From: Yu-cheng Yu <yu-cheng.yu@intel.com> To: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@amacapital.net>, Balbir Singh <bsingharora@gmail.com>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Eugene Syromiatnikov <esyr@redhat.com>, Florian Weimer <fweimer@redhat.com>, "H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>, Peter Zijlstra <peterz@infradead.org>, Randy Dunlap <rdunlap@infradead.org>, "Ravi V. Shankar" <ravi.v.shankar@intel.com>, Vedvyas Shanbhogue <vedvyas.shanbhogue@intel.com> Cc: Yu-cheng Yu <yu-cheng.yu@intel.com> Subject: [RFC PATCH v6 20/26] x86/cet/shstk: Introduce WRUSS instruction Date: Mon, 19 Nov 2018 13:48:03 -0800 [thread overview] Message-ID: <20181119214809.6086-21-yu-cheng.yu@intel.com> (raw) In-Reply-To: <20181119214809.6086-1-yu-cheng.yu@intel.com> WRUSS is a new kernel-mode instruction but writes directly to user shadow stack memory. This is used to construct a return address on the shadow stack for the signal handler. This instruction can fault if the user shadow stack is invalid shadow stack memory. In that case, the kernel does a fixup. Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com> --- arch/x86/include/asm/special_insns.h | 32 ++++++++++++++++++++++++++++ arch/x86/mm/fault.c | 9 ++++++++ 2 files changed, 41 insertions(+) diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h index 43c029cdc3fe..43957f197a9a 100644 --- a/arch/x86/include/asm/special_insns.h +++ b/arch/x86/include/asm/special_insns.h @@ -237,6 +237,38 @@ static inline void clwb(volatile void *__p) : [pax] "a" (p)); } +#ifdef CONFIG_X86_INTEL_CET +#if defined(CONFIG_IA32_EMULATION) || defined(CONFIG_X86_X32) +static inline int write_user_shstk_32(unsigned long addr, unsigned int val) +{ + asm_volatile_goto("1: wrussd %1, (%0)\n" + _ASM_EXTABLE(1b, %l[fail]) + :: "r" (addr), "r" (val) + :: fail); + return 0; +fail: + return -EPERM; +} +#else +static inline int write_user_shstk_32(unsigned long addr, unsigned int val) +{ + WARN_ONCE(1, "%s used but not supported.\n", __func__); + return -EFAULT; +} +#endif + +static inline int write_user_shstk_64(unsigned long addr, unsigned long val) +{ + asm_volatile_goto("1: wrussq %1, (%0)\n" + _ASM_EXTABLE(1b, %l[fail]) + :: "r" (addr), "r" (val) + :: fail); + return 0; +fail: + return -EPERM; +} +#endif /* CONFIG_X86_INTEL_CET */ + #define nop() asm volatile ("nop") diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index c3368fed706c..7b5de629748e 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -1318,6 +1318,15 @@ void do_user_addr_fault(struct pt_regs *regs, } flags |= FAULT_FLAG_USER; } else { + /* + * WRUSS is a kernel instruction and but writes + * to user shadow stack. When a fault occurs, + * both X86_PF_USER and X86_PF_SHSTK are set. + * Clear X86_PF_USER from sw_error_code. + */ + if ((hw_error_code & (X86_PF_USER | X86_PF_SHSTK)) == + (X86_PF_USER | X86_PF_SHSTK)) + sw_error_code &= ~X86_PF_USER; if (regs->flags & X86_EFLAGS_IF) local_irq_enable(); } -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Yu-cheng Yu <yu-cheng.yu@intel.com> To: x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@amacapital.net>, Balbir Singh <bsingharora@gmail.com>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Eugene Syromiatnikov <esyr@redhat.com>, Florian Weimer <fweimer@redhat.com>, "H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pa Cc: Yu-cheng Yu <yu-cheng.yu@intel.com> Subject: [RFC PATCH v6 20/26] x86/cet/shstk: Introduce WRUSS instruction Date: Mon, 19 Nov 2018 13:48:03 -0800 [thread overview] Message-ID: <20181119214809.6086-21-yu-cheng.yu@intel.com> (raw) In-Reply-To: <20181119214809.6086-1-yu-cheng.yu@intel.com> WRUSS is a new kernel-mode instruction but writes directly to user shadow stack memory. This is used to construct a return address on the shadow stack for the signal handler. This instruction can fault if the user shadow stack is invalid shadow stack memory. In that case, the kernel does a fixup. Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com> --- arch/x86/include/asm/special_insns.h | 32 ++++++++++++++++++++++++++++ arch/x86/mm/fault.c | 9 ++++++++ 2 files changed, 41 insertions(+) diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h index 43c029cdc3fe..43957f197a9a 100644 --- a/arch/x86/include/asm/special_insns.h +++ b/arch/x86/include/asm/special_insns.h @@ -237,6 +237,38 @@ static inline void clwb(volatile void *__p) : [pax] "a" (p)); } +#ifdef CONFIG_X86_INTEL_CET +#if defined(CONFIG_IA32_EMULATION) || defined(CONFIG_X86_X32) +static inline int write_user_shstk_32(unsigned long addr, unsigned int val) +{ + asm_volatile_goto("1: wrussd %1, (%0)\n" + _ASM_EXTABLE(1b, %l[fail]) + :: "r" (addr), "r" (val) + :: fail); + return 0; +fail: + return -EPERM; +} +#else +static inline int write_user_shstk_32(unsigned long addr, unsigned int val) +{ + WARN_ONCE(1, "%s used but not supported.\n", __func__); + return -EFAULT; +} +#endif + +static inline int write_user_shstk_64(unsigned long addr, unsigned long val) +{ + asm_volatile_goto("1: wrussq %1, (%0)\n" + _ASM_EXTABLE(1b, %l[fail]) + :: "r" (addr), "r" (val) + :: fail); + return 0; +fail: + return -EPERM; +} +#endif /* CONFIG_X86_INTEL_CET */ + #define nop() asm volatile ("nop") diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index c3368fed706c..7b5de629748e 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -1318,6 +1318,15 @@ void do_user_addr_fault(struct pt_regs *regs, } flags |= FAULT_FLAG_USER; } else { + /* + * WRUSS is a kernel instruction and but writes + * to user shadow stack. When a fault occurs, + * both X86_PF_USER and X86_PF_SHSTK are set. + * Clear X86_PF_USER from sw_error_code. + */ + if ((hw_error_code & (X86_PF_USER | X86_PF_SHSTK)) == + (X86_PF_USER | X86_PF_SHSTK)) + sw_error_code &= ~X86_PF_USER; if (regs->flags & X86_EFLAGS_IF) local_irq_enable(); } -- 2.17.1
next prev parent reply other threads:[~2018-11-19 21:56 UTC|newest] Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-11-19 21:47 [RFC PATCH v6 00/26] Control-flow Enforcement: Shadow Stack Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 01/26] Documentation/x86: Add CET description Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-20 9:52 ` Ingo Molnar 2018-11-20 9:52 ` Ingo Molnar 2018-11-20 20:36 ` Yu-cheng Yu 2018-11-20 20:36 ` Yu-cheng Yu 2018-11-21 7:24 ` Ingo Molnar 2018-11-21 7:24 ` Ingo Molnar 2018-11-19 21:47 ` [RFC PATCH v6 02/26] x86/cpufeatures: Add CET CPU feature flags for Control-flow Enforcement Technology (CET) Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 03/26] x86/fpu/xstate: Change names to separate XSAVES system and user states Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 04/26] x86/fpu/xstate: Introduce XSAVES system states Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-12-04 16:01 ` Borislav Petkov 2018-12-04 16:01 ` Borislav Petkov 2018-12-04 17:08 ` Yu-cheng Yu 2018-12-04 17:08 ` Yu-cheng Yu 2018-12-04 17:08 ` Yu-cheng Yu 2018-12-04 18:16 ` Borislav Petkov 2018-12-04 18:16 ` Borislav Petkov 2018-11-19 21:47 ` [RFC PATCH v6 05/26] x86/fpu/xstate: Add XSAVES system states for shadow stack Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 06/26] x86/cet: Add control protection exception handler Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 07/26] x86/cet/shstk: Add Kconfig option for user-mode shadow stack Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 08/26] mm: Introduce VM_SHSTK for shadow stack memory Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 09/26] mm/mmap: Prevent Shadow Stack VMA merges Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 10/26] x86/mm: Change _PAGE_DIRTY to _PAGE_DIRTY_HW Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 11/26] x86/mm: Introduce _PAGE_DIRTY_SW Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 12/26] drm/i915/gvt: Update _PAGE_DIRTY to _PAGE_DIRTY_BITS Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 13/26] x86/mm: Modify ptep_set_wrprotect and pmdp_set_wrprotect for _PAGE_DIRTY_SW Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 14/26] x86/mm: Shadow stack page fault error checking Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 15/26] mm: Handle shadow stack page fault Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:47 ` [RFC PATCH v6 16/26] mm: Handle THP/HugeTLB " Yu-cheng Yu 2018-11-19 21:47 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 17/26] mm: Update can_follow_write_pte/pmd for shadow stack Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 18/26] mm: Introduce do_mmap_locked() Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 19/26] x86/cet/shstk: User-mode shadow stack support Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu [this message] 2018-11-19 21:48 ` [RFC PATCH v6 20/26] x86/cet/shstk: Introduce WRUSS instruction Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 21/26] x86/cet/shstk: Signal handling for shadow stack Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 22/26] x86/cet/shstk: ELF header parsing of Shadow Stack Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2019-04-25 11:02 ` Dave Martin 2019-04-25 11:02 ` Dave Martin 2019-04-25 15:14 ` Yu-cheng Yu 2019-04-25 15:14 ` Yu-cheng Yu 2019-04-25 15:14 ` Yu-cheng Yu 2019-04-25 15:35 ` Dave Martin 2019-04-25 15:35 ` Dave Martin 2019-04-25 16:11 ` Dave Martin 2019-04-25 16:11 ` Dave Martin 2019-04-25 16:20 ` Yu-cheng Yu 2019-04-25 16:20 ` Yu-cheng Yu 2019-04-25 16:20 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 23/26] x86/cet/shstk: Handle thread shadow stack Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 24/26] mm/mmap: Add Shadow stack pages to memory accounting Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 25/26] x86/cet/shstk: Add arch_prctl functions for Shadow Stack Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-19 21:48 ` [RFC PATCH v6 26/26] x86/cet/shstk: Add Shadow Stack instructions to opcode map Yu-cheng Yu 2018-11-19 21:48 ` Yu-cheng Yu 2018-11-22 16:53 ` [RFC PATCH v6 00/26] Control-flow Enforcement: Shadow Stack Andy Lutomirski 2018-11-22 16:53 ` Andy Lutomirski 2018-11-26 17:38 ` Yu-cheng Yu 2018-11-26 17:38 ` Yu-cheng Yu 2018-11-26 18:29 ` Andy Lutomirski 2018-11-26 18:29 ` Andy Lutomirski
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181119214809.6086-21-yu-cheng.yu@intel.com \ --to=yu-cheng.yu@intel.com \ --cc=arnd@arndb.de \ --cc=bsingharora@gmail.com \ --cc=corbet@lwn.net \ --cc=dave.hansen@linux.intel.com \ --cc=esyr@redhat.com \ --cc=fweimer@redhat.com \ --cc=gorcunov@gmail.com \ --cc=hjl.tools@gmail.com \ --cc=hpa@zytor.com \ --cc=jannh@google.com \ --cc=keescook@chromium.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-arch@vger.kernel.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@amacapital.net \ --cc=mike.kravetz@oracle.com \ --cc=mingo@redhat.com \ --cc=nadav.amit@gmail.com \ --cc=oleg@redhat.com \ --cc=pavel@ucw.cz \ --cc=peterz@infradead.org \ --cc=ravi.v.shankar@intel.com \ --cc=rdunlap@infradead.org \ --cc=tglx@linutronix.de \ --cc=vedvyas.shanbhogue@intel.com \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.