| Message ID | 20240801-arm64-gcs-v10-22-699e2bd2190b@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | arm64/gcs: Provide support for GCS in userspace | expand |
On Thu, Aug 01, 2024 at 01:06:49PM +0100, Mark Brown wrote: > +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) > +{ > + unsigned long alloc_size; > + unsigned long __user *cap_ptr; > + unsigned long cap_val; > + int ret = 0; > + int cap_offset; > + > + if (!system_supports_gcs()) > + return -EOPNOTSUPP; > + > + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) > + return -EINVAL; > + > + if (addr && (addr % PAGE_SIZE)) > + return -EINVAL; > + > + if (size == 8 || size % 8) > + return -EINVAL; Nitpicks: use PAGE_ALIGNED and IS_ALIGNED(size, 8). > + > + /* > + * An overflow would result in attempting to write the restore token > + * to the wrong location. Not catastrophic, but just return the right > + * error code and block it. > + */ > + alloc_size = PAGE_ALIGN(size); > + if (alloc_size < size) > + return -EOVERFLOW; > + > + addr = alloc_gcs(addr, alloc_size); > + if (IS_ERR_VALUE(addr)) > + return addr; > + > + /* > + * Put a cap token at the end of the allocated region so it > + * can be switched to. > + */ > + if (flags & SHADOW_STACK_SET_TOKEN) { > + /* Leave an extra empty frame as a top of stack marker? */ > + if (flags & SHADOW_STACK_SET_MARKER) > + cap_offset = 2; > + else > + cap_offset = 1; > + > + cap_ptr = (unsigned long __user *)(addr + size - > + (cap_offset * sizeof(unsigned long))); > + cap_val = GCS_CAP(cap_ptr); > + > + put_user_gcs(cap_val, cap_ptr, &ret); > + if (ret != 0) { > + vm_munmap(addr, size); > + return -EFAULT; > + } > + > + /* Ensure the new cap is viaible for GCS */ > + gcsb_dsync(); s/viaible/visible/ On the comment itself, the barrier does not ensure visibility in absolute term, it's all about ordering relative to other accesses. It might be good to clarify what we actually need in terms of ordering. One aspect came up in an earlier patch was around thread creation. For the current CPU, subsequent GCS accesses in program order will see this token. Classic LDR/STR won't without the barrier. I think this matters when we check the token in the clone3() implementation. Maybe write something along the lines of "ensure the new cap is ordered before standard memory accesses to the same location". Anyway, the patch looks fine. Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 0d39829f862e..6703c70581a4 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -140,6 +140,67 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret = 0; + int cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (addr && (addr % PAGE_SIZE)) + return -EINVAL; + + if (size == 8 || size % 8) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + put_user_gcs(cap_val, cap_ptr, &ret); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* Ensure the new cap is viaible for GCS */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware.
As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org> Signed-off-by: Mark Brown <broonie@kernel.org> --- arch/arm64/mm/gcs.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+)