From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yu-cheng Yu Subject: Re: [RFC PATCH v3 18/24] x86/cet/shstk: User-mode shadow stack support Date: Thu, 30 Aug 2018 09:20:55 -0700 Message-ID: <1535646055.26689.10.camel@intel.com> References: <20180830143904.3168-1-yu-cheng.yu@intel.com> <20180830143904.3168-19-yu-cheng.yu@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Jann Horn Cc: the arch/x86 maintainers , "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , kernel list , linux-doc@vger.kernel.org, Linux-MM , linux-arch , Linux API , Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Florian Weimer , hjl.tools@gmail.com, Jonathan Corbet , keescook@chromiun.org, Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek List-Id: linux-arch.vger.kernel.org On Thu, 2018-08-30 at 18:10 +0200, Jann Horn wrote: > On Thu, Aug 30, 2018 at 4:44 PM Yu-cheng Yu > wrote: > > > > > > This patch adds basic shadow stack enabling/disabling routines. > > A task's shadow stack is allocated from memory with VM_SHSTK > > flag set and read-only protection.  The shadow stack is > > allocated to a fixed size of RLIMIT_STACK. > > > > Signed-off-by: Yu-cheng Yu > [...] > > > > +static int set_shstk_ptr(unsigned long addr) > > +{ > > +       u64 r; > > + > > +       if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) > > +               return -1; > > + > > +       if ((addr >= TASK_SIZE_MAX) || (!IS_ALIGNED(addr, 4))) > > +               return -1; > > + > > +       rdmsrl(MSR_IA32_U_CET, r); > > +       wrmsrl(MSR_IA32_PL3_SSP, addr); > > +       wrmsrl(MSR_IA32_U_CET, r | MSR_IA32_CET_SHSTK_EN); > > +       return 0; > > +} > Here's a really stupid question: Where is the logic for switching > those MSRs on task switch? MSR_IA32_PL3_SSP contains a userspace > pointer, so it has to be switched on task switch, right? I'm sure > I'm > missing something obvious, but grepping for places that set > MSR_IA32_PL3_SSP to nonzero values through the entire patchset, I > only > see set_shstk_ptr(), which is called from: > >  - cet_setup_shstk() (called from arch_setup_features(), which is > called from load_elf_binary()) >  - cet_restore_signal() (called on signal handler return) >  - cet_setup_signal() (called from signal handling code) The MSR is in the XSAVES buffer and switched by XSAVES/XRSTORS. Yu-cheng From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga14.intel.com ([192.55.52.115]:63242 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727067AbeH3U2K (ORCPT ); Thu, 30 Aug 2018 16:28:10 -0400 Message-ID: <1535646055.26689.10.camel@intel.com> Subject: Re: [RFC PATCH v3 18/24] x86/cet/shstk: User-mode shadow stack support From: Yu-cheng Yu Date: Thu, 30 Aug 2018 09:20:55 -0700 In-Reply-To: References: <20180830143904.3168-1-yu-cheng.yu@intel.com> <20180830143904.3168-19-yu-cheng.yu@intel.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: Jann Horn Cc: the arch/x86 maintainers , "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , kernel list , linux-doc@vger.kernel.org, Linux-MM , linux-arch , Linux API , Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Florian Weimer , hjl.tools@gmail.com, Jonathan Corbet , keescook@chromiun.org, Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , ravi.v.shankar@intel.com, vedvyas.shanbhogue@intel.com Message-ID: <20180830162055.kxZeb-g63xvljFvT-i4xk6CY0Fq96c2j-I4b0Fv6I8g@z> On Thu, 2018-08-30 at 18:10 +0200, Jann Horn wrote: > On Thu, Aug 30, 2018 at 4:44 PM Yu-cheng Yu > wrote: > > > > > > This patch adds basic shadow stack enabling/disabling routines. > > A task's shadow stack is allocated from memory with VM_SHSTK > > flag set and read-only protection.  The shadow stack is > > allocated to a fixed size of RLIMIT_STACK. > > > > Signed-off-by: Yu-cheng Yu > [...] > > > > +static int set_shstk_ptr(unsigned long addr) > > +{ > > +       u64 r; > > + > > +       if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) > > +               return -1; > > + > > +       if ((addr >= TASK_SIZE_MAX) || (!IS_ALIGNED(addr, 4))) > > +               return -1; > > + > > +       rdmsrl(MSR_IA32_U_CET, r); > > +       wrmsrl(MSR_IA32_PL3_SSP, addr); > > +       wrmsrl(MSR_IA32_U_CET, r | MSR_IA32_CET_SHSTK_EN); > > +       return 0; > > +} > Here's a really stupid question: Where is the logic for switching > those MSRs on task switch? MSR_IA32_PL3_SSP contains a userspace > pointer, so it has to be switched on task switch, right? I'm sure > I'm > missing something obvious, but grepping for places that set > MSR_IA32_PL3_SSP to nonzero values through the entire patchset, I > only > see set_shstk_ptr(), which is called from: > >  - cet_setup_shstk() (called from arch_setup_features(), which is > called from load_elf_binary()) >  - cet_restore_signal() (called on signal handler return) >  - cet_setup_signal() (called from signal handling code) The MSR is in the XSAVES buffer and switched by XSAVES/XRSTORS. Yu-cheng