From patchwork Thu Aug 1 12:06:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13750403 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB102C3DA64 for ; Thu, 1 Aug 2024 13:00:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 79BDD6B00BA; Thu, 1 Aug 2024 09:00:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 71E0F6B00BB; Thu, 1 Aug 2024 09:00:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 598846B00BC; Thu, 1 Aug 2024 09:00:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 338AA6B00BA for ; Thu, 1 Aug 2024 09:00:00 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id E20D780D5B for ; Thu, 1 Aug 2024 12:59:59 +0000 (UTC) X-FDA: 82403684118.25.C051EB0 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf02.hostedemail.com (Postfix) with ESMTP id 199D680028 for ; Thu, 1 Aug 2024 12:59:57 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=LOKxC2BE; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf02.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1722517156; a=rsa-sha256; cv=none; b=6fuI6JWfQN/Ck7T4eeJFMRpTMzE0dPRlpa0lnYNmVeSQ6b29nqoWPomza3pNfb8e3gWjIG PE3QmOtUxRUyuK7nyXb4vbzGsPuyI4HqT3dzlZXEk5U0feiBLTrhTXmpT5kqbezO/ShXoT UAhjvNRa/dips6tWBufLJK56e5O7no8= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=LOKxC2BE; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf02.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1722517156; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=q3mMMJqc9hcPcKKyi0bs/sNguX8AFY5itYEFvsSCOVs=; b=mWuL8amn6l6rC4aanHjdrCsWGmBDbvbFikffHLHicKRd97qKPY17j3POo33GTH+l03FSBr Ksdsqz/RE6MkW21/hJijsiF0Sg3yerqLwRMjj0x/6FYwOTS8I+JHEQ0yV06qKMPrp+dLOX jkLWbIV9ubWUxuEIv786w/Nz8qtQgBU= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 54CCE6285D; Thu, 1 Aug 2024 12:59:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DB4DC4AF10; Thu, 1 Aug 2024 12:59:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1722517197; bh=spmcAZuGAEVkEAa67eKDQiXBrVNYqAUzr8CNYTcqBhY=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=LOKxC2BEeYpWK9TNAcSxZylJbNNavaok4F0MVQF42q8Yo5nRUBk81Vc5hp7w8/t92 LsMDgWc+InmcMqTWZD6/69VxGqhn8WSc/jepxE26Xfnyufj0nXumjxFlUBsNs+QANO wsGcFRMs/c40JG6FRb87QyriRPmvRVk4y2Ueek2ZXoweeHhDkcfCMIx6NCHhu+OnHD YO1IoJd/zisL3Wcvob81CPlcsh03PkB3id0JEO9TBq9xv16rzrNf9kw01lIOzHrOlJ BPOAOCgy24R5t6/RMkEItz3FZv8lRmR9ooY2c9yLuM8DFfv5iJv87hNem9uBs53/KE +CzqmqoYAM82A== From: Mark Brown Date: Thu, 01 Aug 2024 13:06:50 +0100 Subject: [PATCH v10 23/40] arm64/signal: Set up and restore the GCS context for signal handlers MIME-Version: 1.0 Message-Id: <20240801-arm64-gcs-v10-23-699e2bd2190b@kernel.org> References: <20240801-arm64-gcs-v10-0-699e2bd2190b@kernel.org> In-Reply-To: <20240801-arm64-gcs-v10-0-699e2bd2190b@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.15-dev-37811 X-Developer-Signature: v=1; a=openpgp-sha256; l=7410; i=broonie@kernel.org; h=from:subject:message-id; bh=spmcAZuGAEVkEAa67eKDQiXBrVNYqAUzr8CNYTcqBhY=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBmq4YXZ0sZoZTGjIVJ72pSAZqpftvV6uf/BnLmr3c6 L0bOK56JATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZquGFwAKCRAk1otyXVSH0IjCB/ 0Z23quOTSlgLwveoWe21ZO693B3sCcrTDtGb3Hzg4WDqZ9uj/j5i/qrMK30dEijKL3tVwAWZetJbdC 2WG7GAoVWlYz7NSgLF035utHXv7atop4YfEsC7gtLxA3fUFhs4nfAKdQ3QBa0T2W5eGma/lSl2Ca2G 8SqGzsnLGC73oBvSORZGQIzSGU1pObqpdFs7BzC52aKp5o9M0CUN9tf8euB48ecU6cKYR/CE0ojMzE t7N1Q2iznMqMTGkqCNnAbigvxKWgEbj1tVQWHryOfxEqXcYnua5swm2P24nYFFDEJ/lQZOfaH6F9+S Q3xoDOzW11CtSxHYGrsPj4nh7AhDpR X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspamd-Queue-Id: 199D680028 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: dtb4dfe8kxsaamzj4mj9jqxq548tr438 X-HE-Tag: 1722517197-826889 X-HE-Meta: U2FsdGVkX1+hdQbX+KiDqvnq1ixMsk4Qf4vcmx1E69i0QzLsFCJLniiqatnmu1SiTIX+5l02+O1HzlDvEka3IPhX3QVmEGh0RD1PJWHmtoLLim04ffP5b03pCCEwPuCEcWZFWGhb91NvrDtNXg9IT6Djzldf01/ofEYEFBIM+nWPta8GBHCaol5v2oRzTJxNwtNzusTU9gFz/EV6AxIIIAXWPvjbpf/ypd0Mo2MSsGAI92/vwjWf540SwF7anaNphgFC3ehrsWMTcu9diga0ew4bOY4KI8W1TiDS1BJOa93lsPoBeHDqPlP8Jw7xx05XNHre3DpuTytGJ8UzmQLFbZwepQsiRVtfSI7whpl8Dp3cJg3T5QDFZVZ1RyPJ6gRn9LlR+hS3bEADQfJQM5sfEUnhkxjLX/7SZIfxOYKvSOsLxQd3TmHl21F5ekdTVVewFB71nuPSIXF7u4hE32drZe+LmRXsjXWMalBTOgSiDxXxHRyc+POjmxbhKzal359cFf8bAYShzAvnI/kvxO/WXgHT/FWt1irh7Ms3bg2xV3GaXdTtLe+HVD05BjmP2sPI3XabfJt2t1qZd/Nb3FHkMJfYTQfF1j6Bs3WmtiSW0F5iQEJeWrA1JwoK7TYcCUZtuie1ANJJJyPp5GQrsUxepj1lAGl3Hqp4t+ZcvomLl53Zm3ZstleFRe1Lg89/cq5RL5gNf/A0HePhPiVcanfnaP3o5n/dmhW+2qElojFh/NUK7QaSH/q15GYAbq3sDnpDxcAkg4CbcN9ZwVInilG5rSSPoWheSk6YtAneP8fcI1fLc8T8cossqUaGXujlZeNN6Z2eAYwePUgSpmkth4g2FyVp9wapj6k/Zo2yGm8YT8MQDjZnoI1glVp1Pb31s5FvSTT7mzwbRQbDCrzdJlkL0A3Xc7xuLePxPNFBFb7p7JodndbFlqMGwOSbjTclo0o9eiGgbX4ScdGoMpWCMCx eTZY/8W1 +PXrNa07Aqnjxc2KdrJ/Dxsr0OItivCUsRuU9OgDXh4RJ2/hlFScVup5LgRp/Q7pvyzfPZcbRae/4B1KIvRFKjcWyoRFvK9MvpgffswB21FNMXTVC+cKaqdpQv0QNTr6pA5VXMdEyM5F0SZVlaLE+vztbPVKCJnkRd61498fQo/K9m1FBYhKBMkV/5Y4ThG0sitzN/uJU0asODUXNqlwMiApLR54Z97R8U7brEJEZpYi8jcgjLj93CaFhEU7ET12ZWfbgnbXC23xewZzG23YmP+BURrqY6Zd/ib4a0/RWi18HCw2z2HGo/O4xnxap79Vv09It7cQ3YWw4YPO3D1AKYX48GkWunHU8hLbJSQGkSKDGU+YUvgfUIpdUzz1XMzRMIyiS X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: When invoking a signal handler we use the GCS configuration and stack for the current thread. Since we implement signal return by calling the signal handler with a return address set up pointing to a trampoline in the vDSO we need to also configure any active GCS for this by pushing a frame for the trampoline onto the GCS. If we do not do this then signal return will generate a GCS protection fault. In order to guard against attempts to bypass GCS protections via signal return we only allow returning with GCSPR_EL0 pointing to an address where it was previously preempted by a signal. We do this by pushing a cap onto the GCS, this takes the form of an architectural GCS cap token with the top bit set and token type of 0 which we add on signal entry and validate and pop off on signal return. The combination of the top bit being set and the token type mean that this can't be interpreted as a valid token or address. Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- arch/arm64/include/asm/gcs.h | 1 + arch/arm64/kernel/signal.c | 134 +++++++++++++++++++++++++++++++++++++++++-- arch/arm64/mm/gcs.c | 1 + 3 files changed, 131 insertions(+), 5 deletions(-) diff --git a/arch/arm64/include/asm/gcs.h b/arch/arm64/include/asm/gcs.h index 48c97e63e56a..f50660603ecf 100644 --- a/arch/arm64/include/asm/gcs.h +++ b/arch/arm64/include/asm/gcs.h @@ -9,6 +9,7 @@ #include struct kernel_clone_args; +struct ksignal; static inline void gcsb_dsync(void) { diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index 4a77f4976e11..a1e0aa38bff9 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -34,6 +35,37 @@ #include #include +#ifdef CONFIG_ARM64_GCS +/* Extra bit set in the address distinguishing a signal cap token. */ +#define GCS_SIGNAL_CAP_FLAG BIT(63) + +#define GCS_SIGNAL_CAP(addr) ((((unsigned long)addr) & GCS_CAP_ADDR_MASK) | \ + GCS_SIGNAL_CAP_FLAG) + +static bool gcs_signal_cap_valid(u64 addr, u64 val) +{ + /* + * The top bit should be set, this is an invalid address for + * EL0 and will only be set for caps created by signals. + */ + if (!(val & GCS_SIGNAL_CAP_FLAG)) + return false; + + /* The rest should be a standard architectural cap token. */ + val &= ~GCS_SIGNAL_CAP_FLAG; + + /* The cap must not have a token set */ + if (GCS_CAP_TOKEN(val) != 0) + return false; + + /* The cap must store the VA the cap was stored at */ + if (GCS_CAP_ADDR(addr) != GCS_CAP_ADDR(val)) + return false; + + return true; +} +#endif + /* * Do a signal return; undo the signal stack. These are aligned to 128-bit. */ @@ -860,6 +892,50 @@ static int restore_sigframe(struct pt_regs *regs, return err; } +#ifdef CONFIG_ARM64_GCS +static int gcs_restore_signal(void) +{ + u64 gcspr_el0, cap; + int ret; + + if (!system_supports_gcs()) + return 0; + + if (!(current->thread.gcs_el0_mode & PR_SHADOW_STACK_ENABLE)) + return 0; + + gcspr_el0 = read_sysreg_s(SYS_GCSPR_EL0); + + /* + * GCSPR_EL0 should be pointing at a capped GCS, read the cap... + */ + gcsb_dsync(); + ret = copy_from_user(&cap, (__user void*)gcspr_el0, sizeof(cap)); + if (ret) + return -EFAULT; + + /* + * ...then check that the cap is the actual GCS before + * restoring it. + */ + if (!gcs_signal_cap_valid(gcspr_el0, cap)) + return -EINVAL; + + /* Invalidate the token to prevent reuse */ + put_user_gcs(0, (__user void*)gcspr_el0, &ret); + if (ret != 0) + return -EFAULT; + + current->thread.gcspr_el0 = gcspr_el0 + sizeof(cap); + write_sysreg_s(current->thread.gcspr_el0, SYS_GCSPR_EL0); + + return 0; +} + +#else +static int gcs_restore_signal(void) { return 0; } +#endif + SYSCALL_DEFINE0(rt_sigreturn) { struct pt_regs *regs = current_pt_regs(); @@ -886,6 +962,9 @@ SYSCALL_DEFINE0(rt_sigreturn) if (restore_altstack(&frame->uc.uc_stack)) goto badframe; + if (gcs_restore_signal()) + goto badframe; + return regs->regs[0]; badframe: @@ -1130,7 +1209,50 @@ static int get_sigframe(struct rt_sigframe_user_layout *user, return 0; } -static void setup_return(struct pt_regs *regs, struct k_sigaction *ka, +#ifdef CONFIG_ARM64_GCS + +static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig) +{ + unsigned long __user *gcspr_el0; + int ret = 0; + + if (!system_supports_gcs()) + return 0; + + if (!task_gcs_el0_enabled(current)) + return 0; + + /* + * We are entering a signal handler, current register state is + * active. + */ + gcspr_el0 = (unsigned long __user *)read_sysreg_s(SYS_GCSPR_EL0); + + /* + * Push a cap and the GCS entry for the trampoline onto the GCS. + */ + put_user_gcs((unsigned long)sigtramp, gcspr_el0 - 2, &ret); + put_user_gcs(GCS_SIGNAL_CAP(gcspr_el0 - 1), gcspr_el0 - 1, &ret); + if (ret != 0) + return ret; + + gcsb_dsync(); + + gcspr_el0 -= 2; + write_sysreg_s((unsigned long)gcspr_el0, SYS_GCSPR_EL0); + + return 0; +} +#else + +static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig) +{ + return 0; +} + +#endif + +static int setup_return(struct pt_regs *regs, struct ksignal *ksig, struct rt_sigframe_user_layout *user, int usig) { __sigrestore_t sigtramp; @@ -1138,7 +1260,7 @@ static void setup_return(struct pt_regs *regs, struct k_sigaction *ka, regs->regs[0] = usig; regs->sp = (unsigned long)user->sigframe; regs->regs[29] = (unsigned long)&user->next_frame->fp; - regs->pc = (unsigned long)ka->sa.sa_handler; + regs->pc = (unsigned long)ksig->ka.sa.sa_handler; /* * Signal delivery is a (wacky) indirect function call in @@ -1178,12 +1300,14 @@ static void setup_return(struct pt_regs *regs, struct k_sigaction *ka, sme_smstop(); } - if (ka->sa.sa_flags & SA_RESTORER) - sigtramp = ka->sa.sa_restorer; + if (ksig->ka.sa.sa_flags & SA_RESTORER) + sigtramp = ksig->ka.sa.sa_restorer; else sigtramp = VDSO_SYMBOL(current->mm->context.vdso, sigtramp); regs->regs[30] = (unsigned long)sigtramp; + + return gcs_signal_entry(sigtramp, ksig); } static int setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set, @@ -1206,7 +1330,7 @@ static int setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set, err |= __save_altstack(&frame->uc.uc_stack, regs->sp); err |= setup_sigframe(&user, regs, set); if (err == 0) { - setup_return(regs, &ksig->ka, &user, usig); + err = setup_return(regs, ksig, &user, usig); if (ksig->ka.sa.sa_flags & SA_SIGINFO) { err |= copy_siginfo_to_user(&frame->info, &ksig->info); regs->regs[1] = (unsigned long)&frame->info; diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 6703c70581a4..30614f4ad164 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -6,6 +6,7 @@ #include #include +#include #include static unsigned long alloc_gcs(unsigned long addr, unsigned long size)