From patchwork Tue Jun 25 14:57:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13711450 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62F0CC2BBCA for ; Tue, 25 Jun 2024 15:03:47 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D25DE6B00BB; Tue, 25 Jun 2024 11:03:46 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C85EE6B00BC; Tue, 25 Jun 2024 11:03:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B345D6B00BD; Tue, 25 Jun 2024 11:03:46 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 8DE086B00BB for ; Tue, 25 Jun 2024 11:03:46 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 1441C1C06D7 for ; Tue, 25 Jun 2024 15:03:46 +0000 (UTC) X-FDA: 82269730452.12.15E8DC5 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf07.hostedemail.com (Postfix) with ESMTP id 87E8640080 for ; Tue, 25 Jun 2024 15:03:19 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=YDScwu9I; spf=pass (imf07.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1719327792; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=v+HRmjxdUqbr0LXCAdY6sWDgk3GJ+0/EkFe2wq48Omk=; b=m9KKN8GpRIIeJwC4a5L3ir+RNFzg98NKuk8XwWbrkDmJC3DAoZ5ugYtt5Xg3cYupSOi3EG aC3L8prIijGi8t+420BZ9Nmtnwi75ZZpCwaea+CkFvq+W4XOakWNeojvo6V1i1yM+8fox5 wFUF7PQaua6s6hJ85tS1e5zT1nhnMXM= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=YDScwu9I; spf=pass (imf07.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1719327792; a=rsa-sha256; cv=none; b=lISuLSQ+KlvBNMTE+W5sEuIiX7O5BFGJDndeNVgwtmzqKID3j5WhffqVkb7TIPYhSSEP5U DArY99X6hNtyyU6Zy6SwYVCftqhhk96UieNiCUrLEffr21P9UTJAD6RhVFMdhdK4oy7rQT MG8V59eftjVouyR678ym+eyEXbYpeRg= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id B10D5614A8; Tue, 25 Jun 2024 15:03:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A9D9C32786; Tue, 25 Jun 2024 15:03:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719327798; bh=Z21AWasSolhz5J/5c3s78sHem1nY4uu+1qvn/s9636U=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=YDScwu9InvdeNgK+aqQ8J/hft/U+qyQUnoOjYAg6t4bAVWWn5H+aPxwHYZmdEnukq dJKGVC4AfFZqiWzIsvkOEG5KEaLV2ct7AcRmq0fkCAAeiQIC//CIuGw8ea0IptNNP7 +Z/FctVB8JE7ZF4n49LA5JkQhXvQNzHUySkteY+FxbjZg41txQyr/W6IVgJZYtrJLb otnwOy7OIfi0/GH5bFqBmeiVmSqYuDO/S+kg/pXZpyjHPC7al3EIM0fnj+s1ivXBbf kxaJb+HcD2AC9v4XH+WDNWlx/1uwXXbBI6GwvuL/P+EHSeJdIFUBrOEZlm+1mKwt4I vOb0ouLv4jkGA== From: Mark Brown Date: Tue, 25 Jun 2024 15:57:50 +0100 Subject: [PATCH v9 22/39] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20240625-arm64-gcs-v9-22-0f634469b8f0@kernel.org> References: <20240625-arm64-gcs-v9-0-0f634469b8f0@kernel.org> In-Reply-To: <20240625-arm64-gcs-v9-0-0f634469b8f0@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.14-dev-d4707 X-Developer-Signature: v=1; a=openpgp-sha256; l=2997; i=broonie@kernel.org; h=from:subject:message-id; bh=Z21AWasSolhz5J/5c3s78sHem1nY4uu+1qvn/s9636U=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBmetuDgBGhsGNt6urfwiqNBknViTYtmdy0dfkzlTfV