| Message ID | 20240822-arm64-gcs-v11-25-41b81947ecb5@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | arm64/gcs: Provide support for GCS in userspace | expand |
On Thu, Aug 22, 2024 at 02:15:28AM +0100, Mark Brown wrote: > +static int preserve_gcs_context(struct gcs_context __user *ctx) > +{ > + int err = 0; > + u64 gcspr; > + > + /* > + * We will add a cap token to the frame, include it in the > + * GCSPR_EL0 we report to support stack switching via > + * sigreturn. > + */ > + gcs_preserve_current_state(); > + gcspr = current->thread.gcspr_el0 - 8; > + > + __put_user_error(GCS_MAGIC, &ctx->head.magic, err); > + __put_user_error(sizeof(*ctx), &ctx->head.size, err); > + __put_user_error(gcspr, &ctx->gcspr, err); > + __put_user_error(0, &ctx->reserved, err); > + __put_user_error(current->thread.gcs_el0_mode, > + &ctx->features_enabled, err); > + > + return err; > +} Do we actually need to store the gcspr value after the cap token has been pushed or just the value of the interrupted context? If we at some point get a sigaltshadowstack() syscall, the saved GCS wouldn't point to the new stack but rather the original one. Unwinders should be able to get the actual GCSPR_EL0 register, no need for the sigcontext to point to the new shadow stack. Also in gcs_signal_entry() in the previous patch, we seem to subtract 16 rather than 8. I admit I haven't checked the past discussions in this area, so maybe I'm missing something. > +static int restore_gcs_context(struct user_ctxs *user) > +{ > + u64 gcspr, enabled; > + int err = 0; > + > + if (user->gcs_size != sizeof(*user->gcs)) > + return -EINVAL; > + > + __get_user_error(gcspr, &user->gcs->gcspr, err); > + __get_user_error(enabled, &user->gcs->features_enabled, err); > + if (err) > + return err; > + > + /* Don't allow unknown modes */ > + if (enabled & ~PR_SHADOW_STACK_SUPPORTED_STATUS_MASK) > + return -EINVAL; > + > + err = gcs_check_locked(current, enabled); > + if (err != 0) > + return err; > + > + /* Don't allow enabling */ > + if (!task_gcs_el0_enabled(current) && > + (enabled & PR_SHADOW_STACK_ENABLE)) > + return -EINVAL; > + > + /* If we are disabling disable everything */ > + if (!(enabled & PR_SHADOW_STACK_ENABLE)) > + enabled = 0; > + > + current->thread.gcs_el0_mode = enabled; > + > + /* > + * We let userspace set GCSPR_EL0 to anything here, we will > + * validate later in gcs_restore_signal(). > + */ > + current->thread.gcspr_el0 = gcspr; > + write_sysreg_s(current->thread.gcspr_el0, SYS_GCSPR_EL0); So in preserve_gcs_context(), we subtract 8 from the gcspr_el0 value. Where is it added back? What I find confusing is that both restore_gcs_context() and gcs_restore_signal() seem to touch current->thread.gcspr_el0 and the sysreg. Which one takes priority? I should probably check the branch out to see the end result. > @@ -977,6 +1079,13 @@ static int setup_sigframe_layout(struct rt_sigframe_user_layout *user, > return err; > } > > + if (add_all || task_gcs_el0_enabled(current)) { > + err = sigframe_alloc(user, &user->gcs_offset, > + sizeof(struct gcs_context)); > + if (err) > + return err; > + } I'm still not entirely convinced of this conditional saving and the interaction with unwinders. In a previous thread you mentioned that we need to keep the GCSPR_EL0 sysreg value up to date even after disabling GCS for a thread as not to confuse the unwinders. We could get a signal delivered together with a sigreturn without any context switch. Do we lose any state? It might help if you describe the scenario, maybe even adding a comment in the code, otherwise I'm sure we'll forget in a few months time.
On Fri, Aug 23, 2024 at 10:37:19AM +0100, Catalin Marinas wrote: > On Thu, Aug 22, 2024 at 02:15:28AM +0100, Mark Brown wrote: > > + gcs_preserve_current_state(); > > + gcspr = current->thread.gcspr_el0 - 8; > > + __put_user_error(gcspr, &ctx->gcspr, err); > Do we actually need to store the gcspr value after the cap token has > been pushed or just the value of the interrupted context? If we at some > point get a sigaltshadowstack() syscall, the saved GCS wouldn't point to > the new stack but rather the original one. Unwinders should be able to > get the actual GCSPR_EL0 register, no need for the sigcontext to point > to the new shadow stack. We could store either the cap token or the interrupted GCSPR_EL0 (the address below the cap token). It felt more joined up to go with the cap token since notionally signal return is consuming the cap token but either way would work, we could just add an offset when looking at the pointer. > Also in gcs_signal_entry() in the previous patch, we seem to subtract 16 > rather than 8. We need to not only place a cap but also a GCS frame for the sigreturn trampoline, the sigreturn trampoline isn't part of the interrupted context so isn't included in the signal frame but it needs to have a record on the GCS so that the signal handler doesn't just generate a GCS fault if it tries to return to the trampoline. This means that the GCSPR_EL0 that is set for the signal handler needs to move two entries, one for the cap token and one for the trampoline. > What I find confusing is that both restore_gcs_context() and > gcs_restore_signal() seem to touch current->thread.gcspr_el0 and the > sysreg. Which one takes priority? I should probably check the branch out > to see the end result. restore_gcs_context() is loading values from the signal frame in memory (which will only happen if a GCS context is present) then gcs_restore_signal() consumes the token at the top of the stack. The split is because userspace can skip the restore_X_context() functions for the optional signal frame elements by removing them from the context but we want to ensure that we always consume a token. > > + /* > > + * We let userspace set GCSPR_EL0 to anything here, we will > > + * validate later in gcs_restore_signal(). > > + */ > > + current->thread.gcspr_el0 = gcspr; > > + write_sysreg_s(current->thread.gcspr_el0, SYS_GCSPR_EL0); > So in preserve_gcs_context(), we subtract 8 from the gcspr_el0 value. > Where is it added back? When we consumed the GCS cap token. > > + if (add_all || task_gcs_el0_enabled(current)) { > > + err = sigframe_alloc(user, &user->gcs_offset, > > + sizeof(struct gcs_context)); > > + if (err) > > + return err; > > + } > I'm still not entirely convinced of this conditional saving and the > interaction with unwinders. In a previous thread you mentioned that we > need to keep the GCSPR_EL0 sysreg value up to date even after disabling > GCS for a thread as not to confuse the unwinders. We could get a signal > delivered together with a sigreturn without any context switch. Do we > lose any state? > It might help if you describe the scenario, maybe even adding a comment > in the code, otherwise I'm sure we'll forget in a few months time. We should probably just change that back to saving unconditionally - it looks like the decision on worrying about overflowing the default signal frame is that we just shouldn't.
On Fri, Aug 23, 2024 at 11:25:30AM +0100, Mark Brown wrote: > On Fri, Aug 23, 2024 at 10:37:19AM +0100, Catalin Marinas wrote: > > On Thu, Aug 22, 2024 at 02:15:28AM +0100, Mark Brown wrote: > > > > + gcs_preserve_current_state(); > > > + gcspr = current->thread.gcspr_el0 - 8; > > > > + __put_user_error(gcspr, &ctx->gcspr, err); > > > Do we actually need to store the gcspr value after the cap token has > > been pushed or just the value of the interrupted context? If we at some > > point get a sigaltshadowstack() syscall, the saved GCS wouldn't point to > > the new stack but rather the original one. Unwinders should be able to > > get the actual GCSPR_EL0 register, no need for the sigcontext to point > > to the new shadow stack. > > We could store either the cap token or the interrupted GCSPR_EL0 (the > address below the cap token). It felt more joined up to go with the cap > token since notionally signal return is consuming the cap token but > either way would work, we could just add an offset when looking at the > pointer. In a hypothetical sigaltshadowstack() scenario, would the cap go on the new signal shadow stack or on the old one? I assume on the new one but in sigcontext we'd save the original GCSPR_EL0. In such hypothetical case, the original GCSPR_EL0 would not need 8 subtracted. I need to think some more about this. The gcs_restore_signal() function makes sense, it starts with the current GCSPR_EL0 on the signal stack and consumes the token, adds 8 to the shadow stack pointer. The restore_gcs_context() one is confusing as it happens before consuming the cap token and assumes that the GCSPR_EL0 value actually points to the signal stack. If we ever implement an alternative shadow stack, the original GCSPR_EL0 of the interrupted context would be lost. I know it's not planned for now but the principles should be the same. The sigframe.uc should store the interrupted state. To me the order for sigreturn should be first to consume the cap token, validate it etc. and then restore GCSPR_EL0 to whatever was saved in the sigframe.uc prior to the signal being delivered. > > Also in gcs_signal_entry() in the previous patch, we seem to subtract 16 > > rather than 8. > > We need to not only place a cap but also a GCS frame for the sigreturn > trampoline, the sigreturn trampoline isn't part of the interrupted > context so isn't included in the signal frame but it needs to have a > record on the GCS so that the signal handler doesn't just generate a GCS > fault if it tries to return to the trampoline. This means that the > GCSPR_EL0 that is set for the signal handler needs to move two entries, > one for the cap token and one for the trampoline. Yes, this makes sense. > > What I find confusing is that both restore_gcs_context() and > > gcs_restore_signal() seem to touch current->thread.gcspr_el0 and the > > sysreg. Which one takes priority? I should probably check the branch out > > to see the end result. > > restore_gcs_context() is loading values from the signal frame in memory > (which will only happen if a GCS context is present) then > gcs_restore_signal() consumes the token at the top of the stack. The > split is because userspace can skip the restore_X_context() functions > for the optional signal frame elements by removing them from the context > but we want to ensure that we always consume a token. I agree we should always consume a token but this should be done from the actual hardware GCSPR_EL0 value on the sigreturn call rather than the one restored from sigframe.uc. The restoring should be the last step.
