLED(CONFIG_X86_32)); > > +#ifdef CONFIG_X86_64 > + err |= restore_sigcontext_ext(buf); > +#endif > + > force_iret(); > > return err; > @@ -266,6 +271,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, > } > > if (fpu->initialized) { > +#ifdef CONFIG_X86_64 > + /* sigcontext extension */ > + if (boot_cpu_has(X86_FEATURE_SHSTK)) > + sp -= sizeof(struct sc_ext) + 8; > +#endif > sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32), > &buf_fx, &math_size); That might be refactored in a separate function. Also, it looks like that possible padding for 8-byte alignment (copy_ext_{to,from}_user) is not accounted here. > *fpstate = (void __user *)sp; > @@ -493,6 +503,9 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig, > err |= setup_sigcontext(&frame->uc.uc_mcontext, fp, regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fp); > + Why is this not in setup_sigcontext, for example? > if (err) > return -EFAULT; > > @@ -576,6 +589,9 @@ static int x32_setup_rt_frame(struct ksignal *ksig, > regs, set->sig[0]); > err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); > > + if (!err) > + err = setup_sigcontext_ext(ksig, fpstate); > + > if (err) > return -EFAULT; > > @@ -707,6 +723,86 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs) > } > } > > +#ifdef CONFIG_X86_64 > +static int copy_ext_from_user(struct sc_ext *ext, void __user *fpu) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_READ, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_from_user(ext, p, sizeof(*ext))) > + return -EFAULT; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + return 0; > +} > + > +static int copy_ext_to_user(void __user *fpu, struct sc_ext *ext) > +{ > + void __user *p; > + > + if (!fpu) > + return -EINVAL; > + > + if (ext->total_size != sizeof(*ext)) > + return -EINVAL; > + > + p = fpu + fpu_user_xstate_size + FP_XSTATE_MAGIC2_SIZE; > + p = (void __user *)ALIGN((unsigned long)p, 8); > + > + if (!access_ok(VERIFY_WRITE, p, sizeof(*ext))) > + return -EFAULT; > + > + if (__copy_to_user(p, ext, sizeof(*ext))) > + return -EFAULT; > + > + return 0; > +} > + > +int restore_sigcontext_ext(void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + > + err = copy_ext_from_user(&ext, fp); > + > + if (!err) > + err = cet_restore_signal(ext.ssp); > + } > + > + return err; > +} > + > +int setup_sigcontext_ext(struct ksignal *ksig, void __user *fp) > +{ > + int err = 0; > + > + if (boot_cpu_has(X86_FEATURE_SHSTK) && fp) { > + struct sc_ext ext = {0, 0}; > + unsigned long rstor; > + > + rstor = (unsigned long)ksig->ka.sa.sa_restorer; > + err = cet_setup_signal(is_ia32_frame(ksig), rstor, &ext.ssp); > + if (!err) { > + ext.total_size = sizeof(ext); > + err = copy_ext_to_user(fp, &ext); > + } > + } > + > + return err; > +} > +#endif > + > static void > handle_signal(struct ksignal *ksig, struct pt_regs *regs) > { > -- > 2.17.1 >
next prev parent reply other threads:[~2018-10-03 14:35 UTC|newest] Thread overview: 145+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-09-21 15:03 [RFC PATCH v4 00/27] Control Flow Enforcement: Shadow Stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 01/27] x86/cpufeatures: Add CPUIDs for Control-flow Enforcement Technology (CET) Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-25 16:27 ` Peter Zijlstra 2018-09-25 16:27 ` Peter Zijlstra 2018-09-25 16:29 ` Yu-cheng Yu 2018-09-25 16:29 ` Yu-cheng Yu 2018-09-28 16:51 ` Borislav Petkov 2018-09-28 16:51 ` Borislav Petkov 2018-09-28 16:56 ` Yu-cheng Yu 2018-09-28 16:56 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 02/27] x86/fpu/xstate: Change some names to separate XSAVES system and user states Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-25 16:37 ` Peter Zijlstra 2018-09-25 16:37 ` Peter Zijlstra 2018-10-02 15:29 ` Borislav Petkov 2018-10-02 15:29 ` Borislav Petkov 2018-10-02 15:29 ` Borislav Petkov 2018-10-02 16:21 ` Yu-cheng Yu 2018-10-02 16:21 ` Yu-cheng Yu 2018-10-02 16:21 ` Yu-cheng Yu 2018-10-02 16:30 ` Dave Hansen 2018-10-02 16:30 ` Dave Hansen 2018-10-02 16:30 ` Dave Hansen 2018-10-02 16:37 ` Borislav Petkov 2018-10-02 16:37 ` Borislav Petkov 2018-10-02 16:39 ` Dave Hansen 2018-10-02 16:39 ` Dave Hansen 2018-10-02 16:43 ` Yu-cheng Yu 2018-10-02 16:43 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 03/27] x86/fpu/xstate: Enable XSAVES system states Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-25 17:03 ` Peter Zijlstra 2018-09-25 17:03 ` Peter Zijlstra 2018-09-25 17:23 ` Yu-cheng Yu 2018-09-25 17:23 ` Yu-cheng Yu 2018-10-02 17:15 ` Borislav Petkov 2018-10-02 17:15 ` Borislav Petkov 2018-10-04 15:47 ` Yu-cheng Yu 2018-10-04 15:47 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 04/27] x86/fpu/xstate: Add XSAVES system states for shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 05/27] Documentation/x86: Add CET description Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 06/27] x86/cet: Control protection exception handler Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 10:39 ` Eugene Syromiatnikov 2018-10-03 10:39 ` Eugene Syromiatnikov 2018-10-03 16:11 ` Yu-cheng Yu 2018-10-03 16:11 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 07/27] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 08/27] mm: Introduce VM_SHSTK for shadow stack memory Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 09/27] x86/mm: Change _PAGE_DIRTY to _PAGE_DIRTY_HW Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 13:38 ` Matthew Wilcox 2018-10-03 13:38 ` Matthew Wilcox 2018-10-03 14:05 ` Dave Hansen 2018-10-03 14:05 ` Dave Hansen 2018-10-03 16:07 ` Yu-cheng Yu 2018-10-03 16:07 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 10/27] drm/i915/gvt: Update _PAGE_DIRTY to _PAGE_DIRTY_BITS Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 13:19 ` Eugene Syromiatnikov 2018-10-03 13:19 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 11/27] x86/mm: Introduce _PAGE_DIRTY_SW Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 12/27] x86/mm: Modify ptep_set_wrprotect and pmdp_set_wrprotect for _PAGE_DIRTY_SW Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 13/27] x86/mm: Shadow stack page fault error checking Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 14/27] mm: Handle shadow stack page fault Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 15/27] mm: Handle THP/HugeTLB " Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 16/27] mm: Update can_follow_write_pte/pmd for shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 17/27] mm: Introduce do_mmap_locked() Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 18/27] x86/cet/shstk: User-mode shadow stack support Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 15:08 ` Eugene Syromiatnikov 2018-10-03 15:08 ` Eugene Syromiatnikov 2018-10-03 15:12 ` Yu-cheng Yu 2018-10-03 15:12 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 19/27] x86/cet/shstk: Introduce WRUSS instruction Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 4:15 ` Eugene Syromiatnikov 2018-10-03 4:15 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 20/27] x86/cet/shstk: Signal handling for shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 14:36 ` Eugene Syromiatnikov [this message] 2018-10-03 14:36 ` Eugene Syromiatnikov 2018-10-03 16:46 ` Jann Horn 2018-10-03 16:46 ` Jann Horn 2018-09-21 15:03 ` [RFC PATCH v4 21/27] x86/cet/shstk: ELF header parsing of Shadow Stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 23:27 ` Eugene Syromiatnikov 2018-10-03 23:27 ` Eugene Syromiatnikov 2018-10-09 21:15 ` Yu-cheng Yu 2018-10-09 21:15 ` Yu-cheng Yu 2018-10-15 23:40 ` Kees Cook 2018-10-15 23:40 ` Kees Cook 2018-10-16 17:23 ` Yu-cheng Yu 2018-10-16 17:23 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 22/27] x86/cet/shstk: Handle thread shadow stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 23/27] mm/map: Add Shadow stack pages to memory accounting Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 16:55 ` Randy Dunlap 2018-09-21 16:55 ` Randy Dunlap 2018-09-21 17:21 ` Yu-cheng Yu 2018-09-21 17:21 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 24/27] mm/mmap: Create a guard area between VMAs Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 4:56 ` Eugene Syromiatnikov 2018-10-03 4:56 ` Eugene Syromiatnikov 2018-10-03 5:36 ` Andy Lutomirski 2018-10-03 5:36 ` Andy Lutomirski 2018-10-03 16:00 ` Yu-cheng Yu 2018-10-03 16:00 ` Yu-cheng Yu 2018-10-03 16:18 ` Andy Lutomirski 2018-10-03 16:18 ` Andy Lutomirski 2018-10-03 16:32 ` Eugene Syromiatnikov 2018-10-03 16:32 ` Eugene Syromiatnikov 2018-10-03 16:40 ` Yu-cheng Yu 2018-10-03 16:40 ` Yu-cheng Yu 2018-10-03 16:52 ` Jann Horn 2018-10-03 16:52 ` Jann Horn 2018-10-03 21:21 ` Eugene Syromiatnikov 2018-10-03 21:21 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 25/27] mm/mmap: Prevent Shadow Stack VMA merges Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 15:03 ` [RFC PATCH v4 26/27] x86/cet/shstk: Add arch_prctl functions for Shadow Stack Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-10-03 17:57 ` Eugene Syromiatnikov 2018-10-03 17:57 ` Eugene Syromiatnikov 2018-09-21 15:03 ` [RFC PATCH v4 27/27] x86/cet/shstk: Add Shadow Stack instructions to opcode map Yu-cheng Yu 2018-09-21 15:03 ` Yu-cheng Yu 2018-09-21 22:53 ` [RFC PATCH v4 00/27] Control Flow Enforcement: Shadow Stack Dave Hansen 2018-09-21 22:53 ` Dave Hansen 2018-09-24 15:25 ` Yu-cheng Yu 2018-09-24 15:25 ` Yu-cheng Yu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181003143610.GC22724@asgard.redhat.com \ --to=esyr@redhat.com \ --cc=arnd@arndb.de \ --cc=bsingharora@gmail.com \ --cc=corbet@lwn.net \ --cc=dave.hansen@linux.intel.com \ --cc=fweimer@redhat.com \ --cc=gorcunov@gmail.com \ --cc=hjl.tools@gmail.com \ --cc=hpa@zytor.com \ --cc=jannh@google.com \ --cc=keescook@chromium.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-arch@vger.kernel.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@amacapital.net \ --cc=mike.kravetz@oracle.com \ --cc=mingo@redhat.com \ --cc=nadav.amit@gmail.com \ --cc=oleg@redhat.com \ --cc=pavel@ucw.cz \ --cc=peterz@infradead.org \ --cc=ravi.v.shankar@intel.com \ --cc=rdunlap@infradead.org \ --cc=tglx@linutronix.de \ --cc=vedvyas.shanbhogue@intel.com \ --cc=x86@kernel.org \ --cc=yu-cheng.yu@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.