From patchwork Mon Jul 24 12:46:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13324641 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0CEFC04E69 for ; Mon, 24 Jul 2023 12:49:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8DAB26B0083; Mon, 24 Jul 2023 08:49:17 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 863548E0006; Mon, 24 Jul 2023 08:49:17 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 751FE8E0005; Mon, 24 Jul 2023 08:49:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 667416B0083 for ; Mon, 24 Jul 2023 08:49:17 -0400 (EDT) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 3FB17A0A4C for ; Mon, 24 Jul 2023 12:49:17 +0000 (UTC) X-FDA: 81046485954.24.2E83E89 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf23.hostedemail.com (Postfix) with ESMTP id 6350B140005 for ; Mon, 24 Jul 2023 12:49:15 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="iW4c/cKl"; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf23.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1690202955; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=aGcCrhfnO1dSCRAUs2DXmf66G0/RvuP8oXDk+bGaZoU=; b=Ohz39JPswTtCIghdwkBdKE0Fuqe7o1HZjaHeGKlU+iIKOrkiwwU6t+q86Dg+UbiGxb9o2P lzw+kUenmsoylikZ5X7CHQsqFt+NAnQLqlxjYrsEzQSL7JWshoCdK4I8DYmy+3EugUOJ6G LbmGB8rvmgza7w6nra1TWqQtopdG9yQ= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b="iW4c/cKl"; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf23.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1690202955; a=rsa-sha256; cv=none; b=8LF4QcYsTfQvXlE+PRtifOsVAhwgn7s841Rqhdvcup86q5/Mo/oGcyPpWStciyeh9QNjLU jpUPZq3IOScdXtB6poXSXOJ/hbDvUI+Eoqf5fzuZtluhNNTh2GnvqnSCTYl0Y2Lcy5Xzqn lS6BMh9GHMzNGj6Zcd61Hf1ofiaUKjU= Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 968746115A; Mon, 24 Jul 2023 12:49:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 326E7C433CB; Mon, 24 Jul 2023 12:49:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1690202954; bh=oiakJxhCl2ggQgHDbaP+YYLLswWzPu+vDfVc2y5agDo=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=iW4c/cKlMkXGakJEmv5ZwTIxvq878gnNDj+1oSPH1KFmgWa6wBDpZxSUhj7nvUg0R C7EX0V38YzWq4SHlqfCI/khHXiWAYgGihlh5r0pD3fSIOgJLNmHqrVVQc90LoUiYV2 78UomftH4dyLkiXIShFrg03qx0augPdJW5PvzhQYlbrdlVazVDdixcrfac6GMQaPOH psokPim4W/YjQvcX/EiPPgtL4JOiu9KUKxZMyBelYO9nJHA3UCs1i3KuzVjoznhZ4x BnQckU+EdV+0GilnY0gysLZXiNFw62zJxnzQuAJbSwrSSfz/hJ1Mjfob3plWceCAWu Ie1I6yA9wwfdg== From: Mark Brown Date: Mon, 24 Jul 2023 13:46:08 +0100 Subject: [PATCH v2 21/35] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20230724-arm64-gcs-v2-21-dc2c1d44c2eb@kernel.org> References: <20230724-arm64-gcs-v2-0-dc2c1d44c2eb@kernel.org> In-Reply-To: <20230724-arm64-gcs-v2-0-dc2c1d44c2eb@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.13-dev-099c9 X-Developer-Signature: v=1; a=openpgp-sha256; l=4500; i=broonie@kernel.org; h=from:subject:message-id; bh=oiakJxhCl2ggQgHDbaP+YYLLswWzPu+vDfVc2y5agDo=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBkvnKktMiW5/GsUPeWzIjvMe318oOP15ClcHBNUp4G MyFwT8yJATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZL5ypAAKCRAk1otyXVSH0PNoB/ 9zFHT1nbXDtnhngqR1FqjYTuHzb8PFLjwSV3lGPDApwGMZUbIiH07S2VAlsQBAKasLM8PVd9fz280e cMzuJUk31R6C/icE3L4wa5pjg43SqaF/ViWBiD1gfXsqb67Q4D/eizuJy8uSsDCSUT295YUVhsWqvx I/DggO8L0BTSmd1MeKgyqhYr+1cbQ9VuewlaI3JYErjhqxxNDo1dn6Ete7+Zyhf6IbxnHo/bI9z6Jo MKQyU0WANNLBpdu2O9cdoKBa59xw7dolesWpa419qwAQ3eNv1C2CKkEBXnF9ARkGRXA0ysA7CJQOJ7 sfqPYQo9jxN0xvTRaxLXDO3AaoYW+j X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 6350B140005 X-Stat-Signature: qt9dw98sf4tm7yoq1fij7ns9j1srb8yj X-Rspam-User: X-HE-Tag: 1690202955-790779 X-HE-Meta: U2FsdGVkX1/oNUqYLcfjVAzjj3tcdcNVxjvMKeFhjuXSX7Y2OkMQ9EV8JqlWDTUXZgS66uugthIKv6muX11Zjm96JIPYg0hdvmijwSX3zANpiM4vvGOJ5FbzDNaCxx2gJUPpWZEd2ThkeLs7LIJ092rzLnI0VqXhDgZi2zh1AV6FrK1wLiDYe9vlVwfJFI0FKmwJadhQCSzsWY/4C8pU6WsCFCgUw5xTynhIqscRDc+IzyYH8nLYcRsRYusr0sfV0ai5YjWcBXNI+PTH3gmacD+gUfNx7v4pw5V5qF+AgFma/AjYBxl3KX/JLSgLaaFdxekC1yfi4s36suxUfIF62Js2a1iuAtuGGbSbFrjHjXxxktEHvVSWMHXva9M04Yc/FR31H82WIRX4MTpHlpNYIGjj0vKELYeHW7AF4qUUcCZTTzy3qlR3fnCtAOdTEcY+RBETd3M1lNZcBTkQ2PsF7kPf5l6YrwTUCem5bjcex4dzApmFjxru8vb+GUdeVgoWhsxYXvjjP2wvnkY0w4iyxmt5d04GwO9HZjruwWp3EKLLbaPF1eYqAu4yhAuVJuJXScdYLSRP9v/jeBYkmf0ufVVO5J3+O/TD0gh5UL7EpMIVF18SwXSpbpVZXcYM9mRlQKgTOs5SUciFCfamVKPqZgYcEmDpBDEqlQfewczIfUO6+AjgCPl9Tlod1HEba4m0kVt9y+fkd+2s8SfK6tQIjf/n5QtVrB6lUjk/bSMsym8azFaIMpt5tnL6n4ZbUlCQiQh9L3PidLaX/SmXeoY89SSn5MzI3J26NH9OrzSfHsMuF+kIcf3OuxoMD9/ao7ziSrpBhdggrbyz9ReKti17a9i46pYGk2CfNhWlUbi5MP2pr9ykUsrKGKO2X6ycuOnlB5w+Htby7NGYXCrdzbEg2BJ7eBhlI2aLFxrEijVY7OuY9ONlYGNmaPOFly8k8t7bbKLyxV+vHnR0D8eYPf9 O1jWCWWV GZcoFyybvpbPAZHd2yb1Z3GoOkmgyf0Vs7uSY6ADypez0ZJi2HwBGp/xaRvN0YQs7cuPlb4BuoJ9Plc+Us/DIGSvqJJaisQASADPstT1glRW/qIQXp398EYt8u70qqPVoD7WHJbtQTFLg/Sn8ErIrPOrxhAPLxoPc73/goM1IKcLOTBY6D8MBSjQYO0DA6GHq10XOsWwGp7bJBW/ymgbisMv5f8rYjxPsGTvHRY10vAQmzD86YBaoSTxSE+GJjgnMt1dUHx6jDQotaO2oJjhw/EG2SltsGXmfB0u30iVLylRWb22+BCPLocMjJtxo6xSpk3TM0A5s32qdVEuEh/8oLGC5LbNWVTMd+kRewQvQ6uXHfVxPRndzT/bMQkyfxJ0nI8+rlTTWJBDWZ2X11qcEY4DGoofAI0YnqUy124zRyXRK4dT2I5PzQdd93RxVEQk25xXdNHDRLPh2fshYupgxQLrSgA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64, initialising memory allocated this way with the top two entries in the stack being 0 (to allow detection of the end of the GCS) and a GCS cap token (to allow switching to the newly allocated GCS via the GCS switch instructions). Since the x86 code has not yet been rebased to v6.5-rc1 this includes the architecture neutral parts of Rick Edgecmbe's "x86/shstk: Introduce map_shadow_stack syscall". Signed-off-by: Mark Brown --- arch/arm64/mm/gcs.c | 50 ++++++++++++++++++++++++++++++++++++++- include/linux/syscalls.h | 1 + include/uapi/asm-generic/unistd.h | 5 +++- kernel/sys_ni.c | 1 + 4 files changed, 55 insertions(+), 2 deletions(-) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 64c9f9a85925..c24fe367e15a 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -52,7 +52,6 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return 0; size = gcs_size(size); - addr = alloc_gcs(0, size, 0, 0); if (IS_ERR_VALUE(addr)) return addr; @@ -64,6 +63,55 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags) + return -EINVAL; + + if (addr % 16) + return -EINVAL; + + if (size == 16 || size % 16) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size, 0, false); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + cap_ptr = (unsigned long __user *)(addr + size - + (2 * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + ret = copy_to_user_gcs(cap_ptr, &cap_val, 1); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware. diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index 03e3d0121d5e..7f6dc0988197 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -953,6 +953,7 @@ asmlinkage long sys_set_mempolicy_home_node(unsigned long start, unsigned long l asmlinkage long sys_cachestat(unsigned int fd, struct cachestat_range __user *cstat_range, struct cachestat __user *cstat, unsigned int flags); +asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags); /* * Architecture-specific system calls diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index fd6c1cb585db..38885a795ea6 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -820,8 +820,11 @@ __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node) #define __NR_cachestat 451 __SYSCALL(__NR_cachestat, sys_cachestat) +#define __NR_map_shadow_stack 452 +__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack) + #undef __NR_syscalls -#define __NR_syscalls 452 +#define __NR_syscalls 453 /* * 32 bit systems traditionally used different diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c index 781de7cc6a4e..e137c1385c56 100644 --- a/kernel/sys_ni.c +++ b/kernel/sys_ni.c @@ -274,6 +274,7 @@ COND_SYSCALL(vm86old); COND_SYSCALL(modify_ldt); COND_SYSCALL(vm86); COND_SYSCALL(kexec_file_load); +COND_SYSCALL(map_shadow_stack); /* s390 */ COND_SYSCALL(s390_pci_mmio_read);