From patchwork Tue Oct 1 22:59:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13818924 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B88BCF3189 for ; Tue, 1 Oct 2024 23:04:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 184D7680032; Tue, 1 Oct 2024 19:04:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 130A368002B; Tue, 1 Oct 2024 19:04:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EEBC4680032; Tue, 1 Oct 2024 19:04:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id D021768002B for ; Tue, 1 Oct 2024 19:04:29 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 86F8A120626 for ; Tue, 1 Oct 2024 23:04:29 +0000 (UTC) X-FDA: 82626564258.01.911CE76 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf01.hostedemail.com (Postfix) with ESMTP id BB19E40002 for ; Tue, 1 Oct 2024 23:04:27 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="R5eOO/Cw"; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf01.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1727823727; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=s7U+AEnEZ/86QVHIFT7ifqq4f0SbQ3oMq9CvtsC2OSQ=; b=62pPdqa4FOnUCaosxEA8d9+J3KHkln3p0Qq8O7oSMDAzSv2x+Th4lJhV9QDNjYdQaHLAMR uoWCBjUJqMpGrflg79hI8DrRFXONdVsexxdRxyopiDN8JrmLW5BPkQ/M/8k8fNgM/nFSsl ri9dMtcE+mkWlJ0RFmOG4oR0pt2iCS0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1727823727; a=rsa-sha256; cv=none; b=AHCFBzsFDjZUc1esflaAifS+NKtxj8rSUduA4Q51Kux8N700j6ohUHkQeelaOgkJaB5KGQ +aB3vlMQZGyy4qvVxN46dhPuDrCvhehXf2GLFYeTcUw0ZeCr4SyixDFUWnEKaIewV1Kgff Wx4N4lV0HSGlXuvgKmEaMI9IuHyVzPc= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="R5eOO/Cw"; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf01.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id EF91C5C0339; Tue, 1 Oct 2024 23:04:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2731BC4CEC6; Tue, 1 Oct 2024 23:04:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1727823866; bh=qUaWHBHdN5KhPSaC2shYeXLiosV3WxoA3aMO7oZsLVE=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=R5eOO/CwUjlApWCgKSs8nP1G9FbTW6gonLZZKFpKZtiXZTuq5ksbI0wpEZjOTU8yG xKBo6Dd0I2/GI0kHJEkkXYarMC1cRGNbblyUwlD/NHUJB0gNe2M34+Pvj+i5NMs2oW AQUVAUxEn0i8MeiNshGyJtj0LUF/KvnAe3Q76pZS78zE69xC5Ne9aYD9h3mJjXX39m WvwPuQhQeS2KJ4LBzyZMXZmT9HjML+MzgorTHGfC0IFNwyg630Fv4fYif2qm7VlHqP ieU/iLIRdW7+XBOXwFy6sWKRc9mDVgT4WTb5lVgTRBUoaFCDboJBJV5vPgPvvQHQfu x3so/N3EBojRw== From: Mark Brown Date: Tue, 01 Oct 2024 23:59:03 +0100 Subject: [PATCH v13 24/40] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20241001-arm64-gcs-v13-24-222b78d87eee@kernel.org> References: <20241001-arm64-gcs-v13-0-222b78d87eee@kernel.org> In-Reply-To: <20241001-arm64-gcs-v13-0-222b78d87eee@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , David Spickett , Yury Khrustalev , Wilco Dijkstra , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.15-dev-99b12 X-Developer-Signature: v=1; a=openpgp-sha256; l=3164; i=broonie@kernel.org; h=from:subject:message-id; bh=qUaWHBHdN5KhPSaC2shYeXLiosV3WxoA3aMO7oZsLVE=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBm/H7W5jFfBYx0dD/AiVB3co7PUfmUOb1RGg81DGmy uzTdjduJATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZvx+1gAKCRAk1otyXVSH0O7/B/ 42dRKw5u6PwVHw5uyGMv0ruX389ObAvdjm3Y36WIttnDUP0tWY+nfpebp14vMHoDi1oOFtcjrptu1r ZlVTVs7h1ekurkDzRQ2XJm89Mop9C4VeausdyagksJAtlGy43yqbrsMZysKPPEPLgeMJrgL+bs0yhY hHpo0pRPoFNGUK3Jzl9WSDCsKobZbzpSDpA+7AdL8f93D4UFUH7XCRkK0oY7mo/u2UCTFOK+8fNwkL CVDcP/EVT9hqzjaMyv4mIH4Ij7rJyU6y/ZXTMMHEPZUQZUOqHuYMaoePQShnA8T4Qw8zPwyZ4dkJZ0 KnR47/XLkVLmJuFGlBMHuGsjK6mlZf X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: BB19E40002 X-Stat-Signature: dcsnsxyfn538cf3rho1txahwpy4kkfpp X-Rspam-User: X-HE-Tag: 1727823867-466899 X-HE-Meta: U2FsdGVkX1++emWo10cqTBk8OZ+clXSJfiXfZtBp5btwW711odIoGwtfNH+cYSpKep/KLiLHvYmFxSGm12fAo/BST6SovtX8AYMT7Kwgd9V7ZcNYxTSUeYkRNwziMWmhdiRg31nNiISaBTh/yzN5Unatz+lFOBIR1W0I97oT9ys+b9GuAZjan7qsve0FnOPiKoMzuWBpa8LZlexwrw+YsZzrtQ30IS5UzxRZPiR2+MVdaGmrRT5KQLEtDp8pFi+dVS5zBvsSl1ZM6T3iGfl+3jg4LmYngosrfYFhyr177DjVNngXioVLzZvj1ey6spFQqykQ3PRXW0LxjhIHDsxa4uG8D7KDZfYkc8zzKJR4srROSWqJvNkXybOyGjkyHhyEZLUBBG/k5aZNzxPq77pVsPNd4TUVpXL6Fq4GIE7JMCQHrwhOrydeVFrWLIQM3JisCD5Zqj6kCaAW0KYGrmWPE3yS3kxkCyiw0nIhZpv7MOiwkVRKCBnZIeDQP4vgF14dEYlXFj1lL4ZllfmvP1ij0hK7+VYa4hF5feSAnab25MmbECY22CWSdMXsIeO1lRD1WxksLMq7r0i5qTR6JsCY25tVzdYscgHH99saZ3fOIGK0HATdITogzYRYK9CTw3mJBJ03ivztBZg3C5f9de+ouNqmU6HdYKOE6MWvNUMNviPVm1KekaovEYqXs+TBtkFcO6K8csVDzYeVZvrFw7ar2FuOKCx27AInk8xuoHPHWMVJIRWSH7EtfqB38mFyhYxc+jxRkhX+1ciuiSroD3G7p1+J28C9DDuoeP+QPTMQDonFLQhad4m3YiaDDbfgZGR34kC6Mv0UqirqSmDaR/YAlxKHenUmyokJPJnOmj9wAGqGcLkrJw1XlloV5Vz6gB6ptMaaKh0gdiy0bcOi+tel5vyM+U6SVA8h/SEjCLm0UkWFDhHrHKG5aMI1IY/XO2UVeh6jqjXYRNIZ5o+GnKJ B9oGdfvw lQHBOx0FBHbIHYajaWMsBO0WMYRfjZiy28GDSqAmJayIw/dYnSPgnSDBfLqXyRn+0TTNjK6o2MyAMMjAtqTvY3/O/mRjuXgmYPdhlweTawlz1KrGHVS4VbPNHZ1kDvKzh3ESYDIE3MnX5/7D/TUKwEXAWsQrsh72xO2a3IgvR81Iwbqv48HZJJ0riGMIpxsfnlx4Q7tgAEV2wCUUZPiMkKASg6R3YvlbzlXk7Hi2wSEpPRHYCsWNxmA3PAJbHigHFrqgmOAlKfokVujwfYqbnZAIM7CGc63XvDHVt0h5TYjAvVFlqKczR4PZD13opw/UlQrWOvTyaQRfhU/zEWnKwpmVW0Zo4uMsWDp6HwiEwTkAqMWwV7GoXhBu7C+Ota4qvIsY25XOdvrUZe1eKLjwdoqkxo8EyWIwTPJLuuD2hSlKiKPtZ78po0Z9koI9ZWAXco2wGTvs6etOEuwHus2iJ8b6FXXW0/HZ3To/K X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Acked-by: Yury Khrustalev Signed-off-by: Mark Brown --- arch/arm64/mm/gcs.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 61a80de6baf8..5c46ec527b1c 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -68,6 +68,70 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret = 0; + int cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (!PAGE_ALIGNED(addr)) + return -EINVAL; + + if (size == 8 || !IS_ALIGNED(size, 8)) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + put_user_gcs(cap_val, cap_ptr, &ret); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* + * Ensure the new cap is ordered before standard + * memory accesses to the same location. + */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware.