From patchwork Thu Aug 22 01:15:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13772378 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70B46C52D7C for ; Thu, 22 Aug 2024 01:20:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E9D156B01FF; Wed, 21 Aug 2024 21:20:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E26EA6B0204; Wed, 21 Aug 2024 21:20:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C52786B0202; Wed, 21 Aug 2024 21:20:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id A48886B01FF for ; Wed, 21 Aug 2024 21:20:47 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 67D721A126D for ; Thu, 22 Aug 2024 01:20:47 +0000 (UTC) X-FDA: 82478126934.04.C1E8E1A Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf13.hostedemail.com (Postfix) with ESMTP id A8B1B2001D for ; Thu, 22 Aug 2024 01:20:45 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=NaYbf4co; spf=pass (imf13.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1724289605; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=RA9rgm+BYHbO0h0145MFP0i7mOM9F5uNg+t9Dsthhzk=; b=aHbGDp0DnYKTkESgswbG6x2y/O5v3lOqzCczfpyluKpN2boFw5bc4OuIx4AsE2GBW5zcjv I6U6WRqFi+dhCj4syYvR684DJvamFjNwvfEVZFARNDcqDLFTE1rigcDZ3LsKGKsHaC848s 1YQCqiN2cl5LGDW8qHBuujNf6M/1Z/U= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=NaYbf4co; spf=pass (imf13.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1724289605; a=rsa-sha256; cv=none; b=CAqCNhub5lh7B/k5Ygzb12+ARHrfqYIHqDmuhM/ycsOt+UD3uY/oxpxFPXz73pb2WXwFrw CsftXzD+6PnvAUltUZnX4M/F7eUu05aA17I35ChXEqg95kZU8E7zYiilGM3ltoi0na5jWV kZgkzerse8lODyP5GwqnMePo4Gu/d14= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id E7CB960FE8; Thu, 22 Aug 2024 01:20:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5837FC32781; Thu, 22 Aug 2024 01:20:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1724289644; bh=kXO2GCPjz2S4M/TO1zkwKAs7nkqAlyHosyHP175ZITc=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=NaYbf4coFOlLrG2dAibV7pBvMyx4JDv93vJ1RN5yZgKnTsT0LKjizxRQFsnLXc7ni 3c6Ka9YUXWQzYr7aYO41AkVGYgEFPS+NQLfFED+bGqnnWcPy704vjGLzr/l9kFfXrm KbBBPl00BgaD3OunTXUjrXZYzhmCinTKWhJrinLoPlACm7cPMNUBKZ7APxHOuq1vTq K9bz41XRDSzyQE0Y04SmBZiEmIMo6LQSseYY4rUAEhDxMVeB9Q6GZGUvPwqKUgR2Z0 wRVW+/BLnVdlG0MZrY17HLJoX7GrW4vjHQ9PX5g3FqZcmDN1b+3i/WgbAi+23MuJzY 0yC/Aj21Bh+YQ== From: Mark Brown Date: Thu, 22 Aug 2024 02:15:26 +0100 Subject: [PATCH v11 23/39] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20240822-arm64-gcs-v11-23-41b81947ecb5@kernel.org> References: <20240822-arm64-gcs-v11-0-41b81947ecb5@kernel.org> In-Reply-To: <20240822-arm64-gcs-v11-0-41b81947ecb5@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , Yury Khrustalev , Wilco Dijkstra , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.15-dev-37811 X-Developer-Signature: v=1; a=openpgp-sha256; l=3111; i=broonie@kernel.org; h=from:subject:message-id; bh=kXO2GCPjz2S4M/TO1zkwKAs7nkqAlyHosyHP175ZITc=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBmxpE1uApeg/OZxbiMhFHBoLLG5SrajXWXBeA40vR0 FCpWfjaJATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZsaRNQAKCRAk1otyXVSH0HXKB/ 0dMGFWwbkX4Z9sEwfB0dY/XOaKUlKCCMaPAx1bkgitG6AntCY2Kli+mJ2dVrlsJiiUuOtKpgm2upC/ gAkHa6Qz6FCwyehhZGr3MKK51DmUkjlCYkZv42cAn0qdft6eCTceFbLwHpGhfbtmuoHLWsvBemKz7g bquAPwNz1oLJQtKSHYXnuCFVboTAJ45j7tCfsXIAEQvBKAcKyxt4CZ6uf3R0H1+X+B8Rj9VhKP30tb QvinvkgvrTuEsazsCcV6TDz6yGerenIMpfRa2ff/BSMxGJGaws6R1VIaoOepqTODXo2vjVoavLksF/ dZQVmPYzpTvliSCTAB846/Xjk3IcAK X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspamd-Server: rspam03 X-Rspam-User: X-Rspamd-Queue-Id: A8B1B2001D X-Stat-Signature: w3x8uj9sswswnwe6gssmksjp7jyhdtba X-HE-Tag: 1724289645-593051 X-HE-Meta: U2FsdGVkX19lTLde/k6IimLxvCO9PuYLxPuWzbcoeXtciy6FZPEKl+d7DTbl4yJUOADHYA5Wn4iaVTuJ31Ulx1/HdoAH4vfvyLg/YwmV8ujgJBO72Bz3ewciTLCAZF1tvA5u7lSL7u69C2moHo8OrBUlQYodFDLdTiIIHHCrH4y4XSqWURD3E+S73iSbSEulx4fTTwL+0fpHK83vTpBonyU8ZQkF3kVTTfvYJHHYBBnWGt6z0/XDynP+DqUMVylKdQQUiE0CprLc5LSONhHDHxQwdC6Z16LVYzjFv3pZQt+vs+MYMaHO+XbhLUTJzLUgPZ5UT/5idxo3dVOXWbWct4U738dkQJowMX64NcrO4OO05Vy9P6s3tOGmeAMWsFHAyKOoVYcQypRlNgAkQPiEOEgHGaPfcLwFP0rtc5fHeSNPfDv2N2mrQUYzbD9dh6LKdB27v0USDiY7h3Q1WdQ0oNMC9DhmZHMctXvcfM0e+b7H1fSMfg3SoAaqBAgpCaGmPDWZyJm/JBkP/7g4O7WYB3xyPGAD52Ob5LLLmCD/LcCwTexsny5BA48lWjWk+8+hyTLGDXP/v6JKnADzs708gxBI0hMAplnQ9cpCDzic3cdSnpQ/asjoEPbRVTv3nch3eyIwRazDNVKnxrX1ipy5KR3ebh8F8t+9cSJPuKsFd97hZb4J6HKegc69qLSR6YAWSae1Jyer3r3tgKYC3d35OFTwknZQAacYXRM03gwoaHw7EPTuw/kQRIj5CIlpG9mrur/fLLuOUwEax1kxQmSQHt6u18w/fNI/e/AhYTG41Lpu8q3zkKZaqM5z9QdhCmx3d7IO/kv2v/ReLnP0VcDXxOASsoqHLXGnL2EEA/5mKFpZPyJomsjH8WfQoqYG9Epw/57gvJCgE1t+JHDehW1Us7DLq24hq4NxOMh1gsniHB7EC7aH7ZWp8E7qkPSXnQolGX81uAUIeKN4R2zNg9D Rj2txwUr VkxpHibRbviL/WQ7Z/RfKXzlwGISYBBJ4fcISGePkXKzXF+ooKCGE90pRnlt2NxqZMfQA8Uk26AVjNO+AFdAVYaOBXN8FMlENSyNZpvvH7vZ5uEpX9WzjpROgT21qs3t92+Q1QNIuLgCSDAHDNU01daUEeVX0sguas/zwoZLDckBB44Ql9MF6wawCGgqQXWmmGzhsJ/5Z+9lcDzRBdqeVF0tTb6sfrnss16Toe0ISCWojoQ2kLuhbo6B83Uq2O/wjeECu3FU4J5t4BhJwunwOsjCFSc31b9Cy2T6NsGepwMoAqEsy7F6BZnwGVTJKNeWbIIWyHKZB5jeOBzJQWaxDYw9nVwGIr9VvQ9nCqSvsBv/B/jYXLnubaiWDV7FMc8Al115zkkc+TL1hHfs3HYoqnvMxK28hACGuRLK4fGP6nRypISbkay/ccpf1KH96WBdXD2ugt52t0vLhmGuX90+0wTOexRYCpDpGojOauAUMBcDHu9w1+HEb5eS2fg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown --- arch/arm64/mm/gcs.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 5eb746fdd872..d9614900c910 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -67,6 +67,70 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret = 0; + int cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (!PAGE_ALIGNED(addr)) + return -EINVAL; + + if (size == 8 || !IS_ALIGNED(size, 8)) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + put_user_gcs(cap_val, cap_ptr, &ret); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* + * Ensure the new cap is ordered before standard + * memory accesses to the same location. + */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware.