Historically, managing the user-space shadow stack state on x86 has been handled exclusively through the arch_prctl() interface via the ARCH_SHSTK_* operations. However, other architectures (such as arm64 and riscv) do not implement arch_prctl() and instead utilize the newer, arch-agnostic, prctl() interface (i.e. PR_GET_SHADOW_STACK_STATUS and PR_SET_SHADOW_STACK_STATUS).
To provide language runtimes, toolchains, and libc implementations with a consistent, cross-architecture interface for managing control-flow integrity, wire up the generic shadow stack prctl handlers for x86. Map the generic PR_SHADOW_STACK_ENABLE, PR_SHADOW_STACK_DISABLE, and PR_SHADOW_STACK_LOCK operations onto the underlying x86 internal CET helper routines. This allows portable userspace applications to toggle or query shadow stack states without relying on architecture-specific system calls, while maintaining backward compatibility with existing arch_prctl() calls. Signed-off-by: Bill Roberts <[email protected]> --- arch/x86/kernel/shstk.c | 83 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index 0ca64900192f..249c4998732a 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -18,6 +18,7 @@ #include <linux/sizes.h> #include <linux/user.h> #include <linux/syscalls.h> +#include <linux/prctl.h> #include <asm/msr.h> #include <asm/fpu/xstate.h> #include <asm/fpu/types.h> @@ -630,3 +631,85 @@ bool shstk_is_enabled(void) { return features_enabled(ARCH_SHSTK_SHSTK); } + +/* Handles the generic prctl interface for PR_SET_SHADOW_STACK_STATUS and its feature bits */ +int arch_set_shadow_stack_status(struct task_struct *t, unsigned long status) +{ + int rc; + bool shstk_was_enabled = features_enabled(ARCH_SHSTK_SHSTK); + + /* + * One must explicitly perform enable/disable calls for the whole feature set so + * that the locked bits are checked. It is also important to capture entry state + * for roll-back if needed. However, we must NOT try to enable or disable a feature + * unless there is a change in feature status from old to new state. This is + * because shstk_prctl(), correctly, checks locked bits before feature enabled/disabled + * short circuit. + */ + switch (status) { + case 0: + /* + * We do NOT explicitly disable WRSS here, disabling shadow stack will disable WRSS, + * and we don't want a locked WRSS to prevent disable. + */ + return shstk_was_enabled ? + shstk_prctl(t, ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK) : 0; + + case PR_SHADOW_STACK_ENABLE: + if (!shstk_was_enabled) { + rc = shstk_prctl(t, ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK); + if (rc) + return rc; + } + + if (features_enabled(ARCH_SHSTK_WRSS)) { + rc = shstk_prctl(t, ARCH_SHSTK_DISABLE, ARCH_SHSTK_WRSS); + if (rc && !shstk_was_enabled) + shstk_prctl(t, ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK); + return rc; + } + + return 0; + + case PR_SHADOW_STACK_ENABLE|PR_SHADOW_STACK_WRITE: + if (!shstk_was_enabled) { + rc = shstk_prctl(t, ARCH_SHSTK_ENABLE, ARCH_SHSTK_SHSTK); + if (rc) + return rc; + } + + if (!features_enabled(ARCH_SHSTK_WRSS)) { + rc = shstk_prctl(t, ARCH_SHSTK_ENABLE, ARCH_SHSTK_WRSS); + if (rc && !shstk_was_enabled) + shstk_prctl(t, ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK); + + return rc; + } + + return 0; + + /* + * Unknown bit mapping, unsupported PR_SHADOW_STACK_PUSH or *only* + * PR_SHADOW_STACK_WRITE. + */ + default: + return -EINVAL; + } +} + +/* Handles the generic prctl interface for PR_LOCK_SHADOW_STACK_STATUS and its feature bits */ +int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status) +{ + return shstk_prctl(t, ARCH_SHSTK_LOCK, status); +} + +/* + * We assume the prctl() feature bits line up with the arch_prctl() specific ones. If not, + * the flags returned via arch_get_shadow_stack_status will be mapped wrong. + */ +static_assert(PR_SHADOW_STACK_ENABLE == ARCH_SHSTK_SHSTK); +static_assert(PR_SHADOW_STACK_WRITE == ARCH_SHSTK_WRSS); +int arch_get_shadow_stack_status(struct task_struct *t, unsigned long __user *status) +{ + return shstk_prctl(t, ARCH_SHSTK_STATUS, (unsigned long)status); +} -- 2.55.0
