From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B1E2C433E3 for ; Tue, 25 Aug 2020 00:29:33 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D31BA207D3 for ; Tue, 25 Aug 2020 00:29:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D31BA207D3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 6294F6B0030; Mon, 24 Aug 2020 20:29:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5B21C6B0031; Mon, 24 Aug 2020 20:29:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 47A8E6B0032; Mon, 24 Aug 2020 20:29:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0156.hostedemail.com [216.40.44.156]) by kanga.kvack.org (Postfix) with ESMTP id 2BAAD6B0030 for ; Mon, 24 Aug 2020 20:29:32 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id D349382499B9 for ; Tue, 25 Aug 2020 00:29:31 +0000 (UTC) X-FDA: 77187207342.16.thing18_38098f727057 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin16.hostedemail.com (Postfix) with ESMTP id A8D6A100E6903 for ; Tue, 25 Aug 2020 00:29:31 +0000 (UTC) X-HE-Tag: thing18_38098f727057 X-Filterd-Recvd-Size: 10158 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by imf38.hostedemail.com (Postfix) with ESMTP for ; Tue, 25 Aug 2020 00:29:30 +0000 (UTC) IronPort-SDR: u8W+pcM5xPp7sQZK5EapTPPhi7scO1h0aFiw3sMzEWvpvl93C3LKt45Q4gcI2pYHU/xyiy9V0v 9NgdMNGVuZmQ== X-IronPort-AV: E=McAfee;i="6000,8403,9723"; a="157061695" X-IronPort-AV: E=Sophos;i="5.76,350,1592895600"; d="scan'208";a="157061695" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Aug 2020 17:29:29 -0700 IronPort-SDR: +ixf0feFasPgS2JIBfpwdEH7OcPp+nDHQQ7IwSKUCHdN49S3H5pYwxzxO/ddWTMF876ij7k2In zcK5DzFLh5fA== X-IronPort-AV: E=Sophos;i="5.76,350,1592895600"; d="scan'208";a="474134921" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by orsmga005-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Aug 2020 17:29:28 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang Cc: Yu-cheng Yu Subject: [PATCH v11 00/25] Control-flow Enforcement: Shadow Stack Date: Mon, 24 Aug 2020 17:25:15 -0700 Message-Id: <20200825002540.3351-1-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 X-Rspamd-Queue-Id: A8D6A100E6903 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Control-flow Enforcement (CET) is a new Intel processor feature that bloc= ks return/jump-oriented programming attacks. Details are in "Intel 64 and IA-32 Architectures Software Developer's Manual" [1]. CET can protect applications and the kernel. This series enables only application-level protection, and has three parts: - shadow stack [2], - indirect branch tracking, ptrace [3], and - selftests [4]. I have run tests on these patches for quite some time, and they have been very stable. Linux distributions with CET are available now, and Intel processors with CET are becoming available. It would be nice if CET support can be accepted into the kernel. I will be working to address an= y issues should they come up. Changes in v11: - Rebase to v5.9-rc1. - There was no more caller passing vm_flags to do_mmap() and the input parameter was removed. Shadow stack allocation is a new user passing VM_SHSTK. Thus, reintroduce the parameter and do_mmap_pgoff(). - Selftests/x86/sigreturn does a sigreturn from 64-bit to a 32-bit contex= t, and needs a shadow stack in the 32-bit address range. For all similar purposes, change shadow stack allocation arch_prctl() to take MAP_32BIT and MAP_POPULATE flags from the user. - Update arch_prctl() for checking invalid inputs and using proper return codes. - Other smaller changes are noted in each patch's log. [1] Intel 64 and IA-32 Architectures Software Developer's Manual: https://software.intel.com/en-us/download/intel-64-and-ia-32- architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4 [2] CET Shadow Stack patches v10: https://lkml.kernel.org/r/20200429220732.31602-1-yu-cheng.yu@intel.co= m/ [3] There is no Indirect Branch Tracking patches v10. There have been no major changes since v9: https://lkml.kernel.org/r/20200205182308.4028-1-yu-cheng.yu@intel.com= / [4] I am holding off the selftests changes and working to get Acked-by's. The earlier version of the selftests patches: https://lkml.kernel.org/r/20200521211720.20236-1-yu-cheng.yu@intel.co= m/ Yu-cheng Yu (25): Documentation/x86: Add CET description x86/cpufeatures: Add CET CPU feature flags for Control-flow Enforcement Technology (CET) x86/fpu/xstate: Introduce CET MSR XSAVES supervisor states x86/cet: Add control-protection fault handler x86/cet/shstk: Add Kconfig option for user-mode Shadow Stack x86/mm: Change _PAGE_DIRTY to _PAGE_DIRTY_HW x86/mm: Remove _PAGE_DIRTY_HW from kernel RO pages x86/mm: Introduce _PAGE_COW drm/i915/gvt: Change _PAGE_DIRTY to _PAGE_DIRTY_BITS x86/mm: Update pte_modify for _PAGE_COW x86/mm: Update ptep_set_wrprotect() and pmdp_set_wrprotect() for transition from _PAGE_DIRTY_HW to _PAGE_COW mm: Introduce VM_SHSTK for shadow stack memory x86/mm: Shadow Stack page fault error checking x86/mm: Update maybe_mkwrite() for shadow stack mm: Fixup places that call pte_mkwrite() directly mm: Add guard pages around a shadow stack. mm/mmap: Add shadow stack pages to memory accounting mm: Update can_follow_write_pte() for shadow stack mm: Re-introduce do_mmap_pgoff() x86/cet/shstk: User-mode shadow stack support x86/cet/shstk: Handle signals for shadow stack binfmt_elf: Define GNU_PROPERTY_X86_FEATURE_1_AND properties ELF: Introduce arch_setup_elf_property() x86/cet/shstk: Handle thread shadow stack x86/cet/shstk: Add arch_prctl functions for shadow stack .../admin-guide/kernel-parameters.txt | 6 + Documentation/x86/index.rst | 1 + Documentation/x86/intel_cet.rst | 143 +++++++ arch/arm64/include/asm/elf.h | 5 + arch/x86/Kconfig | 36 ++ arch/x86/ia32/ia32_signal.c | 17 + arch/x86/include/asm/cet.h | 40 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/disabled-features.h | 8 +- arch/x86/include/asm/elf.h | 13 + arch/x86/include/asm/fpu/internal.h | 10 + arch/x86/include/asm/fpu/types.h | 23 +- arch/x86/include/asm/fpu/xstate.h | 5 +- arch/x86/include/asm/idtentry.h | 4 + arch/x86/include/asm/mmu_context.h | 3 + arch/x86/include/asm/msr-index.h | 17 + arch/x86/include/asm/pgtable.h | 209 +++++++++- arch/x86/include/asm/pgtable_types.h | 58 ++- arch/x86/include/asm/processor.h | 15 + arch/x86/include/asm/special_insns.h | 32 ++ arch/x86/include/asm/traps.h | 2 + arch/x86/include/uapi/asm/prctl.h | 5 + arch/x86/include/uapi/asm/processor-flags.h | 2 + arch/x86/include/uapi/asm/sigcontext.h | 9 + arch/x86/kernel/Makefile | 2 + arch/x86/kernel/cet.c | 357 ++++++++++++++++++ arch/x86/kernel/cet_prctl.c | 98 +++++ arch/x86/kernel/cpu/common.c | 28 ++ arch/x86/kernel/cpu/cpuid-deps.c | 2 + arch/x86/kernel/fpu/signal.c | 100 +++++ arch/x86/kernel/fpu/xstate.c | 28 +- arch/x86/kernel/idt.c | 4 + arch/x86/kernel/process.c | 14 +- arch/x86/kernel/process_64.c | 32 ++ arch/x86/kernel/relocate_kernel_64.S | 2 +- arch/x86/kernel/signal.c | 10 + arch/x86/kernel/signal_compat.c | 2 +- arch/x86/kernel/traps.c | 59 +++ arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/mm/fault.c | 19 + arch/x86/mm/mmap.c | 2 + arch/x86/mm/pat/set_memory.c | 2 +- arch/x86/mm/pgtable.c | 25 ++ drivers/gpu/drm/i915/gvt/gtt.c | 2 +- fs/aio.c | 6 +- fs/binfmt_elf.c | 4 + fs/hugetlbfs/inode.c | 2 +- fs/proc/task_mmu.c | 3 + include/linux/elf.h | 6 + include/linux/fs.h | 2 +- include/linux/mm.h | 46 ++- include/linux/pgtable.h | 35 ++ include/uapi/asm-generic/siginfo.h | 3 +- include/uapi/linux/elf.h | 9 + ipc/shm.c | 2 +- mm/gup.c | 8 +- mm/huge_memory.c | 10 +- mm/memory.c | 5 +- mm/migrate.c | 3 +- mm/mmap.c | 21 +- mm/mprotect.c | 2 +- mm/nommu.c | 6 +- mm/shmem.c | 2 +- mm/util.c | 4 +- scripts/as-x86_64-has-shadow-stack.sh | 4 + .../arch/x86/include/asm/disabled-features.h | 8 +- tools/arch/x86/include/uapi/asm/prctl.h | 5 + 67 files changed, 1574 insertions(+), 77 deletions(-) create mode 100644 Documentation/x86/intel_cet.rst create mode 100644 arch/x86/include/asm/cet.h create mode 100644 arch/x86/kernel/cet.c create mode 100644 arch/x86/kernel/cet_prctl.c create mode 100755 scripts/as-x86_64-has-shadow-stack.sh --=20 2.21.0