| Message ID | 20230716-arm64-gcs-v1-21-bf567f93bba6@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | arm64/gcs: Provide support for GCS at EL0 | expand |
On Sun, 2023-07-16 at 22:51 +0100, Mark Brown wrote: > +int arch_set_shadow_stack_status(struct task_struct *task, unsigned > long arg) > +{ > + unsigned long gcs, size; > + > + if (!system_supports_gcs()) > + return -EINVAL; > + > + if (is_compat_thread(task_thread_info(task))) > + return -EINVAL; > + > + /* Reject unknown flags */ > + if (arg & ~PR_SHADOW_STACK_SUPPORTED_STATUS_MASK) > + return -EINVAL; > + > + /* If the task has been locked block any attempted changes */ > + if (task->thread.gcs_el0_mode & PR_SHADOW_STACK_LOCK) > + return -EBUSY; > + > + /* Drop flags other than lock if disabling */ > + if (!(arg & PR_SHADOW_STACK_ENABLE)) > + arg &= ~PR_SHADOW_STACK_LOCK; > + > + /* If we are enabling GCS then make sure we have a stack */ > + if (arg & PR_SHADOW_STACK_ENABLE) { > + if (!task_gcs_el0_enabled(task)) { > + /* Do not allow GCS to be reenabled */ > + if (task->thread.gcs_base) > + return -EINVAL; > + > + size = gcs_size(0); > + gcs = alloc_gcs(task->thread.gcspr_el0, size, > + 0, 0); > + if (!gcs) > + return -ENOMEM; > + > + task->thread.gcspr_el0 = gcs + size - > sizeof(u64); > + task->thread.gcs_base = gcs; > + task->thread.gcs_size = size; > + if (task == current) > + write_sysreg_s(task- > >thread.gcspr_el0, > + SYS_GCSPR_EL0); > + > + } > + } > + > + task->thread.gcs_el0_mode = arg; > + if (task == current) > + gcs_set_el0_mode(task); > + Ah! So does this task == current part mean this can be called from another task via ptrace? If so, then is the alloc_gcs() part on the wrong mm?
On Tue, Jul 18, 2023 at 05:51:54PM +0000, Edgecombe, Rick P wrote: > On Sun, 2023-07-16 at 22:51 +0100, Mark Brown wrote: > > + gcs = alloc_gcs(task->thread.gcspr_el0, size, > > + 0, 0); > > + if (!gcs) > > + return -ENOMEM; > > + task->thread.gcs_el0_mode = arg; > > + if (task == current) > > + gcs_set_el0_mode(task); > > + > Ah! So does this task == current part mean this can be called from > another task via ptrace? Ugh, right. So I had been worried about preemption rather than invoking prctl() via ptrace, though since ptrace can change the syscall invoked by a task it could cause prctl() to be invoked that way (but that should look like being run in the target process). I'm not aware of an interface specifically intended to remotely invoke prctls via ptrace but that doesn't mean there isn't one that I didn't find yet. I can't remember why I'm aware of the task != current case as a concern which is worrying me. > If so, then is the alloc_gcs() part on the wrong mm? Yes, it will be. I'll add a check in there to reject attempts to enable GCS when task != current.
diff --git a/arch/arm64/include/asm/gcs.h b/arch/arm64/include/asm/gcs.h index 4371a2f99b4a..8655ba8054c7 100644 --- a/arch/arm64/include/asm/gcs.h +++ b/arch/arm64/include/asm/gcs.h @@ -48,6 +48,10 @@ static inline u64 gcsss2(void) return Xt; } +#define PR_SHADOW_STACK_SUPPORTED_STATUS_MASK \ + (PR_SHADOW_STACK_LOCK | PR_SHADOW_STACK_ENABLE | \ + PR_SHADOW_STACK_WRITE | PR_SHADOW_STACK_PUSH) + #ifdef CONFIG_ARM64_GCS static inline bool task_gcs_el0_enabled(struct task_struct *task) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 1e059c37088d..b137493c594d 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -93,3 +93,67 @@ void gcs_free(struct task_struct *task) task->thread.gcs_base = 0; task->thread.gcs_size = 0; } + +int arch_set_shadow_stack_status(struct task_struct *task, unsigned long arg) +{ + unsigned long gcs, size; + + if (!system_supports_gcs()) + return -EINVAL; + + if (is_compat_thread(task_thread_info(task))) + return -EINVAL; + + /* Reject unknown flags */ + if (arg & ~PR_SHADOW_STACK_SUPPORTED_STATUS_MASK) + return -EINVAL; + + /* If the task has been locked block any attempted changes */ + if (task->thread.gcs_el0_mode & PR_SHADOW_STACK_LOCK) + return -EBUSY; + + /* Drop flags other than lock if disabling */ + if (!(arg & PR_SHADOW_STACK_ENABLE)) + arg &= ~PR_SHADOW_STACK_LOCK; + + /* If we are enabling GCS then make sure we have a stack */ + if (arg & PR_SHADOW_STACK_ENABLE) { + if (!task_gcs_el0_enabled(task)) { + /* Do not allow GCS to be reenabled */ + if (task->thread.gcs_base) + return -EINVAL; + + size = gcs_size(0); + gcs = alloc_gcs(task->thread.gcspr_el0, size, + 0, 0); + if (!gcs) + return -ENOMEM; + + task->thread.gcspr_el0 = gcs + size - sizeof(u64); + task->thread.gcs_base = gcs; + task->thread.gcs_size = size; + if (task == current) + write_sysreg_s(task->thread.gcspr_el0, + SYS_GCSPR_EL0); + + } + } + + task->thread.gcs_el0_mode = arg; + if (task == current) + gcs_set_el0_mode(task); + + return 0; +} + +int arch_get_shadow_stack_status(struct task_struct *task, + unsigned long __user *arg) +{ + if (!system_supports_gcs()) + return -EINVAL; + + if (is_compat_thread(task_thread_info(task))) + return -EINVAL; + + return put_user(task->thread.gcs_el0_mode, arg); +}
Implement the architecture neutral prtctl() interface for setting the shadow stack status, this supports setting and reading the current GCS configuration for the current thread. Userspace can enable basic GCS functionality and additionally also support for GCS pushes and arbatrary GCS stores. It is expected that this prctl() will be called very early in application startup, for example by the dynamic linker, and not subsequently adjusted during normal operation. Users should carefully note that after enabling GCS for a thread GCS will become active with no call stack so it is not normally possible to return from the function that invoked the prctl(). State is stored per thread, enabling GCS for a thread causes a GCS to be allocated for that thread. Userspace may lock the current GCS configuration by specifying PR_SHADOW_STACK_ENABLE_LOCK, this prevents any further changes to the GCS configuration via any means. If GCS is not being enabled then all flags other than _LOCK are ignored, it is not possible to enable stores or pops without enabling GCS. When disabling the GCS we do not free the allocated stack, this allows for inspection of the GCS after disabling as part of fault reporting. Since it is not an expected use case and since it presents some complications in determining what to do with previously initialsed data on the GCS attempts to reenable GCS after this are rejected. This can be revisted if a use case arises. Signed-off-by: Mark Brown <broonie@kernel.org> --- arch/arm64/include/asm/gcs.h | 4 +++ arch/arm64/mm/gcs.c | 64 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+)