From patchwork Sun Jul 16 21:51:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 120960 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:c923:0:b0:3e4:2afc:c1 with SMTP id j3csp793011vqt; Sun, 16 Jul 2023 15:08:52 -0700 (PDT) X-Google-Smtp-Source: APBJJlEuOk+efQwxRMRVrhO5MGPcVXmuIYQDMJB0YBvBMhd55djmShYoL5CblvIZOemzgvBMvquV X-Received: by 2002:a05:6a20:3ca0:b0:134:80b3:896 with SMTP id b32-20020a056a203ca000b0013480b30896mr3953893pzj.17.1689545332428; Sun, 16 Jul 2023 15:08:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1689545332; cv=none; d=google.com; s=arc-20160816; b=JhOvnyjgJmSsORJLXgOFUzLDElhkLy4xVRjqj6afvKseVpaIEG0J5G/4GdkU08yxKA GFDFXKsQGDJFGsnVKwvnoLU+ZBvzi3KI/503pW2jZoSbHGoVhpBfI5VwQN0m6nb3R3qX 90F67rKODRe90ZQ7Lau/gUWdywyp11utQFlWyhEj2s2QkU0WwQZsbPqI00kIcnaZmZsh C8u47mpKfMMz/zmQyLJVn/HWxiVnRyFDHTLjD0vbkhgMqIR1dt7RM/zB2tzUaQ3RgVEO 2wD/OicY4VQIc6oYXYyFsk9gCf1Exu4LcsC7AQjHBFrs2+rL0OH8oQwT4QCM3nHC/Q9F 1g6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:in-reply-to:references:message-id :content-transfer-encoding:mime-version:subject:date:from :dkim-signature; bh=KdrWdT1BNFmemPgq8OOMUj31iavOffNAJQCzRAr4kaA=; fh=EdAFSmIgUzZTC6WCy4Jg1wBZ0/m6m2d/OjiRUJ3BsTI=; b=yYRyBv9KL+IJfxl3wGNCqssHcM1P5VBTvKDRpng+DZvTzC0UedpDjT9bQEZLrmYtuT fLQvZUSMMF5skqlO1juX+CFz7HockKjYd9ujw8cN0KbYMKGlf0Xf2e0rJxOA1JEtQPk3 zulm/yPf2H4ru4fc6yg2FQsmztY5A5Pq76SrpjU2jYikP5EZYzMA6L7b27Ne48Ryj67Z GrOJIr9WjrhFvt29L5P1CeoHOZT/9KV9SzpFj+olxgcLPe0bCDBCBk4GYgpzlJXKFA2N S5id6f5QmCpVUanSBI7iwaCijysje2cm3pqZ4IRaiD3fHirdvGFW8qb/3qUjRryjE8+n l2VA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=X8fGlXBV; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id a20-20020a656554000000b0055bef93b8fbsi5068217pgw.75.2023.07.16.15.08.38; Sun, 16 Jul 2023 15:08:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=X8fGlXBV; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231222AbjGPV6r (ORCPT + 99 others); Sun, 16 Jul 2023 17:58:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230205AbjGPV6O (ORCPT ); Sun, 16 Jul 2023 17:58:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5247E420C; Sun, 16 Jul 2023 14:56:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5D03160ED2; Sun, 16 Jul 2023 21:55:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F1A5C433CD; Sun, 16 Jul 2023 21:55:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1689544514; bh=IRPiROrkNB3kUOdwWZbwXaWKwQj52u2NCwJOGF2R4Sc=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=X8fGlXBVOw7r4yAprIZ+kiw/ryd0Wh+6+SFQCEGf04EUbvmqymRi1oissq6NTtnoy QIxLK6tH4vVhbHFdeEh0suZnVNifPkxRXB6pJ8lQs/j4RE1cK14RE+awKQjUzrOT98 qylgjPz+lmesBs9r3rxXffkTR+qC9Dum9D74IdD6knMbYUaHO787Bf0yEX74TDGlfw joVPK7K/qnwAnsNHMDUt91HxyULkAMbvByEr3eO6VNX4c9+boHflmcxPZwxdvtUqgy 00hw51azDroLt6dk7f3fF9kFLPEGgGYcWmslH4+e6rzGH6YaexDDuGP9Gxpx9eq3mc C/4vJ67cJaiEg== From: Mark Brown Date: Sun, 16 Jul 2023 22:51:19 +0100 Subject: [PATCH 23/35] arm64/signal: Set up and restore the GCS context for signal handlers MIME-Version: 1.0 Message-Id: <20230716-arm64-gcs-v1-23-bf567f93bba6@kernel.org> References: <20230716-arm64-gcs-v1-0-bf567f93bba6@kernel.org> In-Reply-To: <20230716-arm64-gcs-v1-0-bf567f93bba6@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.13-dev-099c9 X-Developer-Signature: v=1; a=openpgp-sha256; l=7379; i=broonie@kernel.org; h=from:subject:message-id; bh=IRPiROrkNB3kUOdwWZbwXaWKwQj52u2NCwJOGF2R4Sc=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBktGahg7DotblkjcSfwUFC6Isjt/jiQVo6t4WibWEe