tuvsHI2JATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZnrbgwAKCRAk1otyXVSH0BSWB/ 90CNgm4LPzeTEljHtp42jqZxx5NRjOcF5UPwn5bhwBHZt4Vvh+G0AhRI2t3RBBxfjDegG/EQulsvNL UwVuDcQ/kUJC1c4Os4mMIiNBCihT3EszdXXCWaxY7+Wf6MSkFVpRTKS0zItLUiSaRMTlrrBwN1T5GS KpQ8sGdqNjxetej3A1uVuFQH+IXyerstHNoHWT3DWh54P8V6u0EYBgERs0cEhylH9kfbVxHsBrcvgu Nn41IPVVWUsPcr4Zhy+Rzu8krZrPjLWx+vu9QkTq2cLR1jBXJ4WVTeC6AATc6DMgdc/C9ptIu/uSoj VI2F3/ySC2M3YL30Xi7WKg2x+dOUOa X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspam-User: X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 87E8640080 X-Stat-Signature: 6ztz46efyor38g6yh3sazeydjknnwiha X-HE-Tag: 1719327799-410288 X-HE-Meta: U2FsdGVkX1+LcQpMb6M4jSNBQoGcv5NzPh5OVqy6wziqkIY9GE9+dCGClfyf2HypMEt003y7Hb76mdmweeF65591wZvKRrWVdDHZnOZQZKNcxmsuAp6bsh4SWpzrtd6vUvCDMLM7fjNNObmWfCJzsUg6C41pXQG/y4Lmenfck2/GiiQ80RzoQGtT8C9kysD4X6/mblftYPeyPZlpmBvTi8TJVzo2sjWbYIB88Dc+2NtzUcLGkKPIEqH2vQqENEfquUmVRLXE7rji0qDsfpWelkuF0l0uAzrayvvM79bYNvJ89q7S9EHu4DMJx3CulnHgSxMYk7OrnGiOetfYeamCdvCC1pzlaGG/LFcJvht1O0lRLXXtpvrjFBx7+8zCLIvxt5X+mOtlWJxUQdZLKhqiqO54nFjpVFDNM28muyPH5w3Ckttsb+CXdhAq7z6ledo3+GqGTdau/vKz2rY22FjjXp4VAHzRnFkf5xl4b6NwGgiU9Kxd/1aaACswL+9tHYIVaHmDUpn4xzOd2X3n0XEv2BWK1nA9fuAKMluOxcU2WXHpNQcgirnROONifyOMV2m1zjKmHlvc8TzqS6T6QNQEItOo9aLibgWkyL/PV19YfsvByw5kNL8pPjS/YLg4DQIaing/+G+jK4PTBmhuOZaJtZ2IvLDj1egc1EaLdS3jCgM2dZYl3ICXBDA2/hcW2gnWv42z45/F6G++9SyyEpzpjXvL1X03++7B1ldTfzZa0ytfmhDcAXuBaA4OOWRjLxM0AEQJFaGWhA1ByoicnFJ2mrQbi91E/PVJTtc/1CfPOKuDEasxoqYsuRggmi/ZxQFLki8/3c7FtZxCdisww4EMEZs6axDpSUz75jy/wFryl2LGwJn1Qpv2jxEYyxgGa8kFCNS0dDCx57SO4YCsFwEBMi6tWeM67yyVSdZvDPE4Ow1xUI3cQuh3SvyDcowVR5ffxAnx74u5J/7s+3/iWP1 AyNQ4CXC LTN8GdUd523nc3H0JZPRZEC0ajgPHaQCQGQUs3fWe2bOMQAzQsLUnColVoxFSAsy0k4twUGNCqqENckw0zLJ1ImDKz2A+HPFNBr+KEesVL9eq5g45Kd4rv/OxvCo7Nia4VM2+93gvywSo9yCd+qHODCrfWpfbyeZJJ1a3bn66uWpdzrcvGl5i7VEHMHPWYlXNh8toafz/v9rA/9ttXEleDt7a2j/W9xrii5Gmlvp8q8Ec8AxX0qvpR08AiAJxqiEN2zeOdnc1iGtZyXcjD12msgHW+N68NN29S68AiXMCOfuBWkTZfHlmMDsrKV6sKMA5C1Lf/7D1PgyTaoRSlRaAZleXYN4xonwuUTsgDZJAJCiDDhKnBTJQKHGd2TiuT9G6HDZVyoCU73cp0vT3KoQt4GYbSk1bJwXgmLs09EXr0fmUEZA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- arch/arm64/mm/gcs.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index c6fae0eb9bd6..918d50ba53c6 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -141,6 +141,67 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret = 0; + int cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (addr && (addr % PAGE_SIZE)) + return -EINVAL; + + if (size == 8 || size % 8) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size, 0, false); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + put_user_gcs(cap_val, cap_ptr, &ret); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* Ensure the new cap is viaible for GCS */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware.