From patchwork Wed Sep 16 15:08:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Madhavan T. Venkataraman" X-Patchwork-Id: 11779855 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C4F8A618 for ; Wed, 16 Sep 2020 15:09:13 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 96C2E206B7 for ; Wed, 16 Sep 2020 15:09:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="ecAPQ0iS"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="Ujz+S1Oq" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 96C2E206B7 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:References:In-Reply-To:Message-Id:Date:Subject:To: From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=VHl4oa9gIfFW41lafqYxGPD26Ca5vmwi7y451fX6chY=; b=ecAPQ0iSayZX7qr2YRbmz7sSzX l+Vt35XdB0cY9a2X2aO/Pm9fGCzUJYFe5W8J+FghKW2zTHYbFo4+jSvBPHI2oH4Q3zEwGIZVyTiQ5 YAYFa6wIYIO0X7xdjaz/YhkMZU8PpJkGHJEhCRAS8ZA8WY19ZpzkcW1Cj4YPoHdlfwYAcsMNeA/zA uo26M1X1kk4Nd5j+xxRRCO19dS/gtNIOxsFfDJqrpuR82ZI1VGggRW7xhtaHM9DOjdo32M3DrCUGH sMRxmv08W4qnWzrkzZm3pyV4gZV4loXWr6dZ0jLw5Fet7QQ+VLJ7DowPr53ULtJtkO7aJmxsVuMN9 40TYwD7g==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kIZ3O-0004FC-Ut; Wed, 16 Sep 2020 15:09:02 +0000 Received: from linux.microsoft.com ([13.77.154.182]) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kIZ34-00048k-VZ for linux-arm-kernel@lists.infradead.org; Wed, 16 Sep 2020 15:08:46 +0000 Received: from localhost.localdomain (unknown [47.187.206.220]) by linux.microsoft.com (Postfix) with ESMTPSA id 169662074C90; Wed, 16 Sep 2020 08:08:37 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 169662074C90 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1600268917; bh=b+dZfSYt921SZbqVi9d6jmG8B2GKXdUDhoo8NhJxV+k=; h=From:To:Subject:Date:In-Reply-To:References:From; b=Ujz+S1OqtosPp/8L9N3unu6wuJGss69KS6W/GHWBWqM4qfdWcRG/EKRgUKJbOEORc x+qd/TTcA8Trl1XdmvODaLvWIGzELcQgFeVjLlgZi8uYhTVxlKm7dCUF532grSOPqk Po96nXGPIm2UK+uUyzCR1OmHS74BMY4y3GHpUvus= From: madvenka@linux.microsoft.com To: kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, oleg@redhat.com, x86@kernel.org, madvenka@linux.microsoft.com Subject: [PATCH v2 4/4] [RFC] arm/trampfd: Provide support for the trampoline file descriptor Date: Wed, 16 Sep 2020 10:08:26 -0500 Message-Id: <20200916150826.5990-5-madvenka@linux.microsoft.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200916150826.5990-1-madvenka@linux.microsoft.com> References: <210d7cd762d5307c2aa1676705b392bd445f1baa> <20200916150826.5990-1-madvenka@linux.microsoft.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200916_110843_358135_0F5306DA X-CRM114-Status: GOOD ( 17.62 ) X-Spam-Score: -17.9 (-----------------) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-17.9 points) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [13.77.154.182 listed in list.dnswl.org] -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM white-list -7.5 USER_IN_DEF_SPF_WL From: address is in the default SPF white-list -0.0 SPF_PASS SPF: sender matches SPF record -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.5 ENV_AND_HDR_SPF_MATCH Env and Hdr From used in default SPF WL Match X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org From: "Madhavan T. Venkataraman" - Define architecture specific register names - Architecture specific functions for: - system call init - code descriptor check - data descriptor check - Fill a page with a trampoline table, Signed-off-by: Madhavan T. Venkataraman --- arch/arm/include/uapi/asm/ptrace.h | 21 +++++ arch/arm/kernel/Makefile | 1 + arch/arm/kernel/trampfd.c | 124 +++++++++++++++++++++++++++++ arch/arm/tools/syscall.tbl | 1 + 4 files changed, 147 insertions(+) create mode 100644 arch/arm/kernel/trampfd.c diff --git a/arch/arm/include/uapi/asm/ptrace.h b/arch/arm/include/uapi/asm/ptrace.h index e61c65b4018d..598047768f9b 100644 --- a/arch/arm/include/uapi/asm/ptrace.h +++ b/arch/arm/include/uapi/asm/ptrace.h @@ -151,6 +151,27 @@ struct pt_regs { #define ARM_r0 uregs[0] #define ARM_ORIG_r0 uregs[17] +/* + * These register names are to be used by 32-bit applications. + */ +enum reg_32_name { + arm_min, + arm_r0 = arm_min, + arm_r1, + arm_r2, + arm_r3, + arm_r4, + arm_r5, + arm_r6, + arm_r7, + arm_r8, + arm_r9, + arm_r10, + arm_r11, + arm_r12, + arm_max, +}; + /* * The size of the user-visible VFP state as seen by PTRACE_GET/SETVFPREGS * and core dumps. diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile index 89e5d864e923..652c54c2f19a 100644 --- a/arch/arm/kernel/Makefile +++ b/arch/arm/kernel/Makefile @@ -105,5 +105,6 @@ obj-$(CONFIG_SMP) += psci_smp.o endif obj-$(CONFIG_HAVE_ARM_SMCCC) += smccc-call.o +obj-$(CONFIG_TRAMPFD) += trampfd.o extra-y := $(head-y) vmlinux.lds diff --git a/arch/arm/kernel/trampfd.c b/arch/arm/kernel/trampfd.c new file mode 100644 index 000000000000..45146ed489e8 --- /dev/null +++ b/arch/arm/kernel/trampfd.c @@ -0,0 +1,124 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Trampoline FD - ARM support. + * + * Author: Madhavan T. Venkataraman (madvenka@linux.microsoft.com) + * + * Copyright (c) 2020, Microsoft Corporation. + */ + +#include +#include + +#define TRAMPFD_CODE_SIZE 28 + +/* + * trampfd syscall. + */ +void trampfd_arch(struct trampfd_info *info) +{ + info->code_size = TRAMPFD_CODE_SIZE; + info->ntrampolines = PAGE_SIZE / info->code_size; + info->code_offset = TRAMPFD_CODE_PGOFF << PAGE_SHIFT; + info->reserved = 0; +} + +/* + * trampfd code descriptor check. + */ +int trampfd_code_arch(struct trampfd_code *code) +{ + int ntrampolines; + int min, max; + + min = arm_min; + max = arm_max; + ntrampolines = PAGE_SIZE / TRAMPFD_CODE_SIZE; + + if (code->reg < min || code->reg >= max) + return -EINVAL; + + if (!code->ntrampolines || code->ntrampolines > ntrampolines) + return -EINVAL; + return 0; +} + +/* + * trampfd data descriptor check. + */ +int trampfd_data_arch(struct trampfd_data *data) +{ + int min, max; + + min = arm_min; + max = arm_max; + + if (data->reg < min || data->reg >= max) + return -EINVAL; + return 0; +} + +#define MOVW(ins, reg, imm32) \ +{ \ + u16 *_imm16 = (u16 *) &(imm32); /* little endian */ \ + int _hw, _opcode; \ + \ + for (_hw = 0; _hw < 2; _hw++) { \ + /* movw or movt */ \ + _opcode = _hw ? 0xe3400000 : 0xe3000000; \ + *ins++ = _opcode | (_imm16[_hw] >> 12) << 16 | \ + (reg) << 12 | (_imm16[_hw] & 0xFFF); \ + } \ +} + +#define LDR(ins, reg) \ +{ \ + *ins++ = 0xe5900000 | (reg) << 16 | (reg) << 12; \ +} + +#define BX(ins, reg) \ +{ \ + *ins++ = 0xe12fff10 | (reg); \ +} + +void trampfd_code_fill(struct trampfd *trampfd, char *addr) +{ + char *eaddr = addr + PAGE_SIZE; + int creg = trampfd->code_reg - arm_min; + int dreg = trampfd->data_reg - arm_min; + u32 *code = trampfd->code; + u32 *data = trampfd->data; + u32 *instruction = (u32 *) addr; + int i; + + for (i = 0; i < trampfd->ntrampolines; i++, code++, data++) { + /* + * movw creg, code & 0xFFFF + * movt creg, code >> 16 + */ + MOVW(instruction, creg, code); + + /* + * ldr creg, [creg] + */ + LDR(instruction, creg); + + /* + * movw dreg, data & 0xFFFF + * movt dreg, data >> 16 + */ + MOVW(instruction, dreg, data); + + /* + * ldr dreg, [dreg] + */ + LDR(instruction, dreg); + + /* + * bx creg + */ + BX(instruction, creg); + } + addr = (char *) instruction; + memset(addr, 0, eaddr - addr); +} diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl index d5cae5ffede0..85dcbc9e08ee 100644 --- a/arch/arm/tools/syscall.tbl +++ b/arch/arm/tools/syscall.tbl @@ -452,3 +452,4 @@ 437 common openat2 sys_openat2 438 common pidfd_getfd sys_pidfd_getfd 439 common faccessat2 sys_faccessat2 +440 common trampfd sys_trampfd