Received: by 2002:a05:6a10:6744:0:0:0:0 with SMTP id w4csp4068012pxu; Mon, 12 Oct 2020 08:41:27 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw+8jZJWVV1L8OpqhRGCvsxPbZUYfT4o8+gQIssjYL509bUAOAHCEnLfeoe9L9Xyl4atVzs X-Received: by 2002:a17:906:86ce:: with SMTP id j14mr29296225ejy.158.1602517287607; Mon, 12 Oct 2020 08:41:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1602517287; cv=none; d=google.com; s=arc-20160816; b=V6JnXpCLquEZK+dUn4aNNZjlmzXGUYmrWhiBQGltMLydwxv2DZ1uJIJEKlMimU+a5T AdLpJf8P4dA1AdnPmWjG/Wt87hcUFBr75bwLzI25DXX8y+ymsl5K+sIxmHwgnHbPVseG CcxOAt1x5LMalu74bMnqslITxVoaOb8tXZJSmwE/i3SDIrZDsPtbS+ZQbPnsJR2BPa4L 3ukhQ8iq2p6m9SG6t2ZJzKrm6++gXMhUVUMcIJvoDGm7xHQlEDgijWG1Dh7Panub8gXM DRIhXxm80zZ0asIljM6bsnA6h7Nygm2sNDe+i/qceGMPf2v3Z5v3X6m5S4P8U5RCAOv5 mBzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:ironport-sdr:ironport-sdr; bh=8VahTC8+6B/OfwCwA6LCwFmr9uhzc/imxvvuz7luExU=; b=CrldE4qtw3eCB79xk6XY9PbW733wrHtSEamAVYAvWw5vskCx56dQ6EoOA2TuIYk3Yr YtWZ7UPNBWBgb4+aWRXuWEicPcuQ5yV9Vo8Or0ygq5RlMGb9M9vXsPU3GOdJOXeZgTOt xq8R5MBfXX7wIzt+gAyFa0Swhx4rE9AspW8hrL8nDh9Slk0fdZoU8aJOuL3xDb4P8lfR w++D7B38gL3USIFoZ/2j87vkkXIgc1h0kIHROKf3BtmbYbUX7t7PMMRWG0kaRuURFhfE WhbIyj1/MHByBX7+1QPzyTkywygITvhVRQF3XHyHUy40CziMgDyKSx406lZlQmO4AKUN DsIA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id cx12si15855184edb.263.2020.10.12.08.41.04; Mon, 12 Oct 2020 08:41:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390107AbgJLPjq (ORCPT + 99 others); Mon, 12 Oct 2020 11:39:46 -0400 Received: from mga05.intel.com ([192.55.52.43]:1310 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388881AbgJLPjp (ORCPT ); Mon, 12 Oct 2020 11:39:45 -0400 IronPort-SDR: 4vUTtTujdMXv0/i9le4px3lCzQF9iUA7xqRrYcS9AIcQq0b58BT4RVZtudNpWU9omytlQ3FBkx pRSePYN5YR0Q== X-IronPort-AV: E=McAfee;i="6000,8403,9772"; a="250452628" X-IronPort-AV: E=Sophos;i="5.77,367,1596524400"; d="scan'208";a="250452628" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Oct 2020 08:39:44 -0700 IronPort-SDR: SuCCYzwbjfRI8VAd6IeO4gzkRI1Gowkfmj/SCzLMKtHV+bOQXX4tFKszzojjqQcxMqXHqxxryQ JMD/q9urWEfA== X-IronPort-AV: E=Sophos;i="5.77,367,1596524400"; d="scan'208";a="530010746" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by orsmga005-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Oct 2020 08:39:43 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu Cc: Yu-cheng Yu Subject: [PATCH v14 00/26] Control-flow Enforcement: Shadow Stack Date: Mon, 12 Oct 2020 08:38:24 -0700 Message-Id: <20201012153850.26996-1-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Control-flow Enforcement (CET) is a new Intel processor feature that blocks return/jump-oriented programming attacks. Details are in "Intel 64 and IA-32 Architectures Software Developer's Manual" [1]. CET can protect applications and the kernel. This series enables only application-level protection, and has three parts: - Shadow stack [2], - Indirect branch tracking [3], and - Selftests [4]. I have run tests on these patches for quite some time, and they have been very stable. Linux distributions with CET are available now, and Intel processors with CET are becoming available. It would be nice if CET support can be accepted into the kernel. I will be working to address any issues should they come up. Changes in v14: - Update patch #10, add cpu_feature_enabled() to fixup_dirty_*. - Update patch #19, instead of re-introducing do_mmap_pgoff(), make all callers of the wrapper pass a zero vm_flags. - Update patch #26, move checking vm_flags into arch_validate_prot(); check the task's shadow stack status, instead of static_cpu_has(). [1] Intel 64 and IA-32 Architectures Software Developer's Manual: https://software.intel.com/en-us/download/intel-64-and-ia-32- architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4 [2] CET Shadow Stack patches v13: https://lkml.kernel.org/r/20200925145649.5438-2-yu-cheng.yu@intel.com/ [3] Indirect Branch Tracking patches v13. https://lkml.kernel.org/r/20200925145804.5821-1-yu-cheng.yu@intel.com/ [4] I am holding off the selftests changes and working to get Acked-by's. The earlier version of the selftests patches: https://lkml.kernel.org/r/20200521211720.20236-1-yu-cheng.yu@intel.com/ [5] The kernel ptrace patch is tested with an Intel-internal updated GDB. I am holding off the kernel ptrace patch to re-test it with my earlier patch for fixing regset holes. Yu-cheng Yu (26): Documentation/x86: Add CET description x86/cpufeatures: Add CET CPU feature flags for Control-flow Enforcement Technology (CET) x86/fpu/xstate: Introduce CET MSR XSAVES supervisor states x86/cet: Add control-protection fault handler x86/cet/shstk: Add Kconfig option for user-mode Shadow Stack x86/mm: Change _PAGE_DIRTY to _PAGE_DIRTY_HW x86/mm: Remove _PAGE_DIRTY_HW from kernel RO pages x86/mm: Introduce _PAGE_COW drm/i915/gvt: Change _PAGE_DIRTY to _PAGE_DIRTY_BITS x86/mm: Update pte_modify for _PAGE_COW x86/mm: Update ptep_set_wrprotect() and pmdp_set_wrprotect() for transition from _PAGE_DIRTY_HW to _PAGE_COW mm: Introduce VM_SHSTK for shadow stack memory x86/mm: Shadow Stack page fault error checking x86/mm: Update maybe_mkwrite() for shadow stack mm: Fixup places that call pte_mkwrite() directly mm: Add guard pages around a shadow stack. mm/mmap: Add shadow stack pages to memory accounting mm: Update can_follow_write_pte() for shadow stack mm: Re-introduce vm_flags to do_mmap() x86/cet/shstk: User-mode shadow stack support x86/cet/shstk: Handle signals for shadow stack binfmt_elf: Define GNU_PROPERTY_X86_FEATURE_1_AND properties ELF: Introduce arch_setup_elf_property() x86/cet/shstk: Handle thread shadow stack x86/cet/shstk: Add arch_prctl functions for shadow stack mm: Introduce PROT_SHSTK for shadow stack .../admin-guide/kernel-parameters.txt | 6 + Documentation/x86/index.rst | 1 + Documentation/x86/intel_cet.rst | 133 +++++++ arch/arm64/include/asm/elf.h | 5 + arch/x86/Kconfig | 39 ++ arch/x86/ia32/ia32_signal.c | 17 + arch/x86/include/asm/cet.h | 42 +++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/disabled-features.h | 8 +- arch/x86/include/asm/elf.h | 13 + arch/x86/include/asm/fpu/internal.h | 10 + arch/x86/include/asm/fpu/types.h | 23 +- arch/x86/include/asm/fpu/xstate.h | 5 +- arch/x86/include/asm/idtentry.h | 4 + arch/x86/include/asm/mman.h | 83 +++++ arch/x86/include/asm/mmu_context.h | 3 + arch/x86/include/asm/msr-index.h | 20 + arch/x86/include/asm/pgtable.h | 209 ++++++++++- arch/x86/include/asm/pgtable_types.h | 58 ++- arch/x86/include/asm/processor.h | 15 + arch/x86/include/asm/special_insns.h | 32 ++ arch/x86/include/asm/traps.h | 2 + arch/x86/include/uapi/asm/mman.h | 28 +- arch/x86/include/uapi/asm/prctl.h | 4 + arch/x86/include/uapi/asm/processor-flags.h | 2 + arch/x86/include/uapi/asm/sigcontext.h | 9 + arch/x86/kernel/Makefile | 2 + arch/x86/kernel/cet.c | 343 ++++++++++++++++++ arch/x86/kernel/cet_prctl.c | 68 ++++ arch/x86/kernel/cpu/common.c | 28 ++ arch/x86/kernel/cpu/cpuid-deps.c | 2 + arch/x86/kernel/fpu/signal.c | 100 +++++ arch/x86/kernel/fpu/xstate.c | 28 +- arch/x86/kernel/idt.c | 4 + arch/x86/kernel/process.c | 14 +- arch/x86/kernel/process_64.c | 32 ++ arch/x86/kernel/relocate_kernel_64.S | 2 +- arch/x86/kernel/signal.c | 10 + arch/x86/kernel/signal_compat.c | 2 +- arch/x86/kernel/traps.c | 59 +++ arch/x86/kvm/vmx/vmx.c | 2 +- arch/x86/mm/fault.c | 19 + arch/x86/mm/mmap.c | 2 + arch/x86/mm/pat/set_memory.c | 2 +- arch/x86/mm/pgtable.c | 25 ++ drivers/gpu/drm/i915/gvt/gtt.c | 2 +- fs/aio.c | 2 +- fs/binfmt_elf.c | 4 + fs/proc/task_mmu.c | 3 + include/linux/elf.h | 6 + include/linux/mm.h | 38 +- include/linux/pgtable.h | 35 ++ include/uapi/asm-generic/siginfo.h | 3 +- include/uapi/linux/elf.h | 9 + ipc/shm.c | 2 +- mm/gup.c | 8 +- mm/huge_memory.c | 10 +- mm/memory.c | 5 +- mm/migrate.c | 3 +- mm/mmap.c | 23 +- mm/mprotect.c | 2 +- mm/nommu.c | 4 +- mm/util.c | 2 +- scripts/as-x86_64-has-shadow-stack.sh | 4 + tools/arch/x86/include/asm/cpufeatures.h | 2 + .../arch/x86/include/asm/disabled-features.h | 8 +- tools/arch/x86/include/asm/msr-index.h | 20 + tools/arch/x86/include/uapi/asm/prctl.h | 4 + 68 files changed, 1624 insertions(+), 92 deletions(-) create mode 100644 Documentation/x86/intel_cet.rst create mode 100644 arch/x86/include/asm/cet.h create mode 100644 arch/x86/include/asm/mman.h create mode 100644 arch/x86/kernel/cet.c create mode 100644 arch/x86/kernel/cet_prctl.c create mode 100755 scripts/as-x86_64-has-shadow-stack.sh -- 2.21.0