From patchwork Wed Aug 28 23:27:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13782185 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F2B7C71150 for ; Wed, 28 Aug 2024 23:31:29 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 012986B00BD; Wed, 28 Aug 2024 19:31:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F03F06B00BE; Wed, 28 Aug 2024 19:31:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D7D306B00BF; Wed, 28 Aug 2024 19:31:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id B0A2B6B00BD for ; Wed, 28 Aug 2024 19:31:28 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 6DB92A9AA1 for ; Wed, 28 Aug 2024 23:31:28 +0000 (UTC) X-FDA: 82503253056.19.1817F3E Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf08.hostedemail.com (Postfix) with ESMTP id 049CD16001C for ; Wed, 28 Aug 2024 23:31:25 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fovBxTdh; spf=pass (imf08.hostedemail.com: domain of broonie@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1724887798; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=F5TVaIFO1g+ufkveFc0wCFhaqsK/O9Hq1qeL3Y6nyLE=; b=jcH1yvmRqXzaFP0jQ3s92DeokWkk0w56489+6M2a2aMU3F8A+JzXDQQ9hvaUm+4CQCYYJJ IOV1p8Gw2SqDjXoEU/4Lh1AZJCFJIiGxfCaXfFVC61hjHcSnPlxz5Dc4/TdE4EvT8LvBdc LH7L+f14gxIFA5qNyuOO1zhSEMggNwY= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1724887798; a=rsa-sha256; cv=none; b=68qrzm+KT94qyGhtQ+f/ufz7heo91+ocC7m61EhnQRp7W038lU/nYcmCnRjbt1pj/tYXJQ 5VBY0K/d0gUdjNPfdav+80pSC93tQ4JwbINYX/TLOz7kwaf5ItRbDUzie4hjC8rNy3Qyeo dekfKx+/8FT/NOgQUAthujVvVpvPaS8= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fovBxTdh; spf=pass (imf08.hostedemail.com: domain of broonie@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=broonie@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 1ABF5CE180A; Wed, 28 Aug 2024 23:31:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38069C4CEC4; Wed, 28 Aug 2024 23:31:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1724887882; bh=QZaW0hCLawS24gfsrOh/tioIJLs0ZSMp+GQyLn6Fkyg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=fovBxTdhiD2VqYg10EgfUytuiZHI0AoPc/51GcFsjNd40/y9kJ89gK5C6JqZ+uXAk J+9y0SvG8fBAf/r9+hJeLKROupJ0IvBIkJAmdSRG/VSulTsQPHsmOBhhvWIF0BSAkV gIT5XmBo1uMl0Datb23vtxSiWJnKrQrKC/ygiCngnSY2HD5bLDu5dPhSVnUoebrmvD bULwgQ8WOce3MUoBxGlGZb4vz36yk/xjlSVuKzvFWtLJPXgIdN97N78FQkMXQSlqt7 vRJhZFShmSy8+aV/L3BWwCytVYSKv3zdGbg24IFfjFYvbauMbS5mMMYT4Xtghrg0C4 2lrilOvILazxw== From: Mark Brown Date: Thu, 29 Aug 2024 00:27:39 +0100 Subject: [PATCH v12 23/39] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20240829-arm64-gcs-v12-23-42fec947436a@kernel.org> References: <20240829-arm64-gcs-v12-0-42fec947436a@kernel.org> In-Reply-To: <20240829-arm64-gcs-v12-0-42fec947436a@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , Yury Khrustalev , Wilco Dijkstra , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.15-dev-37811 X-Developer-Signature: v=1; a=openpgp-sha256; l=3111; i=broonie@kernel.org; h=from:subject:message-id; bh=QZaW0hCLawS24gfsrOh/tioIJLs0ZSMp+GQyLn6Fkyg=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBmz7KKThZ/6LRaIIP82jKaeHi/u1K7PI3KtMSJ/Eyu a0lLpT2JATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZs+yigAKCRAk1otyXVSH0PJmB/ 9UdvhfrTKb0KEJxHdMW577qcwze1tFePB+X559s8pp/SgfIA+XNNhYVab1hTQHpVx/ibLczLzsUhgf qtIoJ8wh9/MPww97uUH1ALY8ZN+OM3AuUyEVSIVawsSdoZJgKfehXQ4tSjW5pHxmsFJk0pDVUCtKD6 zMjRggMvXV95HoUi1TX4UJWldJLrzu+TIcN2ZuRcMBZtDsfaRMwr2I+icr/ctzLoUv//gGO/xR8OvU eLtv0qDsbSE2+fny8IODbznNRjeCa+RSX156PyHJYffrFGge9CTM1MKO8yJorXsiu7DsHjW6QuDGb7 PUuXQqdl47bIqXIaufxHO1zjbaiEv1 X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 049CD16001C X-Stat-Signature: r8cbcgzchbi77b48xhuefg4ha3jwqr4r X-HE-Tag: 1724887885-957745 X-HE-Meta: U2FsdGVkX19qztgdSH6hk7Q8soSg7Asupga+owkYTlWge81a5a7bFYrnI1qTysyztWzlpPytWZxxxLrfIi7MJDwyUnOmrnpGzeGL54x6ZSqW/egKwKzoZPhTZ8kzPpUu4b4LkTeIzdK0foP31BPbPDkLr0ulSRFJeu49YkEsYvzMbrONSGxV4FTLtD3rnhB+qufj/Yknd3QGqdEty2dEc9vdtXoHFZUQDNBBNSOrUladasJXYqISHDEI+V6yA3MdIm2pnXg679Kg+Al09M3NLbRZFSFIYLxFt9gfY2760Q9fT0PIrsvk6RiKf2itImMWkB00qp/ae00NsSH5PNHVOn136Zmt52i53Ur4RweSexVIuNi5N8CpyqglQhJSIsry0rdp1sR54Q2OOmFY0FLzJqueV2cE1vW4Wmgt1cs/TXwH4Yvba8WFOE1tg/UeHGMvuatYdsLpU1kRaCjjLE59SrNWcsTlqcdrNDcghGOukIV8MDZBp6e3k2AHeJAL9ORS/0K+1t1rGTOUvRT1e1ssvHOU5AWjSDk7/2493GfZfWXKTU+FCvfg7P5pyBYyYv9A7fq6QOkGXGzmhLiHIiu0tcv6GynMxX3BUogUB5vURLCeALHdjmm9uqZTwbf0oOK+75v9k80tE3Bc3rg+/TKzwxBawzAN7JSCdvIJEVl9iRZl5EW54GA+wBIIcnIra18oc0Nb6GXe9D/jb/mJ13RdHBRnBcal4pyyNSHHU2bk/UKEbCU8IP1t4DQs2UPUJmtVKf6s9frJGAsuYMEOjp3uBO/MbpmJUszuN64+jsrHEisxbR3gejYpvbx5AXyQK+xsBMJqd8wZfo5eOkB9dJ9ZpfbLNLfkJW1a5fRXzFylFYHKu5WFUdeJv5EusAdVnhsYkQRIRtuuJSLkzmI0/sH1JE5EaW94jwc9HOJbe92Aq9mA2V0kGP5ydHUKnPEpyf32byl8I75AlwHFBJf3Lmx mpOwq1qB a2+Qj4KUeXrAM6pOG45KZU9/MvvwUdg8BeTpaa6ngbMLNJPyG00MtIkAyxqrz8VLnY16QXhPqlV6P4WAr3h4tZS+hpEiuyA99QrXdlWbyxfU3C3HthCEVeyXf2zl4s9Vt0c3hEEEl6fQtIhg1t3D5v1QYeDA/GvvAeHPjdnIWWaHwZkkYOG5ek92PCUepAPLnFyIZU+qzrB+J7GMrfVWreATbrY8E5/jAvFlM7xBWkOV9fhwPtRJomIHj0Ho+16u9Anh9lZe77E2viX/FVPa8WJ+Z6me6RSfLNbS55Y2hfmwJakjSte1O6QlnEdNB1/jU2mryPCPcQq9wCsI+hPh/0q0MU+/84Nmc3QDkZF4diD/vJvDoRy3wLDqGAYNCOqfBnnBF64jlyeW8yKBAUkN1PdsteK4OHzX5NO2nJwXcP50zR1magEItsdHMi1qU9U4vZWh0ghrLDLxsfMNqKKqEdSUYRsyT05T3s29Qo/kDu0GKkmbWhBSTUxNodEWl3tVpTaorL5GObzBxn8h2BbakVHLGPQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown Acked-by: Yury Khrustalev --- arch/arm64/mm/gcs.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 979e02cece93..cdd4a9d7ff7d 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -68,6 +68,70 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret = 0; + int cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (!PAGE_ALIGNED(addr)) + return -EINVAL; + + if (size == 8 || !IS_ALIGNED(size, 8)) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + put_user_gcs(cap_val, cap_ptr, &ret); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* + * Ensure the new cap is ordered before standard + * memory accesses to the same location. + */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware.