[PATCH 11/17] x86/cet: Sync with Linux kernel 6.6 shadow stack interface

[Szabolcs Nagy]

The 12/12/2023 10:39, H.J. Lu wrote:
> On Tue, Dec 12, 2023 at 10:03 AM Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
> >
> > The 12/11/2023 08:44, H.J. Lu wrote:
> > > On Mon, Dec 11, 2023 at 3:34 AM Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
> > > > The 12/06/2023 09:20, H.J. Lu wrote:
> > > > > Sync with Linux kernel 6.6 shadow stack interface.  Since only x86-64 is
> > > > > supported, i386 shadow stack codes are unchanged and CET shouldn't be
> > > > > enabled for i386.
> > > > >
> > > > > 1. When the shadow stack base in TCB is unset, the default shadow stack
> > > > > is in use.  Use the current shadow stack pointer as the marker for the
> > > > > default shadow stack.
> > > >
> > > > what is the role of ssp_base in the tcb?
> > >
> > > It is used to identify if the current stack is the same as the target
> > > shadow stack when switching ucontexts.  If yes, INCSSP will
> > > be used to unwind shadow stack.  Otherwise, shadow stack
> > > restore token will be used.
> >
> > i would like to support stack switching in longjmp too
> > (for aarch64 gcs) not just in setcontext/swapcontext.
> >
> > if you assume that the target shadow stack always ends in a
> > restore token when a jump is switching stack, then scanning
> > the shadow stack until the token or current ssp is found works.
> > (tcb ssp_base is not needed.)
> 
> We can't put a restore token on shadow stack for setjmp since
> longjmp is optional, not required.  If longjmp isn't called, there
> will be an extra restore token on shadow stack.  One way to
> switch arbitrary shadow stack is to allow write shadow stack,
> which will reduce security.
> 

setjmp never switches stacks, so it must not place a token.

only stack switching operations need to place tokens.

longjmp cannot target arbitrary setjmp that happened on another
stack: if that stack is still in use by another thread then the
two threads clobber each other's stack. it can only work if that
stack is switched away from and at that point a token was placed.
we can make this the abi: you can only longjmp to a stack which
is switched away from such that a token is placed on it.

in terms of conformance i belive we only need the incssp case,
anything else is qoi extension, but such extensions are used in
practice, e.g. for longjmp between stacks created by makecontext.

> > the linear scanning affects longjmp performance but it seems
> > the overhead is amortized by the creation of the stack frames.
> >
> > if you don't want this in longjmp, then code using it for task
> > scheduling across worker threads have to be patched to use
> > *context (means signal mask saving syscall overhead so some
> > projects may not like this) or marked as non-shadow-stack compat.
> >
> 
> 
> -- 
> H.J.