Re: [PATCH v2 33/39] x86/cpufeatures: Limit shadow stack to Intel CPUs
From: John Allen <john.allen@amd.com>
Date: 2022-10-04 19:43:36
Also in:
linux-arch, linux-doc, linux-mm, lkml
On 10/4/22 10:47 AM, Nathan Chancellor wrote:
Hi Kees, On Mon, Oct 03, 2022 at 09:54:26PM -0700, Kees Cook wrote:quoted
On Mon, Oct 03, 2022 at 05:09:04PM -0700, Dave Hansen wrote:quoted
On 10/3/22 16:57, Kees Cook wrote:quoted
On Thu, Sep 29, 2022 at 03:29:30PM -0700, Rick Edgecombe wrote:quoted
Shadow stack is supported on newer AMD processors, but the kernel implementation has not been tested on them. Prevent basic issues from showing up for normal users by disabling shadow stack on all CPUs except Intel until it has been tested. At which point the limitation should be removed. Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>So running the selftests on an AMD system is sufficient to drop this patch?Yes, that's enough. I _thought_ the AMD folks provided some tested-by's at some point in the past. But, maybe I'm confusing this for one of the other shared features. Either way, I'm sure no tested-by's were dropped on purpose. I'm sure Rick is eager to trim down his series and this would be a great patch to drop. Does anyone want to make that easy for Rick? <hint> <hint>Hey Gustavo, Nathan, or Nick! I know y'all have some fancy AMD testing rigs. Got a moment to spin up this series and run the selftests? :)I do have access to a system with an EPYC 7513, which does have Shadow Stack support (I can see 'shstk' in the "Flags" section of lscpu with this series). As far as I understand it, AMD only added Shadow Stack with Zen 3; my regular AMD test system is Zen 2 (probably should look at procurring a Zen 3 or Zen 4 one at some point). I applied this series on top of 6.0 and reverted this change then booted it on that system. After building the selftest (which did require 'make headers_install' and a small addition to make it build beyond that, see below), I ran it and this was the result. I am not sure if that is expected or not but the other results seem promising for dropping this patch. $ ./test_shadow_stack_64 [INFO] new_ssp = 7f8a36c9fff8, *new_ssp = 7f8a36ca0001 [INFO] changing ssp from 7f8a374a0ff0 to 7f8a36c9fff8 [INFO] ssp is now 7f8a36ca0000 [OK] Shadow stack pivot [OK] Shadow stack faults [INFO] Corrupting shadow stack [INFO] Generated shadow stack violation successfully [OK] Shadow stack violation test [INFO] Gup read -> shstk access success [INFO] Gup write -> shstk access success [INFO] Violation from normal write [INFO] Gup read -> write access success [INFO] Violation from normal write [INFO] Gup write -> write access success [INFO] Cow gup write -> write access success [OK] Shadow gup test [INFO] Violation from shstk access [OK] mprotect() test [OK] Userfaultfd test [FAIL] Alt shadow stack test
The selftest is looking OK on my system (Dell PowerEdge R6515 w/ EPYC 7713). I also just pulled a fresh 6.0 kernel and applied the series including the fix Nathan mentions below. $ tools/testing/selftests/x86/test_shadow_stack_64 [INFO] new_ssp = 7f30cccc5ff8, *new_ssp = 7f30cccc6001 [INFO] changing ssp from 7f30cd4c6ff0 to 7f30cccc5ff8 [INFO] ssp is now 7f30cccc6000 [OK] Shadow stack pivot [OK] Shadow stack faults [INFO] Corrupting shadow stack [INFO] Generated shadow stack violation successfully [OK] Shadow stack violation test [INFO] Gup read -> shstk access success [INFO] Gup write -> shstk access success [INFO] Violation from normal write [INFO] Gup read -> write access success [INFO] Violation from normal write [INFO] Gup write -> write access success [INFO] Cow gup write -> write access success [OK] Shadow gup test [INFO] Violation from shstk access [OK] mprotect() test [OK] Userfaultfd test [OK] Alt shadow stack test.
quoted hunk ↗ jump to hunk
$ echo $? 1 I am happy to provide any information that would be useful for exploring this failure and test further iterations of this series as necessary. Cheers, Nathan test_shadow_stack.c: In function ‘create_shstk’: test_shadow_stack.c:86:70: error: ‘SHADOW_STACK_SET_TOKEN’ undeclared (first use in this function) 86 | return (void *)syscall(__NR_map_shadow_stack, addr, SS_SIZE, SHADOW_STACK_SET_TOKEN); | ^~~~~~~~~~~~~~~~~~~~~~ test_shadow_stack.c:86:70: note: each undeclared identifier is reported only once for each function it appears in test_shadow_stack.c:87:1: warning: control reaches end of non-void function [-Wreturn-type] 87 | } | ^diff --git a/tools/testing/selftests/x86/test_shadow_stack.c b/tools/testing/selftests/x86/test_shadow_stack.c index 22b856de5cdd..958dbb248518 100644 --- a/tools/testing/selftests/x86/test_shadow_stack.c +++ b/tools/testing/selftests/x86/test_shadow_stack.c@@ -11,6 +11,7 @@ #define _GNU_SOURCE #include <sys/syscall.h> +#include <asm/mman.h> #include <sys/mman.h> #include <sys/stat.h> #include <sys/wait.h>