From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3311CC433B4 for ; Fri, 9 Apr 2021 23:47:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C0B4B610CD for ; Fri, 9 Apr 2021 23:47:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C0B4B610CD Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 3E0B96B0036; Fri, 9 Apr 2021 19:47:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 390136B006E; Fri, 9 Apr 2021 19:47:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 209C86B0070; Fri, 9 Apr 2021 19:47:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0118.hostedemail.com [216.40.44.118]) by kanga.kvack.org (Postfix) with ESMTP id 06FCD6B0036 for ; Fri, 9 Apr 2021 19:47:35 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id A77C8824805A for ; Fri, 9 Apr 2021 23:47:34 +0000 (UTC) X-FDA: 78014468028.24.4839C23 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by imf17.hostedemail.com (Postfix) with ESMTP id DBCE040002C8 for ; Fri, 9 Apr 2021 23:47:31 +0000 (UTC) IronPort-SDR: Z2aLDO4dhtQ1k8o5p253VTFUTAqOUqekty6Q8LWEcHR9bhisMsO7fgANRIMYucryFYxSN+X4dH NwSMPejZFGNg== X-IronPort-AV: E=McAfee;i="6000,8403,9949"; a="193409674" X-IronPort-AV: E=Sophos;i="5.82,210,1613462400"; d="scan'208";a="193409674" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2021 16:47:23 -0700 IronPort-SDR: 7kkS8Wxc9BTdMnvBz67vi/4ovTt7qmo8Sx/XhHsJNzLbHt5HqfH+DEzabiA6I67db98dmOCI/G QyDmN3Xu1ijQ== X-IronPort-AV: E=Sophos;i="5.82,210,1613462400"; d="scan'208";a="416470774" Received: from yyu32-mobl1.amr.corp.intel.com (HELO [10.212.27.140]) ([10.212.27.140]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2021 16:47:22 -0700 Subject: Re: [PATCH v24 22/30] x86/cet/shstk: Add user-mode shadow stack support To: "Kirill A. Shutemov" Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , Haitao Huang References: <20210401221104.31584-1-yu-cheng.yu@intel.com> <20210401221104.31584-23-yu-cheng.yu@intel.com> <20210409155711.kxf3fjc7csvqpl33@box.shutemov.name> From: "Yu, Yu-cheng" Message-ID: Date: Fri, 9 Apr 2021 16:47:21 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 In-Reply-To: <20210409155711.kxf3fjc7csvqpl33@box.shutemov.name> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: DBCE040002C8 X-Stat-Signature: 5e5q7qkht98h1nuwnjcdm7e7g8kref4s Received-SPF: none (intel.com>: No applicable sender policy available) receiver=imf17; identity=mailfrom; envelope-from=""; helo=mga14.intel.com; client-ip=192.55.52.115 X-HE-DKIM-Result: none/none X-HE-Tag: 1618012051-106957 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 4/9/2021 8:57 AM, Kirill A. Shutemov wrote: > On Thu, Apr 01, 2021 at 03:10:56PM -0700, Yu-cheng Yu wrote: >> Introduce basic shadow stack enabling/disabling/allocation routines. >> A task's shadow stack is allocated from memory with VM_SHADOW_STACK flag >> and has a fixed size of min(RLIMIT_STACK, 4GB). >> >> Signed-off-by: Yu-cheng Yu >> Cc: Kees Cook [...] >> diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c >> new file mode 100644 >> index 000000000000..5406fdf6df3c >> --- /dev/null >> +++ b/arch/x86/kernel/shstk.c >> @@ -0,0 +1,128 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * shstk.c - Intel shadow stack support >> + * >> + * Copyright (c) 2021, Intel Corporation. >> + * Yu-cheng Yu >> + */ >> + >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> + >> +static void start_update_msrs(void) >> +{ >> + fpregs_lock(); >> + if (test_thread_flag(TIF_NEED_FPU_LOAD)) >> + __fpregs_load_activate(); >> +} >> + >> +static void end_update_msrs(void) >> +{ >> + fpregs_unlock(); >> +} >> + >> +static unsigned long alloc_shstk(unsigned long size, int flags) >> +{ >> + struct mm_struct *mm = current->mm; >> + unsigned long addr, populate; >> + >> + /* VM_SHADOW_STACK requires MAP_ANONYMOUS, MAP_PRIVATE */ >> + flags |= MAP_ANONYMOUS | MAP_PRIVATE; > > Looks like all callers has flags == 0. Do I miss something. My earlier versions use this flag. I should have removed it. >> + >> + mmap_write_lock(mm); >> + addr = do_mmap(NULL, 0, size, PROT_READ, flags, VM_SHADOW_STACK, 0, >> + &populate, NULL); >> + mmap_write_unlock(mm); >> + >> + if (populate) >> + mm_populate(addr, populate); > > If all callers pass down flags==0, populate will never happen. I will fix it. >> + >> + return addr; >> +} >> + >> +int shstk_setup(void) >> +{ >> + unsigned long addr, size; >> + struct cet_status *cet = ¤t->thread.cet; >> + >> + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) >> + return -EOPNOTSUPP; >> + >> + size = round_up(min_t(unsigned long long, rlimit(RLIMIT_STACK), SZ_4G), PAGE_SIZE); >> + addr = alloc_shstk(size, 0); >> + if (IS_ERR_VALUE(addr)) >> + return PTR_ERR((void *)addr); >> + >> + cet->shstk_base = addr; >> + cet->shstk_size = size; >> + >> + start_update_msrs(); >> + wrmsrl(MSR_IA32_PL3_SSP, addr + size); >> + wrmsrl(MSR_IA32_U_CET, CET_SHSTK_EN); >> + end_update_msrs(); >> + return 0; >> +} >> + >> +void shstk_free(struct task_struct *tsk) >> +{ >> + struct cet_status *cet = &tsk->thread.cet; >> + >> + if (!cpu_feature_enabled(X86_FEATURE_SHSTK) || >> + !cet->shstk_size || >> + !cet->shstk_base) >> + return; >> + >> + if (!tsk->mm) >> + return; >> + >> + while (1) { >> + int r; >> + >> + r = vm_munmap(cet->shstk_base, cet->shstk_size); >> + >> + /* >> + * vm_munmap() returns -EINTR when mmap_lock is held by >> + * something else, and that lock should not be held for a >> + * long time. Retry it for the case. >> + */ > > Hm, no. -EINTR is not about the lock being held by somebody else. The task > got a signal and need to return to userspace. From tracing the code itself, it looks like it cannot acquire the lock. Let me dig into it. > I have not looked at the rest of the patches yet, but why do you need a > special free path for shadow stack? Why the normal unmap route doesn't > work for you? The thread's shadow stack is allocated by the kernel, so it needs to be freed when the thread exits. >> + if (r == -EINTR) { >> + cond_resched(); >> + continue; >> + } >> + break; >> + } >> + >> + cet->shstk_base = 0; >> + cet->shstk_size = 0; >> +} >> + [...] Thanks, Yu-cheng