From patchwork Thu Aug 1 12:06:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13750402 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F13F7C3DA4A for ; Thu, 1 Aug 2024 12:59:56 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8A6326B00B8; Thu, 1 Aug 2024 08:59:56 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 82FD46B00B9; Thu, 1 Aug 2024 08:59:56 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6A8786B00BA; Thu, 1 Aug 2024 08:59:56 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 444986B00B8 for ; Thu, 1 Aug 2024 08:59:56 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id E4C2BA779C for ; Thu, 1 Aug 2024 12:59:55 +0000 (UTC) X-FDA: 82403683950.23.E22AD5B Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf13.hostedemail.com (Postfix) with ESMTP id 8421A20015 for ; Thu, 1 Aug 2024 12:59:53 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=f+gcjC8U; spf=pass (imf13.hostedemail.com: domain of broonie@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1722517149; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Fc3efdaWdHZ66wwAfskzSCLEVc53sAtjfnpn9IMT5MI=; b=nfHkyAc4gmWkNpj/8YMIilxa4iOrryXOj3z1Jg2MwPmBINJB1VWBesGEjOgwE50LZx43C7 mqm1jpUYSKE+ARLVDTG8ngKesZ7WkGK00dUGgwP/dqrmfQ0dL6x938CVA7aTBDz3nOt55E gOL0Bqg2QhZoWlvEMYRarS7UEeTqymE= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=f+gcjC8U; spf=pass (imf13.hostedemail.com: domain of broonie@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1722517149; a=rsa-sha256; cv=none; b=vvZQjh81H0ONLtIe1RJgSfQUarcJkEgwHWgFwmyEl9zmND+hxQMxmWWofvxCItpM3v7IrP skL/q5oca0uRjlid7O/onShTz2ulkOYlCS0qh/ILR27WI3pyYWGh0YtNjEhASucpYu9bOw 7GIV8nGeKY8yK+O6w+X20yZx1TnvBQ8= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id DECE0CE193F; Thu, 1 Aug 2024 12:59:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7C84C4AF09; Thu, 1 Aug 2024 12:59:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1722517190; bh=sHUTBcC9ajPqHUJTppDeK0B3kuOgTQJMo9ToCm1jbwg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=f+gcjC8U0DPC9CuVb9hizzrLAAK+UQ4RNTiDbO40spLPhXmrdjZh1UH7Ysws0Iy3F g5XzrUnTYPXWfPP/ApA+KHfbyxXbkQq+n6ctqR8btWf77VzdJvfjokIudQYe3QObZb 412kswTUa4acYd4oKwR5hCgQLRPO+Is+8AGse/LeIzY1Ut5IbYqRR8U2D282SpGEbM tQ5BFRkyvhxTL4MM0YegHjz7PAnmbejqSt6QVly2yZ56V2TH+3Sf2JVhxzVA7K7cOT TZEmFWVliuG0+RPnKnQb/rEQ2NSVglRQ4rN0BLrR2xyeJy1K1sKZuE/e9NFD0EACWP t5apF7XojBzYA== From: Mark Brown Date: Thu, 01 Aug 2024 13:06:49 +0100 Subject: [PATCH v10 22/40] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20240801-arm64-gcs-v10-22-699e2bd2190b@kernel.org> References: <20240801-arm64-gcs-v10-0-699e2bd2190b@kernel.org> In-Reply-To: <20240801-arm64-gcs-v10-0-699e2bd2190b@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.15-dev-37811 X-Developer-Signature: v=1; a=openpgp-sha256; l=2987; i=broonie@kernel.org; h=from:subject:message-id; bh=sHUTBcC9ajPqHUJTppDeK0B3kuOgTQJMo9ToCm1jbwg=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBmq4YXropMdlIS63qshvA6lvojkCo/oAO1adQXBQBZ Du9YUr6JATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZquGFwAKCRAk1otyXVSH0KkqB/ 4/6Y5UAvVw7VWYaEMICrtZg2DSoyU9nSsx2DULzGCY2jNoB49lfqczc/CSIkCdRyAuotj32onJgufj pKduK9m0qZx9Ob+aLo/exl96WDp0nsUmlbefih+oqecwlVtHnSbPTZTuFCpJkKDEEn9UykoGt6JthV O2s4dsnE5i97W3LA80/j8e4vtjd/PTN2RY2ltQ3diEG/YffcHg2W/twN1vBsbrob58yQjz2gMMaYL0 +Fq1SA3+ujMf9iwgmhW6W90O1/FB2S9WnCTeOm18Qd2ZmoDbK1gUc7476SyQWt0lfpyxnPzEFAy/6A xF+nEgrw9zHLV3CAbGKtwlwTT3VH63 X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Stat-Signature: 5utz8ge7u8e68da68ue165cfhgh6ugbb X-Rspam-User: X-Rspamd-Queue-Id: 8421A20015 X-Rspamd-Server: rspam02 X-HE-Tag: 1722517193-955693 X-HE-Meta: U2FsdGVkX18Uko+FKRasf5Jao93pG+x/xUevWJxTLHVQC8k4ZDhwgu4Wez/l4BAjARTngjGA4f2Mvw6dRfRTehQh5JZw1jBMnDLsvBEOiAVg/KadxG5E1u0/DANpomFlFA0eZoUkU+SuVeKPbuflCR+6KSMFr8JzU9YyM3uy8FzCUg4iqfsPPx3ae/JO62kJtjPmaU4YNNXvGpldfN/aHCE7puyS5QSZKQOJxBCzt3PAPkRGlrVVSP7kCTj2bbmUzz7KVIbVOB2KtTgggcHtS5eqCxQpFEE5bRUA9chfSC1nBl+azL2WkZ1BBVQyRAUv5M9aK3Q6kR4fAVltaVn25YRhOle5G5Yil5GhhXUc4sMMhxfaYnFWQ2aKSQUvJzrzpp9oU2kNbXZGW83ocAQfZ1kUsB2hFRX2cxF740jtU/istLiwDYbKuZQ4lB/XOo1cjGGzVxwirt+Y0WLSmyWXTNgm6PtswvNa4u1nEyWtAT9yLobp1UDQBEaWtSgOp+QH1IJfoac5bWbb056+GNqgsV0ANXJLIbzNeTb2mqRt4RMtKCwRwLyzFgbQjyKb9Zx4KgTy9yuDoOa528tf1cdOpgJUQNtIgndYMkBg5IADFjhVONbAlScLJ1RHbkmS5WdFnAXyXhQSKAKzKgnbIkOXr874JtNuYhKbuVIrMfO/sBlLAdswdRxRhSFDUIo97R+4b4FevZPvl/LDZTXqq5zZQZuo5EGXVK1o9BdUw0IK24Byp+QsZhE2R5b1FTXgnv8qXCaruSgPr4pJNA0vrE7Cf25dael5NOe+5v7h/v9Q1k3cagUUFtMVr5Lzh26OjrrjUOgybtX4IuEC4Nmu0/ISwoeLCmix314Slpgi1rR9p0EmBb2//wBsv3ZC3/Gf0/D5uYhpj59FRCuQAD7aTqIGZhuCDHRrpj1S+22gFFKCKzsvZjAhu9qhDRKBEMfEs0dgtZXo8QNtiNkiEm97Fiw rta9RHz0 6tZIxvK1M04X8mUdfQBIpSVROZzBXvzJ3eGQ1sCOg+JxsCOVslONUnHcqoAa9yd46A1FfzljR9hfFo82nEqCHzR8eFvbmKlmvP1G0L8L9kRAEO9smc1DYcMcDd1VL2tvGEdrzq6TW8SUBtrJCIxbQ2hoV9EtGWRXZi8pFAVn7WpBygEPnl6Qr4E2A9ZXjF02cFvQfs5uNOos0lh5HScRCRVsiaZkOJXcv+Z4YQxwlAywbgW0JXjPDkFpes3L8Sscb8lw46hI0Kd6RpEDBsPfgrBnEfBxqGfMaEZnEAm1AJmTooV35NU4kYBNO4LloPdEFBH3KJE22CIHm+ErRM871/RZVPOT/p8/mGld+85Xvme4kwLFaEyGMrx6eTwqFcKbs7fheyHCrm9iGPq5TGzLzgcfBRAGEQ9HlnRWzIiWjrZpGuFM= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mark Brown Reviewed-by: Catalin Marinas --- arch/arm64/mm/gcs.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 0d39829f862e..6703c70581a4 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -140,6 +140,67 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret = 0; + int cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (addr && (addr % PAGE_SIZE)) + return -EINVAL; + + if (size == 8 || size % 8) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + put_user_gcs(cap_val, cap_ptr, &ret); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* Ensure the new cap is viaible for GCS */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware.