Received: by 2002:a05:6a10:1d13:0:0:0:0 with SMTP id pp19csp1686758pxb; Fri, 20 Aug 2021 11:19:53 -0700 (PDT) X-Google-Smtp-Source: ABdhPJySz70yl6Kv2m548lf0VY/fVwPjqh2cmDjFZEUzj2F7ePd8KirakFUqC01UsZt/qIL4t9qj X-Received: by 2002:a6b:7710:: with SMTP id n16mr16993590iom.101.1629483593206; Fri, 20 Aug 2021 11:19:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1629483593; cv=none; d=google.com; s=arc-20160816; b=K1bwy/bgOnCI5nikIYkdqpyaU7PKoDZGQrqAILWRofpISlDdGLSVVlmY2tcPScrXVE iyH+vF/j4dNXgs8UAIN9wzMZavrbCtTf+2FkghhE5Vrpfv97kxVYuKTxUnCNak3w+9uz km1PXJhRtgVKfQRwlMnXyeyjEfLUXSVvPXN41409hHpF8H+sdELK+R7mV/6QMO8HAcfG ZFHRbwnJ5rqaXnNoBktWGHpSTqeM3yLXeBmABNFGlkczcPk5QuSgQ1wqIEEYq12moNVG SjqCRBn+nDd035VmzjNvOwYYLYjW3P7+TEUqdNaNMdha87ZciuW/76+ENV2cMCs8Bgwy nR8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=PX0DBnPSJmROhmUmULBsm5IGv7zmGKG8nsf2Pm1a9uI=; b=eyT7TDzxNFZV1pqVpUs0UT89m1KRwNoULnMm+x2vVUOkCijjHrCsdjTgNgfYYYyMwn yWKYNgeke/yc14v9/d3XSkcPRsj8DniXneBXTcsxiwGpCnSds2FGMkxspKEGg9sZqhwN nK6xglmIYx5/TspEHEF5FdoRxH1WtcjkeN+2t3sCuFQqn5uhomfXHMUn+sAKKjAtP9j9 oGMYAIp1uilOfoi9Vjxb6LHJ9UIWGOAvlhxLbtCm0pVFQMWYJ02kPQkJpPkdzokyzs4D 0/iuw4QrsciQUNLp9o7waE/RpQvupUnS48owJsxP5qZLQD03vptlwYZ/G1F6SXeG4SFb zb5g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id c6si3895201iow.84.2021.08.20.11.19.40; Fri, 20 Aug 2021 11:19:53 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236202AbhHTSTZ (ORCPT + 99 others); Fri, 20 Aug 2021 14:19:25 -0400 Received: from mga05.intel.com ([192.55.52.43]:22426 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231341AbhHTSTX (ORCPT ); Fri, 20 Aug 2021 14:19:23 -0400 X-IronPort-AV: E=McAfee;i="6200,9189,10082"; a="302407774" X-IronPort-AV: E=Sophos;i="5.84,338,1620716400"; d="scan'208";a="302407774" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Aug 2021 11:18:43 -0700 X-IronPort-AV: E=Sophos;i="5.84,338,1620716400"; d="scan'208";a="533074658" Received: from yyu32-desk.sc.intel.com ([143.183.136.146]) by fmsmga002-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Aug 2021 11:18:43 -0700 From: Yu-cheng Yu To: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang , Rick P Edgecombe Cc: Yu-cheng Yu Subject: [PATCH v29 00/32] Control-flow Enforcement: Shadow Stack Date: Fri, 20 Aug 2021 11:11:29 -0700 Message-Id: <20210820181201.31490-1-yu-cheng.yu@intel.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Control-flow Enforcement (CET) is a new Intel processor feature that blocks return/jump-oriented programming attacks. Details are in "Intel 64 and IA-32 Architectures Software Developer's Manual" [1]. CET can protect applications and the kernel. This series enables only application-level protection, and is further split into the Shadow Stack and Indirect Branch Tracking. Linux distributions with CET are available now. The patches being sent are regularly applied to upstream Linus tree and tested by Zero-day service and verified in all configurations of GLIBC tests. In addition, Linux kernel selftests/x86 has been updated and run with CET enabled. Selftests patches v2 will be sent separately [2]. Changes in v29: - Patch #5: Move CET MSR definitions up in msr-index.h. - Patch #6: Remove pr_emerg() from CP fault handler, since that is followed by die(). - Patch #16: Remove likely(). - Patch #25: Add WARN_ON_ONCE() when get_xsave_addr() returns NULL (Dave Hansen). - Rebased to Linus tree v5.14-rc6. Changes in v28: - Patch #1: Update Document to indicate no-user-shstk also disables IBT. - Patch #23: Update shstk_setup() with wrmsrl_safe(). Update return value. - Patch #25: Split out copy_thread() changes. Add support for old clone(). Add comments. - Add comments for get_xsave_addr() (Patch #25, #26). - Rebase to Linus tree v5.14-rc2. Changes in v27: - Eliminate signal context extension structure. Simplify signal handling. - Add a new patch to move VM_UFFD_MINOR_BIT to 38. - Smaller changes are in each patch's log. - Rebase to Linus tree v5.13-rc2. [1] Intel 64 and IA-32 Architectures Software Developer's Manual: https://software.intel.com/en-us/download/intel-64-and-ia-32- architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4 [2] Selftests patches v1: https://lkml.kernel.org/r/20200521211720.20236-1-yu-cheng.yu@intel.com/ Yu-cheng Yu (32): Documentation/x86: Add CET description x86/cet/shstk: Add Kconfig option for Shadow Stack x86/cpufeatures: Add CET CPU feature flags for Control-flow Enforcement Technology (CET) x86/cpufeatures: Introduce CPU setup and option parsing for CET x86/fpu/xstate: Introduce CET MSR and XSAVES supervisor states x86/cet: Add control-protection fault handler x86/mm: Remove _PAGE_DIRTY from kernel RO pages x86/mm: Move pmd_write(), pud_write() up in the file x86/mm: Introduce _PAGE_COW drm/i915/gvt: Change _PAGE_DIRTY to _PAGE_DIRTY_BITS x86/mm: Update pte_modify for _PAGE_COW x86/mm: Update ptep_set_wrprotect() and pmdp_set_wrprotect() for transition from _PAGE_DIRTY to _PAGE_COW mm: Move VM_UFFD_MINOR_BIT from 37 to 38 mm: Introduce VM_SHADOW_STACK for shadow stack memory x86/mm: Shadow Stack page fault error checking x86/mm: Update maybe_mkwrite() for shadow stack mm: Fixup places that call pte_mkwrite() directly mm: Add guard pages around a shadow stack. mm/mmap: Add shadow stack pages to memory accounting mm: Update can_follow_write_pte() for shadow stack mm/mprotect: Exclude shadow stack from preserve_write mm: Re-introduce vm_flags to do_mmap() x86/cet/shstk: Add user-mode shadow stack support x86/process: Change copy_thread() argument 'arg' to 'stack_size' x86/cet/shstk: Handle thread shadow stack x86/cet/shstk: Introduce shadow stack token setup/verify routines x86/cet/shstk: Handle signals for shadow stack ELF: Introduce arch_setup_elf_property() x86/cet/shstk: Add arch_prctl functions for shadow stack mm: Move arch_calc_vm_prot_bits() to arch/x86/include/asm/mman.h mm: Update arch_validate_flags() to test vma anonymous mm: Introduce PROT_SHADOW_STACK for shadow stack .../admin-guide/kernel-parameters.txt | 7 + Documentation/filesystems/proc.rst | 1 + Documentation/x86/index.rst | 1 + Documentation/x86/intel_cet.rst | 139 +++++++ arch/arm64/include/asm/elf.h | 5 + arch/arm64/include/asm/mman.h | 4 +- arch/sparc/include/asm/mman.h | 4 +- arch/x86/Kconfig | 24 ++ arch/x86/Kconfig.assembler | 5 + arch/x86/ia32/ia32_signal.c | 25 +- arch/x86/include/asm/cet.h | 53 +++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/disabled-features.h | 8 +- arch/x86/include/asm/elf.h | 11 + arch/x86/include/asm/fpu/types.h | 23 +- arch/x86/include/asm/fpu/xstate.h | 6 +- arch/x86/include/asm/idtentry.h | 4 + arch/x86/include/asm/mman.h | 88 ++++ arch/x86/include/asm/mmu_context.h | 3 + arch/x86/include/asm/msr-index.h | 20 + arch/x86/include/asm/page_types.h | 7 + arch/x86/include/asm/pgtable.h | 300 ++++++++++++-- arch/x86/include/asm/pgtable_types.h | 48 ++- arch/x86/include/asm/processor.h | 5 + arch/x86/include/asm/special_insns.h | 30 ++ arch/x86/include/asm/trap_pf.h | 2 + arch/x86/include/uapi/asm/mman.h | 28 +- arch/x86/include/uapi/asm/prctl.h | 4 + arch/x86/include/uapi/asm/processor-flags.h | 2 + arch/x86/kernel/Makefile | 2 + arch/x86/kernel/cet_prctl.c | 60 +++ arch/x86/kernel/cpu/common.c | 14 + arch/x86/kernel/cpu/cpuid-deps.c | 2 + arch/x86/kernel/fpu/xstate.c | 11 +- arch/x86/kernel/idt.c | 4 + arch/x86/kernel/process.c | 21 +- arch/x86/kernel/process_64.c | 27 ++ arch/x86/kernel/shstk.c | 377 ++++++++++++++++++ arch/x86/kernel/signal.c | 13 + arch/x86/kernel/signal_compat.c | 2 +- arch/x86/kernel/traps.c | 62 +++ arch/x86/mm/fault.c | 19 + arch/x86/mm/mmap.c | 48 +++ arch/x86/mm/pat/set_memory.c | 2 +- arch/x86/mm/pgtable.c | 25 ++ drivers/gpu/drm/i915/gvt/gtt.c | 2 +- fs/aio.c | 2 +- fs/binfmt_elf.c | 4 + fs/proc/task_mmu.c | 3 + include/linux/elf.h | 6 + include/linux/mm.h | 20 +- include/linux/mman.h | 2 +- include/linux/pgtable.h | 7 + include/uapi/asm-generic/siginfo.h | 3 +- include/uapi/linux/elf.h | 14 + ipc/shm.c | 2 +- mm/gup.c | 16 +- mm/huge_memory.c | 27 +- mm/memory.c | 5 +- mm/migrate.c | 3 +- mm/mmap.c | 17 +- mm/mprotect.c | 11 +- mm/nommu.c | 4 +- mm/util.c | 2 +- 64 files changed, 1583 insertions(+), 115 deletions(-) create mode 100644 Documentation/x86/intel_cet.rst create mode 100644 arch/x86/include/asm/cet.h create mode 100644 arch/x86/include/asm/mman.h create mode 100644 arch/x86/kernel/cet_prctl.c create mode 100644 arch/x86/kernel/shstk.c -- 2.21.0