On Fri, Aug 23, 2024 at 04:59:11PM +0100, Catalin Marinas wrote: > On Fri, Aug 23, 2024 at 11:25:30AM +0100, Mark Brown wrote: > > We could store either the cap token or the interrupted GCSPR_EL0 (the > > address below the cap token). It felt more joined up to go with the cap > > token since notionally signal return is consuming the cap token but > > either way would work, we could just add an offset when looking at the > > pointer. > In a hypothetical sigaltshadowstack() scenario, would the cap go on the > new signal shadow stack or on the old one? I assume on the new one but > in sigcontext we'd save the original GCSPR_EL0. In such hypothetical > case, the original GCSPR_EL0 would not need 8 subtracted. I would have put the token on the old stack since that's what we'd be returning to. This raises interesting questions about what happens if the reason for the signal is that we just overflowed the normal stack (which are among the issues that have got in the way of working out if or how we do something with sigaltshadowstack). I'm not clear what the purpose of the token would be on the new stack, the token basically says "this is somewhere we can sigreturn to", that's not the case for the alternative stack. > I need to think some more about this. The gcs_restore_signal() function > makes sense, it starts with the current GCSPR_EL0 on the signal stack > and consumes the token, adds 8 to the shadow stack pointer. The > restore_gcs_context() one is confusing as it happens before consuming > the cap token and assumes that the GCSPR_EL0 value actually points to > the signal stack. If we ever implement an alternative shadow stack, the > original GCSPR_EL0 of the interrupted context would be lost. I know it's > not planned for now but the principles should be the same. The > sigframe.uc should store the interrupted state. I think the issues you're pointing out here go to the thing with the cap token marking a place we can sigreturn to and therefore being on the original stack. > To me the order for sigreturn should be first to consume the cap token, > validate it etc. and then restore GCSPR_EL0 to whatever was saved in the > sigframe.uc prior to the signal being delivered. To me what we're doing here is that the signal frame says where userspace wants to point GCSPR_EL0 in the returned context, we then go and confirm that this is a valid address by looking at it and checking for a token. The token serves to validate what was saved in sigframe.uc so that it can't just be pointed at some random address. > > restore_gcs_context() is loading values from the signal frame in memory > > (which will only happen if a GCS context is present) then > > gcs_restore_signal() consumes the token at the top of the stack. The > > split is because userspace can skip the restore_X_context() functions > > for the optional signal frame elements by removing them from the context > > but we want to ensure that we always consume a token. > I agree we should always consume a token but this should be done from > the actual hardware GCSPR_EL0 value on the sigreturn call rather than > the one restored from sigframe.uc. The restoring should be the last > step. If we look for a token at the GCSPR_EL0 on sigreturn then it wouldn't be valid to call sigreturn() (well, without doing something first to unwind the stack which seems hostile and would require code to become GCS aware that wouldn't otherwise), if you do a sigreturn from somewhere other than the vDSO then you'd have at least the vDSO signal frame left in the GCS. You'd also be able to point GCSPR_EL0 to anywhere since we'd just load a value from the signal frame but not do the cap verification.
On Fri, Aug 23, 2024 at 11:01:13PM +0100, Mark Brown wrote: > On Fri, Aug 23, 2024 at 04:59:11PM +0100, Catalin Marinas wrote: > > On Fri, Aug 23, 2024 at 11:25:30AM +0100, Mark Brown wrote: > > > > We could store either the cap token or the interrupted GCSPR_EL0 (the > > > address below the cap token). It felt more joined up to go with the cap > > > token since notionally signal return is consuming the cap token but > > > either way would work, we could just add an offset when looking at the > > > pointer. > > > In a hypothetical sigaltshadowstack() scenario, would the cap go on the > > new signal shadow stack or on the old one? I assume on the new one but > > in sigcontext we'd save the original GCSPR_EL0. In such hypothetical > > case, the original GCSPR_EL0 would not need 8 subtracted. > > I would have put the token on the old stack since that's what we'd be > returning to. After some more spec reading, your approach makes sense as it matches the GCSSS[12] instructions where the outgoing, rather than incoming, shadow stack is capped. So all good I think. However, a bit more below on the restore order (it's ok but a bit confusing). > This raises interesting questions about what happens if > the reason for the signal is that we just overflowed the normal stack > (which are among the issues that have got in the way of working out if > or how we do something with sigaltshadowstack). That's not that different from the classic case where we get an error trying to setup the frame. signal_setup_done() handles it by forcing a SIGSEGV. I'd say we do the same here. > I'm not clear what the > purpose of the token would be on the new stack, the token basically says > "this is somewhere we can sigreturn to", that's not the case for the > alternative stack. Yeah, I thought we have to somehow mark the top of the stack with this token. But looking at the architecture stack switching, it caps the outgoing stack (in our case this would be the interrupted one). So that's settled. On the patch itself, I think there are some small inconsistencies on how it reads the GCSPR_EL0: preserve_gcs_context() does a gcs_preserve_current_state() and subsequently reads the value from the thread structure. A bit later, gcs_signal_entry() goes for the sysreg directly. I don't think that's a problem even if the thread gets preempted but it would be nice to be consistent. Maybe leave the gcs_preserve_current_state() only a context switch thing. Would it work if we don't touch the thread structure at all in the signal code? We wouldn't deliver a signal in the middle of the switch_to() code. So any value we write in thread struct would be overridden at the next switch. If GCS is disabled for a guest, we save the GCSPR_EL0 with the cap size subtracted but there's no cap written. In restore_gcs_context() it doesn't look like we add the cap size back when writing GCSPR_EL0. If GCS is enabled, we do consume the cap and add 8 but otherwise it looks that we keep decreasing GCSPR_EL0. I think we should always subtract the cap size if GCS is enabled. This could could do with some refactoring as I find it hard to follow (not sure exactly how, maybe just comments will do). I'd also keep a single write to GCSPR_EL0 on the return path but I'm ok with two if we need to cope with GCS being disabled but the GCSPR_EL0 still being saved/restored. Another aspect for gcs_restore_signal(), I think it makes more sense for the cap to be consumed _after_ restoring the sigcontext since this has the actual gcspr_el0 where we stored the cap and represents the original stack. If we'll get an alternative shadow stack, current GCSPR_EL0 on sigreturn points to that alternative shadow stack rather than the original one. That's what confused me when reviewing the patch and I thought the cap goes to the top of the signal stack.
On Mon, Aug 26, 2024 at 01:00:09PM +0300, Catalin Marinas wrote: > On Fri, Aug 23, 2024 at 11:01:13PM +0100, Mark Brown wrote: > > On Fri, Aug 23, 2024 at 04:59:11PM +0100, Catalin Marinas wrote: > gcs_preserve_current_state() only a context switch thing. Would it work > if we don't touch the thread structure at all in the signal code? We > wouldn't deliver a signal in the middle of the switch_to() code. So any > value we write in thread struct would be overridden at the next switch. I think so, yes. > If GCS is disabled for a guest, we save the GCSPR_EL0 with the cap size s/guest/task/ I guess? > subtracted but there's no cap written. In restore_gcs_context() it > doesn't look like we add the cap size back when writing GCSPR_EL0. If > GCS is enabled, we do consume the cap and add 8 but otherwise it looks > that we keep decreasing GCSPR_EL0. I think we should always subtract the > cap size if GCS is enabled. This could could do with some refactoring as > I find it hard to follow (not sure exactly how, maybe just comments will > do). I've changed this so we instead only add the frame for the token if GCS is enabled and updated the comment, that way we don't modify GCSPR_EL0 in cases where GCS is not enabled. > I'd also keep a single write to GCSPR_EL0 on the return path but I'm ok > with two if we need to cope with GCS being disabled but the GCSPR_EL0 > still being saved/restored. I think the handling for the various options in the second case mean that it's clearer and simpler to write once when we restore the frame and once when we consume the token. > Another aspect for gcs_restore_signal(), I think it makes more sense for > the cap to be consumed _after_ restoring the sigcontext since this has > the actual gcspr_el0 where we stored the cap and represents the original > stack. If we'll get an alternative shadow stack, current GCSPR_EL0 on > sigreturn points to that alternative shadow stack rather than the > original one. That's what confused me when reviewing the patch and I > thought the cap goes to the top of the signal stack. I've moved gcs_restore_signal() before the altstack restore which I think is what you're looking for here?
