Re: [PATCH v6 1/6] x86/cet: Sync with Linux kernel 6.6 shadow stack interface

["H.J. Lu" <hjl.tools@gmail.com>]

On Wed, Jan 3, 2024 at 11:21 AM Adhemerval Zanella Netto
<adhemerval.zanella@linaro.org> wrote:
>
>
>
> On 29/12/23 13:43, H.J. Lu wrote:
> > Sync with Linux kernel 6.6 shadow stack interface.  Since only x86-64 is
> > supported, i386 shadow stack codes are unchanged and CET shouldn't be
> > enabled for i386.
> >
> > 1. When the shadow stack base in TCB is unset, the default shadow stack
> > is in use.  Use the current shadow stack pointer as the marker for the
> > default shadow stack. It is used to identify if the current shadow stack
> > is the same as the target shadow stack when switching ucontexts.  If yes,
> > INCSSP will be used to unwind shadow stack.  Otherwise, shadow stack
> > restore token will be used.
> > 2. Allocate shadow stack with the map_shadow_stack syscall.  Since there
> > is no function to explicitly release ucontext, there is no place to
> > release shadow stack allocated by map_shadow_stack in ucontext functions.
> > Such shadow stacks will be leaked.
> > 3. Rename arch_prctl CET commands to ARCH_SHSTK_XXX.
> > 4. Rewrite the CET control functions with the current kernel shadow stack
> > interface.
> >
> > Since CET is no longer enabled by kernel, a separate patch will enable
> > shadow stack during startup.
> > ---
>
> > diff --git a/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h b/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h
> > index 45ad0b052f..2f511321ad 100644
> > --- a/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h
> > +++ b/sysdeps/unix/sysv/linux/x86/include/asm/prctl.h
> > @@ -4,24 +4,19 @@
> >
> >  #include_next <asm/prctl.h>
> >
> > -#ifndef ARCH_CET_STATUS
> > -/* CET features:
> > -   IBT:   GNU_PROPERTY_X86_FEATURE_1_IBT
> > -   SHSTK: GNU_PROPERTY_X86_FEATURE_1_SHSTK
> > - */
> > -/* Return CET features in unsigned long long *addr:
> > -     features: addr[0].
> > -     shadow stack base address: addr[1].
> > -     shadow stack size: addr[2].
> > - */
> > -# define ARCH_CET_STATUS     0x3001
> > -/* Disable CET features in unsigned int features.  */
> > -# define ARCH_CET_DISABLE    0x3002
> > -/* Lock all CET features.  */
> > -# define ARCH_CET_LOCK               0x3003
> > -/* Allocate a new shadow stack with unsigned long long *addr:
> > -     IN: requested shadow stack size: *addr.
> > -     OUT: allocated shadow stack address: *addr.
> > - */
> > -# define ARCH_CET_ALLOC_SHSTK        0x3004
>
> This broke i686 build with --enable-cet:
>
> ld: [...]libc_pic.os.clean: warning: relocation against `ARCH_CET_ALLOC_SHSTK' in read-only section `.text'
> [...]
> ld: /home/azanella/Projects/glibc/build/i686-linux-gnu/libc_pic.os.clean: in function `getcontext':
> [...]/glibc-git/stdlib/../sysdeps/unix/sysv/linux/i386/getcontext.S:65:(.text+0x1e12c): undefined reference to `ARCH_CET_STATUS'
> [...]
>
> Which leads the question whether CET is really supported on i386.  The
> commit message is not clear, the 'CET shouldn't be enabled for i386'
> leads to the idea that --enable-cet should not be used for i686 and/or
> is not supported. Is this the case?

Yes.

> If so, should we make --eanble-cet x86_64 only and remove the previous
> i686 support (such as 5d844e1b72513cf59b5e7c14295644efdcc66e44)?

We can move --enable-cet to x86_64.   There are many i386 CET bits.
I think we should leave them alone for now.


-- 
H.J.