|
 |
e354a5 |
commit 5d844e1b72513cf59b5e7c14295644efdcc66e44
|
|
|
e354a5 |
Author: H.J. Lu <hjl.tools@gmail.com>
|
|
|
e354a5 |
Date: Fri Feb 14 14:45:34 2020 -0800
|
|
|
e354a5 |
|
|
|
e354a5 |
i386: Enable CET support in ucontext functions
|
|
|
e354a5 |
|
|
|
e354a5 |
1. getcontext and swapcontext are updated to save the caller's shadow
|
|
|
e354a5 |
stack pointer and return address.
|
|
|
e354a5 |
2. setcontext and swapcontext are updated to restore shadow stack and
|
|
|
e354a5 |
jump to new context directly.
|
|
|
e354a5 |
3. makecontext is updated to allocate a new shadow stack and set the
|
|
|
e354a5 |
caller's return address to the helper code, L(exitcode).
|
|
|
e354a5 |
4. Since we no longer save and restore EAX, ECX and EDX in getcontext,
|
|
|
e354a5 |
setcontext and swapcontext, we can use them as scratch register slots
|
|
|
e354a5 |
to enable CET in ucontext functions.
|
|
|
e354a5 |
|
|
|
e354a5 |
Since makecontext allocates a new shadow stack when making a new
|
|
|
e354a5 |
context and kernel allocates a new shadow stack for clone/fork/vfork
|
|
|
e354a5 |
syscalls, we track the current shadow stack base. In setcontext and
|
|
|
e354a5 |
swapcontext, if the target shadow stack base is the same as the current
|
|
|
e354a5 |
shadow stack base, we unwind the shadow stack. Otherwise it is a stack
|
|
|
e354a5 |
switch and we look for a restore token.
|
|
|
e354a5 |
|
|
|
e354a5 |
We enable shadow stack at run-time only if program and all used shared
|
|
|
e354a5 |
objects, including dlopened ones, are shadow stack enabled, which means
|
|
|
e354a5 |
that they must be compiled with GCC 8 or above and glibc 2.28 or above.
|
|
|
e354a5 |
We need to save and restore shadow stack only if shadow stack is enabled.
|
|
|
e354a5 |
When caller of getcontext, setcontext, swapcontext and makecontext is
|
|
|
e354a5 |
compiled with smaller ucontext_t, shadow stack won't be enabled at
|
|
|
e354a5 |
run-time. We check if shadow stack is enabled before accessing the
|
|
|
e354a5 |
extended field in ucontext_t.
|
|
|
e354a5 |
|
|
|
e354a5 |
Tested on i386 CET/non-CET machines.
|
|
|
e354a5 |
|
|
|
e354a5 |
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
|
|
e354a5 |
---
|
|
|
e354a5 |
|
|
|
e354a5 |
diff --git a/sysdeps/unix/sysv/linux/i386/getcontext.S b/sysdeps/unix/sysv/linux/i386/getcontext.S
|
|
|
e354a5 |
index 6637596..4ed9d03 100644
|
|
|
e354a5 |
--- a/sysdeps/unix/sysv/linux/i386/getcontext.S
|
|
|
e354a5 |
+++ b/sysdeps/unix/sysv/linux/i386/getcontext.S
|
|
|
e354a5 |
@@ -18,6 +18,7 @@
|
|
|
e354a5 |
<http://www.gnu.org/licenses/>. */
|
|
|
e354a5 |
|
|
|
e354a5 |
#include <sysdep.h>
|
|
|
e354a5 |
+#include <asm/prctl.h>
|
|
|
e354a5 |
|
|
|
e354a5 |
#include "ucontext_i.h"
|
|
|
e354a5 |
|
|
|
e354a5 |
@@ -42,6 +43,61 @@ ENTRY(__getcontext)
|
|
|
e354a5 |
movw %fs, %dx
|
|
|
e354a5 |
movl %edx, oFS(%eax)
|
|
|
e354a5 |
|
|
|
e354a5 |
+#if SHSTK_ENABLED
|
|
|
e354a5 |
+ /* Check if shadow stack is enabled. */
|
|
|
e354a5 |
+ testl $X86_FEATURE_1_SHSTK, %gs:FEATURE_1_OFFSET
|
|
|
e354a5 |
+ jz L(no_shstk)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save EAX in EDX. */
|
|
|
e354a5 |
+ movl %eax, %edx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ xorl %eax, %eax
|
|
|
e354a5 |
+ cmpl %gs:SSP_BASE_OFFSET, %eax
|
|
|
e354a5 |
+ jnz L(shadow_stack_bound_recorded)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save EBX in the first scratch register slot. */
|
|
|
e354a5 |
+ movl %ebx, oSCRATCH1(%edx)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the base address and size of the default shadow stack
|
|
|
e354a5 |
+ which must be the current shadow stack since nothing has
|
|
|
e354a5 |
+ been recorded yet. */
|
|
|
e354a5 |
+ sub $24, %esp
|
|
|
e354a5 |
+ mov %esp, %ecx
|
|
|
e354a5 |
+ movl $ARCH_CET_STATUS, %ebx
|
|
|
e354a5 |
+ movl $__NR_arch_prctl, %eax
|
|
|
e354a5 |
+ ENTER_KERNEL
|
|
|
e354a5 |
+ testl %eax, %eax
|
|
|
e354a5 |
+ jz L(continue_no_err)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* This should never happen. */
|
|
|
e354a5 |
+ hlt
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(continue_no_err):
|
|
|
e354a5 |
+ /* Restore EBX from the first scratch register slot. */
|
|
|
e354a5 |
+ movl oSCRATCH1(%edx), %ebx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Record the base of the current shadow stack. */
|
|
|
e354a5 |
+ movl 8(%esp), %eax
|
|
|
e354a5 |
+ movl %eax, %gs:SSP_BASE_OFFSET
|
|
|
e354a5 |
+ add $24, %esp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(shadow_stack_bound_recorded):
|
|
|
e354a5 |
+ /* Load address of the context data structure. */
|
|
|
e354a5 |
+ movl 4(%esp), %eax
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the current shadow stack pointer. */
|
|
|
e354a5 |
+ rdsspd %edx
|
|
|
e354a5 |
+ /* NB: Save the caller's shadow stack so that we can jump back
|
|
|
e354a5 |
+ to the caller directly. */
|
|
|
e354a5 |
+ addl $4, %edx
|
|
|
e354a5 |
+ movl %edx, oSSP(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the current shadow stack base in ucontext. */
|
|
|
e354a5 |
+ movl %gs:SSP_BASE_OFFSET, %edx
|
|
|
e354a5 |
+ movl %edx, (oSSP + 4)(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(no_shstk):
|
|
|
e354a5 |
+#endif
|
|
|
e354a5 |
/* We have separate floating-point register content memory on the
|
|
|
e354a5 |
stack. We use the __fpregs_mem block in the context. Set the
|
|
|
e354a5 |
links up correctly. */
|
|
|
e354a5 |
diff --git a/sysdeps/unix/sysv/linux/i386/makecontext.S b/sysdeps/unix/sysv/linux/i386/makecontext.S
|
|
|
e354a5 |
index e3ca3dc..2d82ddc 100644
|
|
|
e354a5 |
--- a/sysdeps/unix/sysv/linux/i386/makecontext.S
|
|
|
e354a5 |
+++ b/sysdeps/unix/sysv/linux/i386/makecontext.S
|
|
|
e354a5 |
@@ -18,6 +18,7 @@
|
|
|
e354a5 |
<http://www.gnu.org/licenses/>. */
|
|
|
e354a5 |
|
|
|
e354a5 |
#include <sysdep.h>
|
|
|
e354a5 |
+#include <asm/prctl.h>
|
|
|
e354a5 |
|
|
|
e354a5 |
#include "ucontext_i.h"
|
|
|
e354a5 |
|
|
|
e354a5 |
@@ -68,6 +69,127 @@ ENTRY(__makecontext)
|
|
|
e354a5 |
jnz 1b
|
|
|
e354a5 |
2:
|
|
|
e354a5 |
|
|
|
e354a5 |
+#if SHSTK_ENABLED
|
|
|
e354a5 |
+ /* Check if Shadow Stack is enabled. */
|
|
|
e354a5 |
+ testl $X86_FEATURE_1_SHSTK, %gs:FEATURE_1_OFFSET
|
|
|
e354a5 |
+ jz L(skip_ssp)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Reload the pointer to ucontext. */
|
|
|
e354a5 |
+ movl 4(%esp), %eax
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Shadow stack is enabled. We need to allocate a new shadow
|
|
|
e354a5 |
+ stack. */
|
|
|
e354a5 |
+ subl oSS_SP(%eax), %edx
|
|
|
e354a5 |
+ shrl $STACK_SIZE_TO_SHADOW_STACK_SIZE_SHIFT, %edx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Align shadow stack size to 8 bytes. */
|
|
|
e354a5 |
+ addl $7, %edx
|
|
|
e354a5 |
+ andl $-8, %edx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Store shadow stack size in __ssp[2]. */
|
|
|
e354a5 |
+ movl %edx, (oSSP + 8)(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save ESI in the second scratch register slot. */
|
|
|
e354a5 |
+ movl %esi, oSCRATCH2(%eax)
|
|
|
e354a5 |
+ /* Save EDI in the third scratch register slot. */
|
|
|
e354a5 |
+ movl %edi, oSCRATCH3(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the pointer to ucontext. */
|
|
|
e354a5 |
+ movl %eax, %edi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the original shadow stack pointer. */
|
|
|
e354a5 |
+ rdsspd %esi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Align the saved original shadow stack pointer to the next
|
|
|
e354a5 |
+ 8 byte aligned boundary. */
|
|
|
e354a5 |
+ andl $-8, %esi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Load the top of the new stack into EDX. */
|
|
|
e354a5 |
+ movl oESP(%eax), %edx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* We need to terminate the FDE here because the unwinder looks
|
|
|
e354a5 |
+ at ra-1 for unwind information. */
|
|
|
e354a5 |
+ cfi_endproc
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Swap the original stack pointer with the top of the new
|
|
|
e354a5 |
+ stack. */
|
|
|
e354a5 |
+ xchgl %esp, %edx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Add 4 bytes since CALL will push the 4-byte return address
|
|
|
e354a5 |
+ onto stack. */
|
|
|
e354a5 |
+ addl $4, %esp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Allocate the new shadow stack. Save EBX in the first scratch
|
|
|
e354a5 |
+ register slot. */
|
|
|
e354a5 |
+ movl %ebx, oSCRATCH1(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* CET syscall takes 64-bit sizes. */
|
|
|
e354a5 |
+ subl $16, %esp
|
|
|
e354a5 |
+ movl (oSSP + 8)(%eax), %ecx
|
|
|
e354a5 |
+ movl %ecx, (%esp)
|
|
|
e354a5 |
+ movl $0, 4(%esp)
|
|
|
e354a5 |
+ movl %ecx, 8(%esp)
|
|
|
e354a5 |
+ movl $0, 12(%esp)
|
|
|
e354a5 |
+ movl %esp, %ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ movl $ARCH_CET_ALLOC_SHSTK, %ebx
|
|
|
e354a5 |
+ movl $__NR_arch_prctl, %eax
|
|
|
e354a5 |
+ ENTER_KERNEL
|
|
|
e354a5 |
+ testl %eax, %eax
|
|
|
e354a5 |
+ jne L(hlt) /* This should never happen. */
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Copy the base address of the new shadow stack to __ssp[1]. */
|
|
|
e354a5 |
+ movl (%esp), %eax
|
|
|
e354a5 |
+ movl %eax, (oSSP + 4)(%edi)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ addl $16, %esp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Restore EBX from the first scratch register slot. */
|
|
|
e354a5 |
+ movl oSCRATCH1(%edi), %ebx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the size of the new shadow stack. */
|
|
|
e354a5 |
+ movl (oSSP + 8)(%edi), %ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Use the restore stoken to restore the new shadow stack. */
|
|
|
e354a5 |
+ rstorssp -8(%eax, %ecx)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the restore token at the next 8 byte aligned boundary
|
|
|
e354a5 |
+ on the original shadow stack. */
|
|
|
e354a5 |
+ saveprevssp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Push the address of "jmp exitcode" onto the new stack as
|
|
|
e354a5 |
+ well as the new shadow stack. */
|
|
|
e354a5 |
+ call 1f
|
|
|
e354a5 |
+ jmp L(exitcode)
|
|
|
e354a5 |
+1:
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the new shadow stack pointer. */
|
|
|
e354a5 |
+ rdsspd %eax
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Use the restore stoken to restore the original shadow stack. */
|
|
|
e354a5 |
+ rstorssp -8(%esi)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the restore token on the new shadow stack. */
|
|
|
e354a5 |
+ saveprevssp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Store the new shadow stack pointer in __ssp[0]. */
|
|
|
e354a5 |
+ movl %eax, oSSP(%edi)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Restore the original stack. */
|
|
|
e354a5 |
+ mov %edx, %esp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ cfi_startproc
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Restore ESI from the second scratch register slot. */
|
|
|
e354a5 |
+ movl oSCRATCH2(%edi), %esi
|
|
|
e354a5 |
+ /* Restore EDI from the third scratch register slot. */
|
|
|
e354a5 |
+ movl oSCRATCH3(%edi), %edi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ ret
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(skip_ssp):
|
|
|
e354a5 |
+#endif
|
|
|
e354a5 |
+
|
|
|
e354a5 |
/* If the function we call returns we must continue with the
|
|
|
e354a5 |
context which is given in the uc_link element. To do this
|
|
|
e354a5 |
set the return address for the function the user provides
|
|
|
e354a5 |
@@ -123,6 +245,7 @@ L(call_exit):
|
|
|
e354a5 |
call HIDDEN_JUMPTARGET(exit)
|
|
|
e354a5 |
/* The 'exit' call should never return. In case it does cause
|
|
|
e354a5 |
the process to terminate. */
|
|
|
e354a5 |
+L(hlt):
|
|
|
e354a5 |
hlt
|
|
|
e354a5 |
cfi_startproc
|
|
|
e354a5 |
END(__makecontext)
|
|
|
e354a5 |
diff --git a/sysdeps/unix/sysv/linux/i386/setcontext.S b/sysdeps/unix/sysv/linux/i386/setcontext.S
|
|
|
e354a5 |
index 7565d7d..7b58918 100644
|
|
|
e354a5 |
--- a/sysdeps/unix/sysv/linux/i386/setcontext.S
|
|
|
e354a5 |
+++ b/sysdeps/unix/sysv/linux/i386/setcontext.S
|
|
|
e354a5 |
@@ -18,6 +18,7 @@
|
|
|
e354a5 |
<http://www.gnu.org/licenses/>. */
|
|
|
e354a5 |
|
|
|
e354a5 |
#include <sysdep.h>
|
|
|
e354a5 |
+#include <asm/prctl.h>
|
|
|
e354a5 |
|
|
|
e354a5 |
#include "ucontext_i.h"
|
|
|
e354a5 |
|
|
|
e354a5 |
@@ -56,9 +57,6 @@ ENTRY(__setcontext)
|
|
|
e354a5 |
movl oFS(%eax), %ecx
|
|
|
e354a5 |
movw %cx, %fs
|
|
|
e354a5 |
|
|
|
e354a5 |
- /* Fetch the address to return to. */
|
|
|
e354a5 |
- movl oEIP(%eax), %ecx
|
|
|
e354a5 |
-
|
|
|
e354a5 |
/* Load the new stack pointer. */
|
|
|
e354a5 |
cfi_def_cfa (eax, 0)
|
|
|
e354a5 |
cfi_offset (edi, oEDI)
|
|
|
e354a5 |
@@ -67,6 +65,103 @@ ENTRY(__setcontext)
|
|
|
e354a5 |
cfi_offset (ebx, oEBX)
|
|
|
e354a5 |
movl oESP(%eax), %esp
|
|
|
e354a5 |
|
|
|
e354a5 |
+#if SHSTK_ENABLED
|
|
|
e354a5 |
+ /* Check if Shadow Stack is enabled. */
|
|
|
e354a5 |
+ testl $X86_FEATURE_1_SHSTK, %gs:FEATURE_1_OFFSET
|
|
|
e354a5 |
+ jz L(no_shstk)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* If the base of the target shadow stack is the same as the
|
|
|
e354a5 |
+ base of the current shadow stack, we unwind the shadow
|
|
|
e354a5 |
+ stack. Otherwise it is a stack switch and we look for a
|
|
|
e354a5 |
+ restore token. */
|
|
|
e354a5 |
+ movl oSSP(%eax), %esi
|
|
|
e354a5 |
+ movl %esi, %edi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the base of the target shadow stack. */
|
|
|
e354a5 |
+ movl (oSSP + 4)(%eax), %ecx
|
|
|
e354a5 |
+ cmpl %gs:SSP_BASE_OFFSET, %ecx
|
|
|
e354a5 |
+ je L(unwind_shadow_stack)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Align the saved original shadow stack pointer to the next
|
|
|
e354a5 |
+ 8 byte aligned boundary. */
|
|
|
e354a5 |
+ andl $-8, %esi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(find_restore_token_loop):
|
|
|
e354a5 |
+ /* Look for a restore token. */
|
|
|
e354a5 |
+ movl -8(%esi), %ebx
|
|
|
e354a5 |
+ andl $-8, %ebx
|
|
|
e354a5 |
+ cmpl %esi, %ebx
|
|
|
e354a5 |
+ je L(restore_shadow_stack)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Try the next slot. */
|
|
|
e354a5 |
+ subl $8, %esi
|
|
|
e354a5 |
+ jmp L(find_restore_token_loop)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(restore_shadow_stack):
|
|
|
e354a5 |
+ /* Pop return address from the shadow stack since setcontext
|
|
|
e354a5 |
+ will not return. */
|
|
|
e354a5 |
+ movl $1, %ebx
|
|
|
e354a5 |
+ incsspd %ebx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Use the restore stoken to restore the target shadow stack. */
|
|
|
e354a5 |
+ rstorssp -8(%esi)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the restore token on the old shadow stack. NB: This
|
|
|
e354a5 |
+ restore token may be checked by setcontext or swapcontext
|
|
|
e354a5 |
+ later. */
|
|
|
e354a5 |
+ saveprevssp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Record the new shadow stack base that was switched to. */
|
|
|
e354a5 |
+ movl (oSSP + 4)(%eax), %ebx
|
|
|
e354a5 |
+ movl %ebx, %gs:SSP_BASE_OFFSET
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(unwind_shadow_stack):
|
|
|
e354a5 |
+ rdsspd %ebx
|
|
|
e354a5 |
+ subl %edi, %ebx
|
|
|
e354a5 |
+ je L(skip_unwind_shadow_stack)
|
|
|
e354a5 |
+ negl %ebx
|
|
|
e354a5 |
+ shrl $2, %ebx
|
|
|
e354a5 |
+ movl $255, %esi
|
|
|
e354a5 |
+L(loop):
|
|
|
e354a5 |
+ cmpl %esi, %ebx
|
|
|
e354a5 |
+ cmovb %ebx, %esi
|
|
|
e354a5 |
+ incsspd %esi
|
|
|
e354a5 |
+ subl %esi, %ebx
|
|
|
e354a5 |
+ ja L(loop)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(skip_unwind_shadow_stack):
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Load the values of all the preserved registers (except ESP). */
|
|
|
e354a5 |
+ movl oEDI(%eax), %edi
|
|
|
e354a5 |
+ movl oESI(%eax), %esi
|
|
|
e354a5 |
+ movl oEBP(%eax), %ebp
|
|
|
e354a5 |
+ movl oEBX(%eax), %ebx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the return address set with getcontext. */
|
|
|
e354a5 |
+ movl oEIP(%eax), %ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Check if return address is valid for the case when setcontext
|
|
|
e354a5 |
+ is invoked from L(exitcode) with linked context. */
|
|
|
e354a5 |
+ rdsspd %eax
|
|
|
e354a5 |
+ cmpl (%eax), %ecx
|
|
|
e354a5 |
+ /* Clear EAX to indicate success. NB: Don't use xorl to keep
|
|
|
e354a5 |
+ EFLAGS for jne. */
|
|
|
e354a5 |
+ movl $0, %eax
|
|
|
e354a5 |
+ jne L(jmp)
|
|
|
e354a5 |
+ /* Return to the new context if return address valid. */
|
|
|
e354a5 |
+ pushl %ecx
|
|
|
e354a5 |
+ ret
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(jmp):
|
|
|
e354a5 |
+ /* Jump to the new context directly. */
|
|
|
e354a5 |
+ jmp *%ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(no_shstk):
|
|
|
e354a5 |
+#endif
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Fetch the address to return to. */
|
|
|
e354a5 |
+ movl oEIP(%eax), %ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
/* Push the return address on the new stack so we can return there. */
|
|
|
e354a5 |
pushl %ecx
|
|
|
e354a5 |
|
|
|
e354a5 |
diff --git a/sysdeps/unix/sysv/linux/i386/swapcontext.S b/sysdeps/unix/sysv/linux/i386/swapcontext.S
|
|
|
e354a5 |
index ce27d51..d1b648c 100644
|
|
|
e354a5 |
--- a/sysdeps/unix/sysv/linux/i386/swapcontext.S
|
|
|
e354a5 |
+++ b/sysdeps/unix/sysv/linux/i386/swapcontext.S
|
|
|
e354a5 |
@@ -18,6 +18,7 @@
|
|
|
e354a5 |
<http://www.gnu.org/licenses/>. */
|
|
|
e354a5 |
|
|
|
e354a5 |
#include <sysdep.h>
|
|
|
e354a5 |
+#include <asm/prctl.h>
|
|
|
e354a5 |
|
|
|
e354a5 |
#include "ucontext_i.h"
|
|
|
e354a5 |
|
|
|
e354a5 |
@@ -76,6 +77,144 @@ ENTRY(__swapcontext)
|
|
|
e354a5 |
movl oFS(%eax), %edx
|
|
|
e354a5 |
movw %dx, %fs
|
|
|
e354a5 |
|
|
|
e354a5 |
+#if SHSTK_ENABLED
|
|
|
e354a5 |
+ /* Check if Shadow Stack is enabled. */
|
|
|
e354a5 |
+ testl $X86_FEATURE_1_SHSTK, %gs:FEATURE_1_OFFSET
|
|
|
e354a5 |
+ jz L(no_shstk)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ xorl %eax, %eax
|
|
|
e354a5 |
+ cmpl %gs:SSP_BASE_OFFSET, %eax
|
|
|
e354a5 |
+ jnz L(shadow_stack_bound_recorded)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the base address and size of the default shadow stack
|
|
|
e354a5 |
+ which must be the current shadow stack since nothing has
|
|
|
e354a5 |
+ been recorded yet. */
|
|
|
e354a5 |
+ sub $24, %esp
|
|
|
e354a5 |
+ mov %esp, %ecx
|
|
|
e354a5 |
+ movl $ARCH_CET_STATUS, %ebx
|
|
|
e354a5 |
+ movl $__NR_arch_prctl, %eax
|
|
|
e354a5 |
+ ENTER_KERNEL
|
|
|
e354a5 |
+ testl %eax, %eax
|
|
|
e354a5 |
+ jz L(continue_no_err)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* This should never happen. */
|
|
|
e354a5 |
+ hlt
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(continue_no_err):
|
|
|
e354a5 |
+ /* Record the base of the current shadow stack. */
|
|
|
e354a5 |
+ movl 8(%esp), %eax
|
|
|
e354a5 |
+ movl %eax, %gs:SSP_BASE_OFFSET
|
|
|
e354a5 |
+ add $24, %esp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(shadow_stack_bound_recorded):
|
|
|
e354a5 |
+ /* Load address of the context data structure we save in. */
|
|
|
e354a5 |
+ movl 4(%esp), %eax
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Load address of the context data structure we swap in */
|
|
|
e354a5 |
+ movl 8(%esp), %edx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* If we unwind the stack, we can't undo stack unwinding. Just
|
|
|
e354a5 |
+ save the target shadow stack pointer as the current shadow
|
|
|
e354a5 |
+ stack pointer. */
|
|
|
e354a5 |
+ movl oSSP(%edx), %ecx
|
|
|
e354a5 |
+ movl %ecx, oSSP(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the current shadow stack base in ucontext. */
|
|
|
e354a5 |
+ movl %gs:SSP_BASE_OFFSET, %ecx
|
|
|
e354a5 |
+ movl %ecx, (oSSP + 4)(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* If the base of the target shadow stack is the same as the
|
|
|
e354a5 |
+ base of the current shadow stack, we unwind the shadow
|
|
|
e354a5 |
+ stack. Otherwise it is a stack switch and we look for a
|
|
|
e354a5 |
+ restore token. */
|
|
|
e354a5 |
+ movl oSSP(%edx), %esi
|
|
|
e354a5 |
+ movl %esi, %edi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the base of the target shadow stack. */
|
|
|
e354a5 |
+ movl (oSSP + 4)(%edx), %ecx
|
|
|
e354a5 |
+ cmpl %gs:SSP_BASE_OFFSET, %ecx
|
|
|
e354a5 |
+ je L(unwind_shadow_stack)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Align the saved original shadow stack pointer to the next
|
|
|
e354a5 |
+ 8 byte aligned boundary. */
|
|
|
e354a5 |
+ andl $-8, %esi
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(find_restore_token_loop):
|
|
|
e354a5 |
+ /* Look for a restore token. */
|
|
|
e354a5 |
+ movl -8(%esi), %ebx
|
|
|
e354a5 |
+ andl $-8, %ebx
|
|
|
e354a5 |
+ cmpl %esi, %ebx
|
|
|
e354a5 |
+ je L(restore_shadow_stack)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Try the next slot. */
|
|
|
e354a5 |
+ subl $8, %esi
|
|
|
e354a5 |
+ jmp L(find_restore_token_loop)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(restore_shadow_stack):
|
|
|
e354a5 |
+ /* The target shadow stack will be restored. Save the current
|
|
|
e354a5 |
+ shadow stack pointer. */
|
|
|
e354a5 |
+ rdsspd %ecx
|
|
|
e354a5 |
+ movl %ecx, oSSP(%eax)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Use the restore stoken to restore the target shadow stack. */
|
|
|
e354a5 |
+ rstorssp -8(%esi)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Save the restore token on the old shadow stack. NB: This
|
|
|
e354a5 |
+ restore token may be checked by setcontext or swapcontext
|
|
|
e354a5 |
+ later. */
|
|
|
e354a5 |
+ saveprevssp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Record the new shadow stack base that was switched to. */
|
|
|
e354a5 |
+ movl (oSSP + 4)(%edx), %ebx
|
|
|
e354a5 |
+ movl %ebx, %gs:SSP_BASE_OFFSET
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(unwind_shadow_stack):
|
|
|
e354a5 |
+ rdsspd %ebx
|
|
|
e354a5 |
+ subl %edi, %ebx
|
|
|
e354a5 |
+ je L(skip_unwind_shadow_stack)
|
|
|
e354a5 |
+ negl %ebx
|
|
|
e354a5 |
+ shrl $2, %ebx
|
|
|
e354a5 |
+ movl $255, %esi
|
|
|
e354a5 |
+L(loop):
|
|
|
e354a5 |
+ cmpl %esi, %ebx
|
|
|
e354a5 |
+ cmovb %ebx, %esi
|
|
|
e354a5 |
+ incsspd %esi
|
|
|
e354a5 |
+ subl %esi, %ebx
|
|
|
e354a5 |
+ ja L(loop)
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(skip_unwind_shadow_stack):
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Load the new stack pointer. */
|
|
|
e354a5 |
+ movl oESP(%edx), %esp
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Load the values of all the preserved registers (except ESP). */
|
|
|
e354a5 |
+ movl oEDI(%edx), %edi
|
|
|
e354a5 |
+ movl oESI(%edx), %esi
|
|
|
e354a5 |
+ movl oEBP(%edx), %ebp
|
|
|
e354a5 |
+ movl oEBX(%edx), %ebx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Get the return address set with getcontext. */
|
|
|
e354a5 |
+ movl oEIP(%edx), %ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+ /* Check if return address is valid for the case when setcontext
|
|
|
e354a5 |
+ is invoked from L(exitcode) with linked context. */
|
|
|
e354a5 |
+ rdsspd %eax
|
|
|
e354a5 |
+ cmpl (%eax), %ecx
|
|
|
e354a5 |
+ /* Clear EAX to indicate success. NB: Don't use xorl to keep
|
|
|
e354a5 |
+ EFLAGS for jne. */
|
|
|
e354a5 |
+ movl $0, %eax
|
|
|
e354a5 |
+ jne L(jmp)
|
|
|
e354a5 |
+ /* Return to the new context if return address valid. */
|
|
|
e354a5 |
+ pushl %ecx
|
|
|
e354a5 |
+ ret
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(jmp):
|
|
|
e354a5 |
+ /* Jump to the new context directly. */
|
|
|
e354a5 |
+ jmp *%ecx
|
|
|
e354a5 |
+
|
|
|
e354a5 |
+L(no_shstk):
|
|
|
e354a5 |
+#endif
|
|
|
e354a5 |
+
|
|
|
e354a5 |
/* Fetch the address to return to. */
|
|
|
e354a5 |
movl oEIP(%eax), %ecx
|
|
|
e354a5 |
|
|
|
e354a5 |
diff --git a/sysdeps/unix/sysv/linux/i386/sysdep.h b/sysdeps/unix/sysv/linux/i386/sysdep.h
|
|
|
e354a5 |
index 3255cc7..9344ac7 100644
|
|
|
e354a5 |
--- a/sysdeps/unix/sysv/linux/i386/sysdep.h
|
|
|
e354a5 |
+++ b/sysdeps/unix/sysv/linux/i386/sysdep.h
|
|
|
e354a5 |
@@ -656,4 +656,9 @@ struct libc_do_syscall_args
|
|
|
e354a5 |
# endif
|
|
|
e354a5 |
#endif
|
|
|
e354a5 |
|
|
|
e354a5 |
+/* Each shadow stack slot takes 4 bytes. Assuming that each stack
|
|
|
e354a5 |
+ frame takes 128 bytes, this is used to compute shadow stack size
|
|
|
e354a5 |
+ from stack size. */
|
|
|
e354a5 |
+#define STACK_SIZE_TO_SHADOW_STACK_SIZE_SHIFT 5
|
|
|
e354a5 |
+
|
|
|
e354a5 |
#endif /* linux/i386/sysdep.h */
|
|
|
e354a5 |
diff --git a/sysdeps/unix/sysv/linux/i386/ucontext_i.sym b/sysdeps/unix/sysv/linux/i386/ucontext_i.sym
|
|
|
e354a5 |
index 1dfe03d..1d8608e 100644
|
|
|
e354a5 |
--- a/sysdeps/unix/sysv/linux/i386/ucontext_i.sym
|
|
|
e354a5 |
+++ b/sysdeps/unix/sysv/linux/i386/ucontext_i.sym
|
|
|
e354a5 |
@@ -22,6 +22,10 @@ oEBP mreg (EBP)
|
|
|
e354a5 |
oESP mreg (ESP)
|
|
|
e354a5 |
oEBX mreg (EBX)
|
|
|
e354a5 |
oEIP mreg (EIP)
|
|
|
e354a5 |
+oSCRATCH1 mreg (EAX)
|
|
|
e354a5 |
+oSCRATCH2 mreg (ECX)
|
|
|
e354a5 |
+oSCRATCH3 mreg (EDX)
|
|
|
e354a5 |
oFPREGS mcontext (fpregs)
|
|
|
e354a5 |
oSIGMASK ucontext (uc_sigmask)
|
|
|
e354a5 |
oFPREGSMEM ucontext (__fpregs_mem)
|
|
|
e354a5 |
+oSSP ucontext (__ssp)
|
|
|
e354a5 |
|