From patchwork Mon Feb 13 04:53:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13137857 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E853C636D7 for ; Mon, 13 Feb 2023 04:54:14 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 899B46B0073; Sun, 12 Feb 2023 23:54:13 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 821E96B0074; Sun, 12 Feb 2023 23:54:13 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6EA796B0075; Sun, 12 Feb 2023 23:54:13 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 60D476B0073 for ; Sun, 12 Feb 2023 23:54:13 -0500 (EST) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 3ADF4A13E4 for ; Mon, 13 Feb 2023 04:54:13 +0000 (UTC) X-FDA: 80461051986.24.3566441 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by imf16.hostedemail.com (Postfix) with ESMTP id 6661618000C for ; Mon, 13 Feb 2023 04:54:10 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=rivosinc-com.20210112.gappssmtp.com header.s=20210112 header.b=vt+qlNRD; dmarc=none; spf=pass (imf16.hostedemail.com: domain of debug@rivosinc.com designates 209.85.216.53 as permitted sender) smtp.mailfrom=debug@rivosinc.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1676264050; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Lt6u6bYwhuTYMTt/YfubY13MWrPuafF8Y1u+P5cWyE8=; b=0zNkKiX0lUyhAEKklIDjXhiCs8Lmf3AmkqixT0jo9ElOFesXgM4/zuXaFEom/PBOzPuZ6Z EiwAdWB8nneDY9N0SrsR7ikWTn5Wgm0+2CJsYvztUhJzK81EFsBvMP5sV+V9afKiOTiKUr ZEsi4vDapTfi8Ug4bz5baD1wCUqX4gQ= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=rivosinc-com.20210112.gappssmtp.com header.s=20210112 header.b=vt+qlNRD; dmarc=none; spf=pass (imf16.hostedemail.com: domain of debug@rivosinc.com designates 209.85.216.53 as permitted sender) smtp.mailfrom=debug@rivosinc.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1676264050; a=rsa-sha256; cv=none; b=TbZYi381h/SFd49/II4YwpiT+OlhHuOYFi5B6RipYzvAryvGkM6R1rWkk7TRb8GZvqpueL /E8i08kxRUNKj12OTcfwr9LeRZAvknxYk7yquY7cllKCcdHJag4neUFo35igRvMqOvJjZt yibN5RJUqkCwp2fd5DYFBu03KG8aJC0= Received: by mail-pj1-f53.google.com with SMTP id bg2so1476040pjb.4 for ; Sun, 12 Feb 2023 20:54:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Lt6u6bYwhuTYMTt/YfubY13MWrPuafF8Y1u+P5cWyE8=; b=vt+qlNRDi7mRznlVUmbqj3O98hmw8TzQhEaLZE107DASJjh3mP5YoOhuFoE/yDgncn OCvZHgb1zW/hH2iTg9NRv5Wvr+diw7rZF11dNmNK02h8Eanq2/2oPPW05Ri4S37QtvJL 22/4YVAOYRBOGaZ1sF7hoskBSUqcx3veQeIhV7or5WE2e3hlEkKjqfifPGWWsd0kxu/j WAyBfRKGlvAkydGHT9alybIs4NM7Z4c5f3VlNPpGkMhJwjPyX420tB4sAm4543ChntNk KKPDv0GKHwLrhhldTsJrjzkPUijMNypauZOdcTMX5tonq3hrIgVD+1N6zaNBQE3PWR3U 6B0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Lt6u6bYwhuTYMTt/YfubY13MWrPuafF8Y1u+P5cWyE8=; b=3yTIiqtCDGKzBeCSR+SyoT3Ja238gX/9ozX64LsebOloCVJjxh+TV60YELcwdLQANp ixglkuEO5/gxFkCAj7LIl/BbCQObUoFSS7mXggbmCYpyL7QC0dZipRq6B9AiaMbXuhuR COwCKpzdGbWj9obYLxk2/XFhS44nVd+yfDQKMM43+Z0AMciBMYyr85BkE9RzzlE96i5g yBFyyB+o86aXGrUuUVjFQCNjNV2Xa0ryvrn+y2dIpUmy2c/XlIrSRwpgs6X+8LbWQxmm 5Lf3hv6zdDvQwOXpcQYNfZdIYjeb40O4+dhBKTRuQrr0CEB8usdmngJSonnrU/bmKeS6 NwjA== X-Gm-Message-State: AO0yUKVym5/kb19DEl7dU7IG55oewM/K9myyEqh/7Erzk1gmw5tyfS+G vOEJT0r5U1btXuv7kd3wCs5vKA== X-Google-Smtp-Source: AK7set/M2hXnLP/wI4jka3ngVh/rpW9tQNim5nRuWweSNonl8MMrLnl7Zea2Dyx/IgKeNWfXUHLJEQ== X-Received: by 2002:a17:902:dcc5:b0:199:482f:d4c4 with SMTP id t5-20020a170902dcc500b00199482fd4c4mr13241724pll.44.1676264049102; Sun, 12 Feb 2023 20:54:09 -0800 (PST) Received: from debug.ba.rivosinc.com ([66.220.2.162]) by smtp.gmail.com with ESMTPSA id e5-20020a170902784500b00189e7cb8b89sm7078303pln.127.2023.02.12.20.54.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Feb 2023 20:54:08 -0800 (PST) From: Deepak Gupta To: linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Arnd Bergmann , Andrew Morton , Paul Walmsley , Palmer Dabbelt , Albert Ou Cc: Deepak Gupta , linux-arch@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH v1 RFC Zisslpcfi 05/20] mmap : Introducing new protection "PROT_SHADOWSTACK" for mmap Date: Sun, 12 Feb 2023 20:53:34 -0800 Message-Id: <20230213045351.3945824-6-debug@rivosinc.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230213045351.3945824-1-debug@rivosinc.com> References: <20230213045351.3945824-1-debug@rivosinc.com> MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 6661618000C X-Stat-Signature: e8yuburpd3fzcaqffjbuatzsw4cjdsqh X-HE-Tag: 1676264050-962689 X-HE-Meta: U2FsdGVkX1/nWnnqZvHmCQ/zhFpTMCfSkpbpl6199tMIL7s6Pa3ZGsV14XW/F3qFGl2YG7iODtZi72SloZ3ZV0ehtQBXHke2HU0YhEkgf0+/XxEn9lHG5R420PeeQKwFGVAKdlvkzA/cNwcXdiv2GvDDyhA1ebwsQLNC4mjggkJVhB7HjZYHVeIg657uSuG1VzQ1E1TiOr8iwWkEJKCJS32IPrYfwESsaC0bTW3sk4+049MU/zi9gSArl8di0Mr965kWM0kjDbMC4/Kv8DCZIMDi+Xn/dRdpyK0wC3wBcoEPQ0a7Mf9j9fa3b4nSg9mDeK1bG5fggRbY/PKLLEghFdcWEmklGp1oQ+6+/oOaAV+bZ3n870j+rzBTzGL5VGSxNyb6DVR9BshAO++BS8IIsB6ZJAMFvZ/XqwcUU1yFu4ReQGF24dQrBYLVU9I7pqa4AemU63NtoAvD/pb4iWP7VMVPnbXtdYEg0/mt1tqxH4qs0yM2N7yEp430C1Nr2UoY/a6WjOM7FwS5nYxn9efCj2LtCF4Bgo2iHM29wtD3M+Ez+vekwGf1CZDpDd2HhB6Jl/ABiLXi52UqfpN3p4hLiyxAEtp2a1jpknGA8nbYc3Md32+WiChmFcISvnfFB6mdkUEhbZc7/LwmNPGvUyygHeZf58Vwvtc6ykkQaUimvgHgc/1sNxRlh0Wym7CrFzLgjd0arCHydXyuO9Wlt+gKSfXkwIOS3Cjlnk0fT11uY0a5NvRJn3tOlb27A5xKRp6l5dEqZdfyO9AbTt27g2H4HnohwCU70N3NudnsMiiswSWTGm6EVUrl+9ABJC9nXigs6xIfpjuN+SgucVjKjV1QBBGYdyXAVWVkXhbVK/EIacsVRHoT/6p+xlCsKl5nkUZh2kXJnRli3qCz4IOb11AZI7ns6P0KBkCvxEyieo4/ET/bX7AhNuslZ37sxEmZRKSR7S5PKH3tSqj5Cqt0Ar4 10kyRmsD h0lruTg7NA3RmhftBECPtOchcJlqpLK/G2Q1xcactxVg4cwzH30bYgBdtE10Qv3+3Be4IOFGcmeKO5ti6J5HwSS/dsG54r9RU8blPtXj7rGpW+fjm09qVD9eLT9oYZMP0q/p1H0Gxd27vXQmiQ1eTZ20uWiQg0jfC90Edwbf53O9I5ikFfmwUxOWVkFXxs919Ck4XAi4nOPawnKNXrSAbGy45kAbaEvv79Iu4E3aaLJUkVTGpuMfGCf9RAa74eP6ejgzhz0ljkLYDtKhSGmaQx+2h4zkbYGCEy3/rY/ZcFTsGNDigTsJZyOV6Z/6uowgiVqv6NJGHXaSrfo9ngNVzVLFiHKDvxolvGELyEQTedBJl7h+HPR1YskiVI1Ssqb00o2iI6UsD3EYHjzE+515nMgIXGfd/tfnZ6s0EblAqGVxSbSJOixWbBmn2filkhR6lzekiJ1n+koRVIKEKciYA1O63vCLnmJSrv/vTibVzi5wz1eSzKv6zk958SEkC3DG/7/p4fKsUWg2fLxJUG5t8wn8HzLqZsrxm3Ag1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Major architectures (x86, arm, riscv) have introduced shadow stack support in their architecture for return control flow integrity ISA extensions have some special encodings to make sure this shadow stack page has special property in page table i.e a readonly page but still writeable under special scenarios. As an example x86 has `call` (or new shadow stack instructions) which can perform store on shadow stack but regular stores are disallowed. Similarly riscv has sspush & ssamoswap instruction which can perform stores but regular stores are not allowed. As evident a page which can only be writeable by certain special instructions but otherwise appear readonly to regular stores need a new protection flag. This patch introduces a new mmap protection flag to indicate such protection in generic manner. Architectures can implement such protection using arch specific encodings in page tables. Signed-off-by: Deepak Gupta --- include/uapi/asm-generic/mman-common.h | 6 ++++++ mm/mmap.c | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/include/uapi/asm-generic/mman-common.h b/include/uapi/asm-generic/mman-common.h index 6ce1f1ceb432..c8e549b29a24 100644 --- a/include/uapi/asm-generic/mman-common.h +++ b/include/uapi/asm-generic/mman-common.h @@ -11,6 +11,12 @@ #define PROT_WRITE 0x2 /* page can be written */ #define PROT_EXEC 0x4 /* page can be executed */ #define PROT_SEM 0x8 /* page may be used for atomic ops */ +/* + * Major architectures (x86, aarch64, riscv) have shadow stack now. Each architecture can + * choose to implement different PTE encodings. x86 encodings are PTE.R=0, PTE.W=1, PTE.D=1 + * riscv encodings are PTE.R=0, PTE.W=1. Aarch64 encodings are not published yet + */ +#define PROT_SHADOWSTACK 0x40 /* 0x10 reserved for arch-specific use */ /* 0x20 reserved for arch-specific use */ #define PROT_NONE 0x0 /* page can not be accessed */ diff --git a/mm/mmap.c b/mm/mmap.c index 425a9349e610..7e877c93d711 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -46,6 +46,7 @@ #include #include #include +#include #include #include @@ -1251,6 +1252,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr, if (!len) return -EINVAL; + /* If PROT_SHADOWSTACK is specified and arch doesn't support it, return -EINVAL */ + if ((prot & PROT_SHADOWSTACK) && !arch_supports_shadow_stack()) + return -EINVAL; /* * Does the application expect PROT_READ to imply PROT_EXEC? *