diff --git a/arch/arm64/include/uapi/asm/sigcontext.h b/arch/arm64/include/uapi/asm/sigcontext.h index 8a45b7a411e0..c2d61e8efc84 100644 --- a/arch/arm64/include/uapi/asm/sigcontext.h +++ b/arch/arm64/include/uapi/asm/sigcontext.h @@ -176,6 +176,15 @@ struct zt_context { __u16 __reserved[3]; }; +#define GCS_MAGIC 0x47435300 + +struct gcs_context { + struct _aarch64_ctx head; + __u64 gcspr; + __u64 features_enabled; + __u64 reserved; +}; + #endif /* !__ASSEMBLY__ */ #include <asm/sve_context.h> diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index b54d684c4bf8..3ad93f3c2227 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -66,6 +66,7 @@ struct rt_sigframe_user_layout { unsigned long fpsimd_offset; unsigned long esr_offset; + unsigned long gcs_offset; unsigned long sve_offset; unsigned long tpidr2_offset; unsigned long za_offset; @@ -195,6 +196,8 @@ struct user_ctxs { u32 zt_size; struct fpmr_context __user *fpmr; u32 fpmr_size; + struct gcs_context __user *gcs; + u32 gcs_size; }; static int preserve_fpsimd_context(struct fpsimd_context __user *ctx) @@ -614,6 +617,81 @@ extern int restore_zt_context(struct user_ctxs *user); #endif /* ! CONFIG_ARM64_SME */ +#ifdef CONFIG_ARM64_GCS + +static int preserve_gcs_context(struct gcs_context __user *ctx) +{ + int err = 0; + u64 gcspr; + + /* + * We will add a cap token to the frame, include it in the + * GCSPR_EL0 we report to support stack switching via + * sigreturn. + */ + gcs_preserve_current_state(); + gcspr = current->thread.gcspr_el0 - 8; + + __put_user_error(GCS_MAGIC, &ctx->head.magic, err); + __put_user_error(sizeof(*ctx), &ctx->head.size, err); + __put_user_error(gcspr, &ctx->gcspr, err); + __put_user_error(0, &ctx->reserved, err); + __put_user_error(current->thread.gcs_el0_mode, + &ctx->features_enabled, err); + + return err; +} + +static int restore_gcs_context(struct user_ctxs *user) +{ + u64 gcspr, enabled; + int err = 0; + + if (user->gcs_size != sizeof(*user->gcs)) + return -EINVAL; + + __get_user_error(gcspr, &user->gcs->gcspr, err); + __get_user_error(enabled, &user->gcs->features_enabled, err); + if (err) + return err; + + /* Don't allow unknown modes */ + if (enabled & ~PR_SHADOW_STACK_SUPPORTED_STATUS_MASK) + return -EINVAL; + + err = gcs_check_locked(current, enabled); + if (err != 0) + return err; + + /* Don't allow enabling */ + if (!task_gcs_el0_enabled(current) && + (enabled & PR_SHADOW_STACK_ENABLE)) + return -EINVAL; + + /* If we are disabling disable everything */ + if (!(enabled & PR_SHADOW_STACK_ENABLE)) + enabled = 0; + + current->thread.gcs_el0_mode = enabled; + + /* + * We let userspace set GCSPR_EL0 to anything here, we will + * validate later in gcs_restore_signal(). + */ + current->thread.gcspr_el0 = gcspr; + write_sysreg_s(current->thread.gcspr_el0, SYS_GCSPR_EL0); + + return 0; +} + +#else /* ! CONFIG_ARM64_GCS */ + +/* Turn any non-optimised out attempts to use these into a link error: */ +extern int preserve_gcs_context(void __user *ctx); +extern int restore_gcs_context(struct user_ctxs *user); + +#endif /* ! CONFIG_ARM64_GCS */ + static int parse_user_sigframe(struct user_ctxs *user, struct rt_sigframe __user *sf) { @@ -631,6 +709,7 @@ static int parse_user_sigframe(struct user_ctxs *user, user->za = NULL; user->zt = NULL; user->fpmr = NULL; + user->gcs = NULL; if (!IS_ALIGNED((unsigned long)base, 16)) goto invalid; @@ -736,6 +815,17 @@ static int parse_user_sigframe(struct user_ctxs *user, user->fpmr_size = size; break; + case GCS_MAGIC: + if (!system_supports_gcs()) + goto invalid; + + if (user->gcs) + goto invalid; + + user->gcs = (struct gcs_context __user *)head; + user->gcs_size = size; + break; + case EXTRA_MAGIC: if (have_extra_context) goto invalid; @@ -855,6 +945,9 @@ static int restore_sigframe(struct pt_regs *regs, err = restore_fpsimd_context(&user); } + if (err == 0 && system_supports_gcs() && user.gcs) + err = restore_gcs_context(&user); + if (err == 0 && system_supports_tpidr2() && user.tpidr2) err = restore_tpidr2_context(&user); @@ -873,7 +966,8 @@ static int restore_sigframe(struct pt_regs *regs, #ifdef CONFIG_ARM64_GCS static int gcs_restore_signal(void) { - u64 gcspr_el0, cap; + unsigned long __user *gcspr_el0; + u64 cap; int ret; if (!system_supports_gcs()) @@ -882,21 +976,29 @@ static int gcs_restore_signal(void) if (!(current->thread.gcs_el0_mode & PR_SHADOW_STACK_ENABLE)) return 0; - gcspr_el0 = read_sysreg_s(SYS_GCSPR_EL0); + gcspr_el0 = (unsigned long __user *)read_sysreg_s(SYS_GCSPR_EL0); /* - * GCSPR_EL0 should be pointing at a capped GCS, read the cap... + * Ensure that any changes to the GCS done via GCS operations + * are visible to the normal reads we do to validate the + * token. */ gcsb_dsync(); - ret = copy_from_user(&cap, (__user void*)gcspr_el0, sizeof(cap)); + + /* + * GCSPR_EL0 should be pointing at a capped GCS, read the cap. + * We don't enforce that this is in a GCS page, if it is not + * then faults will be generated on GCS operations - the main + * concern is to protect GCS pages. + */ + ret = copy_from_user(&cap, gcspr_el0, sizeof(cap)); if (ret) return -EFAULT; /* - * ...then check that the cap is the actual GCS before - * restoring it. + * Check that the cap is the actual GCS before replacing it. */ - if (!gcs_signal_cap_valid(gcspr_el0, cap)) + if (!gcs_signal_cap_valid((u64)gcspr_el0, cap)) return -EINVAL; /* Invalidate the token to prevent reuse */ @@ -904,7 +1006,7 @@ static int gcs_restore_signal(void) if (ret != 0) return -EFAULT; - current->thread.gcspr_el0 = gcspr_el0 + sizeof(cap); + current->thread.gcspr_el0 = (u64)gcspr_el0 + sizeof(cap); write_sysreg_s(current->thread.gcspr_el0, SYS_GCSPR_EL0); return 0; @@ -977,6 +1079,13 @@ static int setup_sigframe_layout(struct rt_sigframe_user_layout *user, return err; } + if (add_all || task_gcs_el0_enabled(current)) { + err = sigframe_alloc(user, &user->gcs_offset, + sizeof(struct gcs_context)); + if (err) + return err; + } + if (system_supports_sve() || system_supports_sme()) { unsigned int vq = 0; @@ -1077,6 +1186,12 @@ static int setup_sigframe(struct rt_sigframe_user_layout *user, __put_user_error(current->thread.fault_code, &esr_ctx->esr, err); } + if (system_supports_gcs() && err == 0 && user->gcs_offset) { + struct gcs_context __user *gcs_ctx = + apply_user_offset(user, user->gcs_offset); + err |= preserve_gcs_context(gcs_ctx); + } + /* Scalable Vector Extension state (including streaming), if present */ if ((system_supports_sve() || system_supports_sme()) && err == 0 && user->sve_offset) { @@ -1214,8 +1329,6 @@ static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig) if (ret != 0) return ret; - gcsb_dsync(); - gcspr_el0 -= 2; write_sysreg_s((unsigned long)gcspr_el0, SYS_GCSPR_EL0);