On Thu, Sep 29, 2022 at 03:28:59PM -0700, Rick Edgecombe wrote: > From: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> > > Shadow Stack provides protection against function return address > corruption. It is active when the processor supports it, the kernel has > CONFIG_X86_SHADOW_STACK enabled, and the application is built for the > feature. This is only implemented for the 64-bit kernel. When it is > enabled, legacy non-Shadow Stack applications continue to work, but without > protection. > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> > Co-developed-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx> > Signed-off-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx> > Cc: Kees Cook <keescook@xxxxxxxxxxxx> > > --- > > v2: > - Remove already wrong kernel size increase info (tlgx) > - Change prompt to remove "Intel" (tglx) > - Update line about what CPUs are supported (Dave) > > Yu-cheng v25: > - Remove X86_CET and use X86_SHADOW_STACK directly. > > Yu-cheng v24: > - Update for the splitting X86_CET to X86_SHADOW_STACK and X86_IBT. > > arch/x86/Kconfig | 18 ++++++++++++++++++ > arch/x86/Kconfig.assembler | 5 +++++ > 2 files changed, 23 insertions(+) > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > index f9920f1341c8..b68eb75887b8 100644 > --- a/arch/x86/Kconfig > +++ b/arch/x86/Kconfig > @@ -26,6 +26,7 @@ config X86_64 > depends on 64BIT > # Options that are inherently 64-bit kernel only: > select ARCH_HAS_GIGANTIC_PAGE > + select ARCH_HAS_SHADOW_STACK > select ARCH_SUPPORTS_INT128 if CC_HAS_INT128 > select ARCH_USE_CMPXCHG_LOCKREF > select HAVE_ARCH_SOFT_DIRTY > @@ -1936,6 +1937,23 @@ config X86_SGX > > If unsure, say N. > > +config ARCH_HAS_SHADOW_STACK > + def_bool n > + > +config X86_SHADOW_STACK > + prompt "X86 Shadow Stack" > + def_bool n I hope we can switch this to "default y" soon, given it's a hardware feature that is disabled at runtime when not available. > + depends on ARCH_HAS_SHADOW_STACK Doesn't this depend on AS_WRUSS too? > + select ARCH_USES_HIGH_VMA_FLAGS > + help > + Shadow Stack protection is a hardware feature that detects function > + return address corruption. Today the kernel's support is limited to > + virtualizing it in KVM guests. > + > + CPUs supporting shadow stacks were first released in 2020. > + > + If unsure, say N. > + > config EFI > bool "EFI runtime service support" > depends on ACPI > diff --git a/arch/x86/Kconfig.assembler b/arch/x86/Kconfig.assembler > index 26b8c08e2fc4..00c79dd93651 100644 > --- a/arch/x86/Kconfig.assembler > +++ b/arch/x86/Kconfig.assembler > @@ -19,3 +19,8 @@ config AS_TPAUSE > def_bool $(as-instr,tpause %ecx) > help > Supported by binutils >= 2.31.1 and LLVM integrated assembler >= V7 > + > +config AS_WRUSS > + def_bool $(as-instr,wrussq %rax$(comma)(%rbx)) > + help > + Supported by binutils >= 2.31 and LLVM integrated assembler Otherwise, I don't see anything else using OCNFIG_AS_WRUSS: $ git grep AS_WRUSS arch/x86/Kconfig.assembler:config AS_WRUSS -Kees -- Kees Cook
