From nobody Mon May 20 21:31:21 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1683734658; cv=none; d=zohomail.com; s=zohoarc; b=Q+/WdWx9TKtNnsr+au5s2Xm39PTCzaQxmTvcm/MchINiQroS6G329y/tpvxTmanK7HV4JQFP3LLA4D2V+wiQ4BB7oJ9lhSFuJHx3hfEbte0KtS68mn+/DaGcpDDZj/dJL13lYJg+IkKNlcot0nDDNlzeWGuk41ulcHq5vZutwjM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1683734658; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=0i0pyo1eojjJCUnANfMoxPgp4XIF4q+7+aKWreDoslg=; b=Z9pMNUvB3kiq4WIrjP3/XlYr79xcJVWS4lJyhIgs2iU/WBGH/uxPYJzbReVhaLADq7O34i2PJyQJp0elo40K9MdGff8L5vd2Dh8cE2Gmzqf5C5uP52Zoxkt7+cAe4u9LFyT6Zk1SGPREgo1ZR1GE5eUbdZG42EgcM25lAR1fKOY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1683734658145640.8395361266727; Wed, 10 May 2023 09:04:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pwmIH-0003WS-TW; Wed, 10 May 2023 12:03:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pwmIG-0003WC-Bi for qemu-devel@nongnu.org; Wed, 10 May 2023 12:03:56 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pwmIE-0006rG-Kr for qemu-devel@nongnu.org; Wed, 10 May 2023 12:03:56 -0400 Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-661-9bIcsiQ6OVyKWnvL5hksxQ-1; Wed, 10 May 2023 12:03:52 -0400 Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-50d89279d95so14427248a12.1 for ; Wed, 10 May 2023 09:03:51 -0700 (PDT) Received: from [192.168.10.118] ([2001:b07:6468:f312:9af8:e5f5:7516:fa89]) by smtp.gmail.com with ESMTPSA id v9-20020a170906380900b0094e1344ddfdsm2802724ejc.34.2023.05.10.09.03.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 May 2023 09:03:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1683734633; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0i0pyo1eojjJCUnANfMoxPgp4XIF4q+7+aKWreDoslg=; b=fsYdydSyrIoYKTQ3KN9UCsKkPzzZ0AkZJdixuJ2WEX3wdCDmJ8OyQKrzpdQPBQOfu1Vd1w shTzjIG6c9GDoAPADx8B4tHxi+6vlrN9xP4lDJucWqom6zzPLqNLi97aliNzhi9/mKs9d6 Fv6Pcy5wNxSDo937ROROBkBQzi+rSeE= X-MC-Unique: 9bIcsiQ6OVyKWnvL5hksxQ-1 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683734630; x=1686326630; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0i0pyo1eojjJCUnANfMoxPgp4XIF4q+7+aKWreDoslg=; b=YMmCmFcvVYnWuTOrdmPrzGvBYA8509j+PMa4K4zlAZGjrufdUPVGn/2aDEGxLm4VaV I1lnUT94nVP0SKMMVu9TAHq4U2U3HqciNNuuxDpDdw/1Y3p0fh1i8q1e1JdAqWgFJ329 4n54q+jrsnfUNIxsNKVw2R0uNCJf2N0yCuqiU9TSyrVhVCMm6FJvUI9Gqw73mN4SLPym tldJFUj5dByjCFryI+3FbdPGZqjo9hHUFwxohZdYyFCVZ63G0DENhiBq/YrB51pNgtUl uu2o9sui/w+djvWTyOppadoF3TlZJzHPrG0hEBmLtUj5spTGmJB27CZxuTTvyg+Ndpow zwEg== X-Gm-Message-State: AC+VfDyTKzO1a8ZgwFajLoC0TB7N8/ekhIoJY8jVxdPlaOTVe+Fjdx32 +qPw2Zdq4Y6CZ1LWZ69WbgT4vyqR4mLSDrVdbLntujPzsOuOQVbq8QaO3mdkBu9XDxFS/+hiNSP +qi4grNHmLMv8+pnq4Nn/OLEg0Z6Crr7ykj007PSAvj/Onvq19TCt32HPc/B7mbPAeNgZpOA0fM c= X-Received: by 2002:a17:906:da8c:b0:94a:653b:ba41 with SMTP id xh12-20020a170906da8c00b0094a653bba41mr1751327ejb.15.1683734630307; Wed, 10 May 2023 09:03:50 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6JbaOhTNtGWiLE/pTxq9UfU4bUL1/mD0FYhDBBN9m7DY3ZnF4qoxZeD1OHkPeMUKHGXPGrXg== X-Received: by 2002:a17:906:da8c:b0:94a:653b:ba41 with SMTP id xh12-20020a170906da8c00b0094a653bba41mr1751284ejb.15.1683734629838; Wed, 10 May 2023 09:03:49 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Cc: richard.henderson@linaro.org Subject: [PATCH] coroutine-asm: add x86 CET shadow stack support Date: Wed, 10 May 2023 18:03:46 +0200 Message-Id: <20230510160346.1248626-2-pbonzini@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230510160346.1248626-1-pbonzini@redhat.com> References: <20230510160346.1248626-1-pbonzini@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=pbonzini@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1683734658655100001 Content-Type: text/plain; charset="utf-8" Signed-off-by: Paolo Bonzini --- meson.build | 16 +++++++-- util/coroutine-asm.c | 82 ++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 93 insertions(+), 5 deletions(-) diff --git a/meson.build b/meson.build index 0121ccab78dd..17e4a3bc582e 100644 --- a/meson.build +++ b/meson.build @@ -328,6 +328,10 @@ elif coroutine_backend not in supported_backends .format(coroutine_backend, ', '.join(supported_backends))) endif =20 +if cfi_mode =3D=3D 'hw' and coroutine_backend !=3D 'asm' + error('Hardware control-flow integrity requires the "asm" coroutine back= end.') +endif + # Compiles if SafeStack *not* enabled safe_stack_probe =3D ''' int main(void) @@ -469,16 +473,22 @@ if cfi_mode =3D=3D 'sw' endif endif elif cfi_mode in ['hw', 'auto'] - if cfi_mode =3D=3D 'hw' - error('Hardware CFI is not supported yet') + if cpu in ['x86', 'x86_64'] + cfi_flags +=3D cc.get_supported_arguments('-fcf-protection=3Dfull') + if cfi_mode =3D=3D 'hw' + error('C compiler does not support -fcf-protection') + endif + elif cfi_mode =3D=3D 'hw' + error('Hardware CFI is only supported on x86') endif if cfi_flags =3D=3D [] and cfi_mode =3D=3D 'auto' cfi_mode =3D 'disabled' endif endif -if cpu in ['x86', 'x86_64'] +if cpu in ['x86', 'x86_64'] and cfi_mode !=3D 'hw' cfi_flags +=3D cc.get_supported_arguments('-fcf-protection=3Dbranch') endif + add_global_arguments(cfi_flags, native: false, language: all_languages) add_global_link_arguments(cfi_flags, native: false, language: all_language= s) =20 diff --git a/util/coroutine-asm.c b/util/coroutine-asm.c index a06ecbcb0a07..771b1d4a0fc9 100644 --- a/util/coroutine-asm.c +++ b/util/coroutine-asm.c @@ -22,6 +22,13 @@ #include "qemu/osdep.h" #include "qemu-common.h" #include "qemu/coroutine_int.h" +#include "qemu/error-report.h" + +#ifdef CONFIG_CF_PROTECTION +#include +#include +int arch_prctl(int code, unsigned long addr); +#endif =20 #ifdef CONFIG_VALGRIND_H #include @@ -39,10 +46,14 @@ typedef struct { Coroutine base; void *sp; + void *ssp; =20 void *stack; size_t stack_size; =20 + /* x86: CET shadow stack */ + void *sstack; + size_t sstack_size; #ifdef CONFIG_VALGRIND_H unsigned int valgrind_stack_id; #endif @@ -77,6 +88,35 @@ static void start_switch_fiber(void **fake_stack_save, #endif } =20 +static bool have_sstack(void) +{ +#if defined CONFIG_CF_PROTECTION && defined __x86_64__ + uint64_t ssp; + asm ("xor %0, %0; rdsspq %0\n" : "=3Dr" (ssp)); + return !!ssp; +#else + return 0; +#endif +} + +static void *alloc_sstack(size_t sz) +{ +#if defined CONFIG_CF_PROTECTION && defined __x86_64__ +#ifndef ARCH_X86_CET_ALLOC_SHSTK +#define ARCH_X86_CET_ALLOC_SHSTK 0x3004 +#endif + + uint64_t arg =3D sz; + if (arch_prctl(ARCH_X86_CET_ALLOC_SHSTK, (unsigned long) &arg) < 0) { + abort(); + } + + return (void *)arg; +#else + abort(); +#endif +} + #ifdef __x86_64__ /* * We hardcode all operands to specific registers so that we can write dow= n all the @@ -88,6 +128,26 @@ static void start_switch_fiber(void **fake_stack_save, * Note that push and call would clobber the red zone. Makefile.objs comp= iles this * file with -mno-red-zone. The alternative is to subtract/add 128 bytes = from rsp * around the switch, with slightly lower cache performance. + * + * The RSTORSSP and SAVEPREVSSP instructions are intricate. In a nutshell= they are: + * + * RSTORSSP(mem): oldSSP =3D SSP + * SSP =3D mem + * *SSP =3D oldSSP + * + * SAVEPREVSSP: oldSSP =3D shadow_stack_pop() + * *(oldSSP - 8) =3D oldSSP # "push" to old s= hadow stack + * + * Therefore, RSTORSSP(mem) followed by SAVEPREVSSP is the same as + * + * shadow_stack_push(SSP) + * SSP =3D mem + * shadow_stack_pop() + * + * From the simplified description you can see that co->ssp, being stored = before + * the RSTORSSP+SAVEPREVSSP sequence, points to the top actual entry of th= e shadow + * stack, not to the restore token. Hence we use an offset of -8 in the o= perand + * of rstorssp. */ #define CO_SWITCH(from, to, action, jump) ({ = \ int action_ =3D action; = \ @@ -100,7 +160,15 @@ static void start_switch_fiber(void **fake_stack_save, "jmp 2f\n" /* switch back continues at la= bel 2 */ \ = \ "1: .cfi_adjust_cfa_offset 8\n" = \ - "movq %%rsp, %c[SP](%[FROM])\n" /* save source SP */ = \ + "xor %%rbp, %%rbp\n" /* use old frame pointer as sc= ratch reg */ \ + "rdsspq %%rbp\n" = \ + "test %%rbp, %%rbp\n" /* if CET is enabled... */ = \ + "jz 9f\n" = \ + "movq %%rbp, %c[SSP](%[FROM])\n" /* ... save source shadow SP, = */ \ + "movq %c[SSP](%[TO]), %%rbp\n" /* restore destination shadow = stack, */ \ + "rstorssp -8(%%rbp)\n" = \ + "saveprevssp\n" /* and save source shadow SP t= oken */ \ + "9: movq %%rsp, %c[SP](%[FROM])\n" /* save source SP */ = \ "movq %c[SP](%[TO]), %%rsp\n" /* load destination SP */ = \ jump "\n" /* coroutine switch */ = \ = \ @@ -108,7 +176,8 @@ static void start_switch_fiber(void **fake_stack_save, "popq %%rbp\n" = \ ".cfi_adjust_cfa_offset -8\n" = \ : "+a" (action_), [FROM] "+b" (from_), [TO] "+D" (to_) = \ - : [SP] "i" (offsetof(CoroutineAsm, sp)) = \ + : [SP] "i" (offsetof(CoroutineAsm, sp)), = \ + [SSP] "i" (offsetof(CoroutineAsm, ssp)) = \ : "rcx", "rdx", "rsi", "r8", "r9", "r10", "r11", "r12", "r13", "r1= 4", "r15", \ "memory"); = \ action_; = \ @@ -141,6 +210,12 @@ Coroutine *qemu_coroutine_new(void) co->stack =3D qemu_alloc_stack(&co->stack_size); co->sp =3D co->stack + co->stack_size; =20 + if (have_sstack()) { + co->sstack_size =3D COROUTINE_SHADOW_STACK_SIZE; + co->sstack =3D alloc_sstack(co->sstack_size); + co->ssp =3D co->sstack + co->sstack_size; + } + #ifdef CONFIG_VALGRIND_H co->valgrind_stack_id =3D VALGRIND_STACK_REGISTER(co->stack, co->stack + co->stack_size); @@ -186,6 +261,9 @@ void qemu_coroutine_delete(Coroutine *co_) #endif =20 qemu_free_stack(co->stack, co->stack_size); + if (co->sstack) { + munmap(co->sstack, co->sstack_size); + } g_free(co); } =20 --=20 2.40.1