Re: [RFC PATCH v3 18/24] x86/cet/shstk: User-mode shadow stack support

[Yu-cheng Yu]

On Thu, 2018-08-30 at 18:10 +0200, Jann Horn wrote:
> On Thu, Aug 30, 2018 at 4:44 PM Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx>
> wrote:
> > 
> > 
> > This patch adds basic shadow stack enabling/disabling routines.
> > A task's shadow stack is allocated from memory with VM_SHSTK
> > flag set and read-only protection.ÂÂThe shadow stack is
> > allocated to a fixed size of RLIMIT_STACK.
> > 
> > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx>
> [...]
> > 
> > +static int set_shstk_ptr(unsigned long addr)
> > +{
> > +ÂÂÂÂÂÂÂu64 r;
> > +
> > +ÂÂÂÂÂÂÂif (!cpu_feature_enabled(X86_FEATURE_SHSTK))
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂreturn -1;
> > +
> > +ÂÂÂÂÂÂÂif ((addr >= TASK_SIZE_MAX) || (!IS_ALIGNED(addr, 4)))
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂreturn -1;
> > +
> > +ÂÂÂÂÂÂÂrdmsrl(MSR_IA32_U_CET, r);
> > +ÂÂÂÂÂÂÂwrmsrl(MSR_IA32_PL3_SSP, addr);
> > +ÂÂÂÂÂÂÂwrmsrl(MSR_IA32_U_CET, r | MSR_IA32_CET_SHSTK_EN);
> > +ÂÂÂÂÂÂÂreturn 0;
> > +}
> Here's a really stupid question: Where is the logic for switching
> those MSRs on task switch? MSR_IA32_PL3_SSP contains a userspace
> pointer, so it has to be switched on task switch, right? I'm sure
> I'm
> missing something obvious, but grepping for places that set
> MSR_IA32_PL3_SSP to nonzero values through the entire patchset, I
> only
> see set_shstk_ptr(), which is called from:
> 
> Â- cet_setup_shstk() (called from arch_setup_features(), which is
> called from load_elf_binary())
> Â- cet_restore_signal() (called on signal handler return)
> Â- cet_setup_signal() (called from signal handling code)

The MSR is in the XSAVES buffer and switched by XSAVES/XRSTORS.

Yu-cheng