From patchwork Mon Oct 9 12:08:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13413602 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CD58AE95A8E for ; Mon, 9 Oct 2023 12:13:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References:Message-Id :MIME-Version:Subject:Date:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=W+SivSy8Feu88WKTE17riUZy43u8YWRxauYDD6GTt54=; b=hqVKu38cEtGbeZ bnIqbRe/k1cfKOVHPVnj2btVp5UKrPYt+WMkfMH0jBX0iga5gGkT18wXz71xLpTWKmldDvTTkdYY+ TuY2+QKlNO4Vxs2T/gbAiSK0w94CqICW58xf8hzLDRV2es19CB7zvYFJNNu8JkOOkRfaKHivsvEWb OM84TgUG8BRrNe1QeHP4AclT2i0YLM0VlehOZK7M/CHvmucsZ096L5HjXmNYjfWQdF/RBJr9mVHyn P0YwVv9K+CZT0q/ooWNeAjKMPA382697Pw0Sr1KmnvolRb1+RcQ5KkwmMiJolnI5z8mZZKIYsp7OW cQc4RuZYjZpObaSrvcFA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qpp8s-00Ac5a-0W; Mon, 09 Oct 2023 12:13:46 +0000 Received: from ams.source.kernel.org ([2604:1380:4601:e00::1]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qpp8T-00Abfs-2z; Mon, 09 Oct 2023 12:13:25 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by ams.source.kernel.org (Postfix) with ESMTP id 767C7B81180; Mon, 9 Oct 2023 12:13:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1B94C433C7; Mon, 9 Oct 2023 12:13:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1696853600; bh=3LBLWW4xqQTJQMWYb4R/QtsJnugqlDnd+PiKUkXUjuA=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=P9Wr3GwBII/troV8sSInqN/yln0ljfppZkXdgNhIKCGeuz0U+TlKktncbl5ZuxSMv cnpk394nCZYhGg+WD14CECDK2jkgemmwg8G20VX0LL1g6mMxIHRyeNlnqmDEVtF90q FFnSiMH6ROz3jBld7EZvS4hDwB4543EKyvQn3nPsVhJgRvqC7iQWtpG0sOFbuAnMBT LBXq/imIcLMJd16TUl76v7FQb1k2UBT3GrPUzclaABKw3F6BRix1Mzo29TqRnDPDOi /s0ZaDRniGtOGopTrCBS4zdNWTWfqkkUuEtxPQPhazgXEJ/6eXVGTZhcViuAI1+kAK qKLQBhIvkHUow== From: Mark Brown Date: Mon, 09 Oct 2023 13:08:57 +0100 Subject: [PATCH v6 23/38] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20231009-arm64-gcs-v6-23-78e55deaa4dd@kernel.org> References: <20231009-arm64-gcs-v6-0-78e55deaa4dd@kernel.org> In-Reply-To: <20231009-arm64-gcs-v6-0-78e55deaa4dd@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.13-dev-0438c X-Developer-Signature: v=1; a=openpgp-sha256; l=3956; i=broonie@kernel.org; h=from:subject:message-id; bh=3LBLWW4xqQTJQMWYb4R/QtsJnugqlDnd+PiKUkXUjuA=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBlI+2j1jSjL4UqyUBzIdyarA602yL79WXmOoB+6YF2 +t4GvA6JATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZSPtowAKCRAk1otyXVSH0OvdB/ 0cqCiubP/0qwNLxtJmoTPf6p1bC1UgC7rcfqKmhkCd3ObxNQocCvyScqT+Zaj16RTzDpOXDqZSIB+9 BrdW1iVbYEFacwOK9q790fpkvdNJM923UIl37uQniQ+XDYGEp0m8l2d7e2FXdSmYYYStPDfqVFlFQ5 u8LnB9Rm5+fGvKmaHq0N7GysxvUXggg1pDipsule1LrpYg4qM/Zihw1G73FZvyOwwQu3C2AtqoY0Cl bJD/fSzTXuIkTyIpGuDSCOOUbYASGZeG+DWm9S09GyiuJze3FKWIu4QLAEP05tQAWoHi15HXplsOdv hL1ncvYBm5iYfM5gIqIklqlJUYobpg X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231009_051322_239667_715AAA9A X-CRM114-Status: GOOD ( 20.34 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Since the x86 code has not yet been rebased to v6.5-rc1 this includes the architecture neutral parts of Rick Edgecmbe's "x86/shstk: Introduce map_shadow_stack syscall". Signed-off-by: Mark Brown --- arch/arm64/mm/gcs.c | 61 ++++++++++++++++++++++++++++++++++++++- include/uapi/asm-generic/unistd.h | 5 +++- 2 files changed, 64 insertions(+), 2 deletions(-) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 2b2223b13fc3..c718ac4325bb 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -43,7 +43,6 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, unsigned long addr; size = gcs_size(size); - addr = alloc_gcs(0, size, 0, 0); if (IS_ERR_VALUE(addr)) return addr; @@ -55,6 +54,66 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret, cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (addr && (addr % PAGE_SIZE)) + return -EINVAL; + + if (size == 8 || size % 8) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size, 0, false); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + ret = copy_to_user_gcs(cap_ptr, &cap_val, 1); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + + /* Ensure the new cap is viaible for GCS */ + gcsb_dsync(); + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware. diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index abe087c53b4b..203ae30d7761 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -823,8 +823,11 @@ __SYSCALL(__NR_cachestat, sys_cachestat) #define __NR_fchmodat2 452 __SYSCALL(__NR_fchmodat2, sys_fchmodat2) +#define __NR_map_shadow_stack 453 +__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack) + #undef __NR_syscalls -#define __NR_syscalls 453 +#define __NR_syscalls 454 /* * 32 bit systems traditionally used different