From nobody Mon May 20 17:49:20 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1683734716; cv=none; d=zohomail.com; s=zohoarc; b=Z8akJ3EKzgzrsv7n+Bo0+LYAhmLV1QB1lRIKRbxvLhYqHe167SCmpHOkbFHOSIqLdAHDDchCmxV6o/W/KLe+sXfjH4YTjXWsv21WqmH9Mm0YsBx5H0rFpq7MX/5pqtUaG5vUHIT7XGMIC+MLast4Axs1M/5ZYph9cPD/8i/aClg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1683734716; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=0i0pyo1eojjJCUnANfMoxPgp4XIF4q+7+aKWreDoslg=; b=Jbu3478t1tlad87K38Op2dp0BRdLLEuoc6DFWrrIVhnkYixhEl7F631sUpDsY6IjbsCIBkBk4C/pix4FfwjN5aBDAKjgIUNrQToEdv2/JLcaUKDfuzOM3Plh3XeO5ZSOmWf7uwKTA2Zrux+Y9YQ7YjS8Jfkm+F6hDnbSZAxJWy0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1683734715940928.9239739883343; Wed, 10 May 2023 09:05:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pwmJS-0004lF-Rn; Wed, 10 May 2023 12:05:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pwmJF-0004bo-33 for qemu-devel@nongnu.org; Wed, 10 May 2023 12:05:00 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pwmJ9-0006zf-LO for qemu-devel@nongnu.org; Wed, 10 May 2023 12:04:53 -0400 Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-531-HcJsd4kDN3iOkwbX-bplEw-1; Wed, 10 May 2023 12:04:47 -0400 Received: by mail-ed1-f72.google.com with SMTP id 4fb4d7f45d1cf-50bd7555c6eso6895131a12.1 for ; Wed, 10 May 2023 09:04:47 -0700 (PDT) Received: from [192.168.10.118] ([2001:b07:6468:f312:9af8:e5f5:7516:fa89]) by smtp.gmail.com with ESMTPSA id hf27-20020a1709072c5b00b0096557203071sm2823287ejc.217.2023.05.10.09.04.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 May 2023 09:04:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1683734689; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0i0pyo1eojjJCUnANfMoxPgp4XIF4q+7+aKWreDoslg=; b=Z8xknmunONDXsTlqjvM3iw7Db3a0pM3nL7cxALX8FihWA4MTZSn77tCQuL9bvpSFDtzq52 qB0YoT6dI1o68xVTfPzKd/twTkzkb7ViuQWdStcV+IOElPRTu6av6F1IiACGEY7+mi36mi cObF4u5hsFPYIgtR36YZO57sRT9DOQw= X-MC-Unique: HcJsd4kDN3iOkwbX-bplEw-1 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683734685; x=1686326685; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0i0pyo1eojjJCUnANfMoxPgp4XIF4q+7+aKWreDoslg=; b=eHLyvK5eieKTgpzt8uwJyvjrP04MJOmOeZKfvg9bVeVlz/O60/UoBC5qv8pCTwoU+V 0MAwdv5vN2Ha5X7EGSz645Af1QxMEzn8XytXRUVK8GenioLg/xMrDKtkl6sNSKajheo4 +Z2B0FljaEXGy+XIiYfUo4YNRtUpowL5gSZYYsRdbqTYM1nI+Lakra97BlkhZQy/vVni zB8hAJLe7D0hTKXnwqTJLZYo3w3qQviY+qaA/VQ1KhXq/qDVHNkjmuUD7T7pCX4k+LkQ ORsU7NoJoSacxC+LHEAT57KtG7iR1E8KTjlmaDDGTA9Mkff7cWVRHam+0fTVwo4/rY2H k5qw== X-Gm-Message-State: AC+VfDzAYpysZeEOnLWhVIM8IvgmRwagvQV766x87zDca+M97fDRw8s3 jZSveLpuEIfMkIAdubB29iX6WnnX0PVG/OxWCwqCIqC2pMMBvB1WWK711a7Xdm/a16f2x6+O5bY ZKdZMZserK5A3V5su9KaRx0XnOM0YpHqeL5XayKxnapj0JC796H4indXwWqiNH9nrP5hjcpv0D3 M= X-Received: by 2002:a17:906:4fc3:b0:965:c42d:ac59 with SMTP id i3-20020a1709064fc300b00965c42dac59mr15392008ejw.14.1683734685249; Wed, 10 May 2023 09:04:45 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6yPzlCUY2fXgOHDsEuVRjt/HPRnijS3HSqyC5D6+E2ECmcE4xygCLiuwE+DgxoLB2nx3Gdsg== X-Received: by 2002:a17:906:4fc3:b0:965:c42d:ac59 with SMTP id i3-20020a1709064fc300b00965c42dac59mr15391990ejw.14.1683734684845; Wed, 10 May 2023 09:04:44 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Cc: richard.henderson@linaro.org Subject: [PATCH] coroutine-asm: add x86 CET shadow stack support Date: Wed, 10 May 2023 18:04:41 +0200 Message-Id: <20230510160441.1249170-2-pbonzini@redhat.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230510160441.1249170-1-pbonzini@redhat.com> References: <20230510160441.1249170-1-pbonzini@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=pbonzini@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1683734716353100001 Content-Type: text/plain; charset="utf-8" Signed-off-by: Paolo Bonzini --- meson.build | 16 +++++++-- util/coroutine-asm.c | 82 ++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 93 insertions(+), 5 deletions(-) diff --git a/meson.build b/meson.build index 0121ccab78dd..17e4a3bc582e 100644 --- a/meson.build +++ b/meson.build @@ -328,6 +328,10 @@ elif coroutine_backend not in supported_backends .format(coroutine_backend, ', '.join(supported_backends))) endif =20 +if cfi_mode =3D=3D 'hw' and coroutine_backend !=3D 'asm' + error('Hardware control-flow integrity requires the "asm" coroutine back= end.') +endif + # Compiles if SafeStack *not* enabled safe_stack_probe =3D ''' int main(void) @@ -469,16 +473,22 @@ if cfi_mode =3D=3D 'sw' endif endif elif cfi_mode in ['hw', 'auto'] - if cfi_mode =3D=3D 'hw' - error('Hardware CFI is not supported yet') + if cpu in ['x86', 'x86_64'] + cfi_flags +=3D cc.get_supported_arguments('-fcf-protection=3Dfull') + if cfi_mode =3D=3D 'hw' + error('C compiler does not support -fcf-protection') + endif + elif cfi_mode =3D=3D 'hw' + error('Hardware CFI is only supported on x86') endif if cfi_flags =3D=3D [] and cfi_mode =3D=3D 'auto' cfi_mode =3D 'disabled' endif endif -if cpu in ['x86', 'x86_64'] +if cpu in ['x86', 'x86_64'] and cfi_mode !=3D 'hw' cfi_flags +=3D cc.get_supported_arguments('-fcf-protection=3Dbranch') endif + add_global_arguments(cfi_flags, native: false, language: all_languages) add_global_link_arguments(cfi_flags, native: false, language: all_language= s) =20 diff --git a/util/coroutine-asm.c b/util/coroutine-asm.c index a06ecbcb0a07..771b1d4a0fc9 100644 --- a/util/coroutine-asm.c +++ b/util/coroutine-asm.c @@ -22,6 +22,13 @@ #include "qemu/osdep.h" #include "qemu-common.h" #include "qemu/coroutine_int.h" +#include "qemu/error-report.h" + +#ifdef CONFIG_CF_PROTECTION +#include +#include +int arch_prctl(int code, unsigned long addr); +#endif =20 #ifdef CONFIG_VALGRIND_H #include @@ -39,10 +46,14 @@ typedef struct { Coroutine base; void *sp; + void *ssp; =20 void *stack; size_t stack_size; =20 + /* x86: CET shadow stack */ + void *sstack; + size_t sstack_size; #ifdef CONFIG_VALGRIND_H unsigned int valgrind_stack_id; #endif @@ -77,6 +88,35 @@ static void start_switch_fiber(void **fake_stack_save, #endif } =20 +static bool have_sstack(void) +{ +#if defined CONFIG_CF_PROTECTION && defined __x86_64__ + uint64_t ssp; + asm ("xor %0, %0; rdsspq %0\n" : "=3Dr" (ssp)); + return !!ssp; +#else + return 0; +#endif +} + +static void *alloc_sstack(size_t sz) +{ +#if defined CONFIG_CF_PROTECTION && defined __x86_64__ +#ifndef ARCH_X86_CET_ALLOC_SHSTK +#define ARCH_X86_CET_ALLOC_SHSTK 0x3004 +#endif + + uint64_t arg =3D sz; + if (arch_prctl(ARCH_X86_CET_ALLOC_SHSTK, (unsigned long) &arg) < 0) { + abort(); + } + + return (void *)arg; +#else + abort(); +#endif +} + #ifdef __x86_64__ /* * We hardcode all operands to specific registers so that we can write dow= n all the @@ -88,6 +128,26 @@ static void start_switch_fiber(void **fake_stack_save, * Note that push and call would clobber the red zone. Makefile.objs comp= iles this * file with -mno-red-zone. The alternative is to subtract/add 128 bytes = from rsp * around the switch, with slightly lower cache performance. + * + * The RSTORSSP and SAVEPREVSSP instructions are intricate. In a nutshell= they are: + * + * RSTORSSP(mem): oldSSP =3D SSP + * SSP =3D mem + * *SSP =3D oldSSP + * + * SAVEPREVSSP: oldSSP =3D shadow_stack_pop() + * *(oldSSP - 8) =3D oldSSP # "push" to old s= hadow stack + * + * Therefore, RSTORSSP(mem) followed by SAVEPREVSSP is the same as + * + * shadow_stack_push(SSP) + * SSP =3D mem + * shadow_stack_pop() + * + * From the simplified description you can see that co->ssp, being stored = before + * the RSTORSSP+SAVEPREVSSP sequence, points to the top actual entry of th= e shadow + * stack, not to the restore token. Hence we use an offset of -8 in the o= perand + * of rstorssp. */ #define CO_SWITCH(from, to, action, jump) ({ = \ int action_ =3D action; = \ @@ -100,7 +160,15 @@ static void start_switch_fiber(void **fake_stack_save, "jmp 2f\n" /* switch back continues at la= bel 2 */ \ = \ "1: .cfi_adjust_cfa_offset 8\n" = \ - "movq %%rsp, %c[SP](%[FROM])\n" /* save source SP */ = \ + "xor %%rbp, %%rbp\n" /* use old frame pointer as sc= ratch reg */ \ + "rdsspq %%rbp\n" = \ + "test %%rbp, %%rbp\n" /* if CET is enabled... */ = \ + "jz 9f\n" = \ + "movq %%rbp, %c[SSP](%[FROM])\n" /* ... save source shadow SP, = */ \ + "movq %c[SSP](%[TO]), %%rbp\n" /* restore destination shadow = stack, */ \ + "rstorssp -8(%%rbp)\n" = \ + "saveprevssp\n" /* and save source shadow SP t= oken */ \ + "9: movq %%rsp, %c[SP](%[FROM])\n" /* save source SP */ = \ "movq %c[SP](%[TO]), %%rsp\n" /* load destination SP */ = \ jump "\n" /* coroutine switch */ = \ = \ @@ -108,7 +176,8 @@ static void start_switch_fiber(void **fake_stack_save, "popq %%rbp\n" = \ ".cfi_adjust_cfa_offset -8\n" = \ : "+a" (action_), [FROM] "+b" (from_), [TO] "+D" (to_) = \ - : [SP] "i" (offsetof(CoroutineAsm, sp)) = \ + : [SP] "i" (offsetof(CoroutineAsm, sp)), = \ + [SSP] "i" (offsetof(CoroutineAsm, ssp)) = \ : "rcx", "rdx", "rsi", "r8", "r9", "r10", "r11", "r12", "r13", "r1= 4", "r15", \ "memory"); = \ action_; = \ @@ -141,6 +210,12 @@ Coroutine *qemu_coroutine_new(void) co->stack =3D qemu_alloc_stack(&co->stack_size); co->sp =3D co->stack + co->stack_size; =20 + if (have_sstack()) { + co->sstack_size =3D COROUTINE_SHADOW_STACK_SIZE; + co->sstack =3D alloc_sstack(co->sstack_size); + co->ssp =3D co->sstack + co->sstack_size; + } + #ifdef CONFIG_VALGRIND_H co->valgrind_stack_id =3D VALGRIND_STACK_REGISTER(co->stack, co->stack + co->stack_size); @@ -186,6 +261,9 @@ void qemu_coroutine_delete(Coroutine *co_) #endif =20 qemu_free_stack(co->stack, co->stack_size); + if (co->sstack) { + munmap(co->sstack, co->sstack_size); + } g_free(co); } =20 --=20 2.40.1