C8U2ix+JATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZLRmoQAKCRAk1otyXVSH0OOWB/ wIeZomcMZ8MKKejsyZrDUdGTnJMN7Y0qlopScHT/rNeF51V1OYlw4155l7F8rqdIi1ioJXzxTgGX6G BJmCIYRHjlOqmTaoPjYUCPkxJfDHM80qMVVt8P/F1f9kWc14QIjs2KpXuubfSuikckqQ5vlYJz9/bI Xg9unXrwZZ7PgOwdm0xUZ/0Jfvc9umK2vqHPXmpAmhQDd+p9DcjVhgVrffU+YEDJc9EkQHyIjEhgpN owoBmjwlMoiOV9zWSzWtte0E+Sn2tUKJpEQgFLO5UqJbSWYTeQUO7z7kpJjYc9DmotnL4NKr/7FlhH mXmUpjWM+STovTTDaSv+WYg/sbTD1H X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1771616686625757537 X-GMAIL-MSGID: 1771616686625757537 When invoking a signal handler we use the GCS configuration and stack for the current thread. Since we implement signal return by calling the signal handler with a return address set up pointing to a trampoline in the vDSO we need to also configure any active GCS for this by pushing a frame for the trampoline onto the GCS. If we do not do this then signal return will generate a GCS protection fault. In order to guard against attempts to bypass GCS protections via signal return we only allow returning with GCSPR_EL0 pointing to an address where it was previously preempted by a signal. We do this by pushing a cap onto the GCS, this takes the form of an architectural GCS cap token with the top bit set which we add on signal entry and validate and pop off on signal return. Since the top bit is set address validation for the token will fail if an attempt is made to use it with the stack switch instructions. Signed-off-by: Mark Brown --- arch/arm64/include/asm/gcs.h | 2 + arch/arm64/kernel/signal.c | 134 +++++++++++++++++++++++++++++++++++++++++-- arch/arm64/mm/gcs.c | 1 + 3 files changed, 132 insertions(+), 5 deletions(-) diff --git a/arch/arm64/include/asm/gcs.h b/arch/arm64/include/asm/gcs.h index 8655ba8054c7..8ef2313522b4 100644 --- a/arch/arm64/include/asm/gcs.h +++ b/arch/arm64/include/asm/gcs.h @@ -8,6 +8,8 @@ #include #include +struct ksignal; + static inline void gcsb_dsync(void) { asm volatile(".inst 0xd503227f" : : : "memory"); diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index 0df8cc295ea5..922b694fa0aa 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -34,6 +35,36 @@ #include #include +#ifdef CONFIG_ARM64_GCS +/* Extra bit set in the address distinguishing a signal cap token. */ +#define GCS_SIGNAL_CAP_FLAG BIT(63) + +#define GCS_SIGNAL_CAP(addr) (GCS_CAP(addr) | GCS_SIGNAL_CAP_FLAG) + +static bool gcs_signal_cap_valid(u64 addr, u64 val) +{ + /* + * The top bit should be set, this is an invalid address for + * EL0 and will only be set for caps created by signals. + */ + if (!(val & GCS_SIGNAL_CAP_FLAG)) + return false; + + /* The rest should be a standard architectural cap token. */ + val &= ~GCS_SIGNAL_CAP_FLAG; + + /* The cap must have the low bits set to a token value */ + if (GCS_CAP_TOKEN(val) != GCS_CAP_VALID_TOKEN) + return false; + + /* The cap must store the VA the cap was stored at */ + if (GCS_CAP_ADDR(addr) != GCS_CAP_ADDR(val)) + return false; + + return true; +} +#endif + /* * Do a signal return; undo the signal stack. These are aligned to 128-bit. */ @@ -815,6 +846,49 @@ static int restore_sigframe(struct pt_regs *regs, return err; } +#ifdef CONFIG_ARM64_GCS +static int gcs_restore_signal(void) +{ + u64 gcspr_el0, cap; + int ret; + + if (!system_supports_gcs()) + return 0; + + if (!(current->thread.gcs_el0_mode & PR_SHADOW_STACK_ENABLE)) + return 0; + + /* + * We are exiting from a signal, the in memory state will be the + * most up to date value. + */ + gcspr_el0 = current->thread.gcspr_el0; + + /* + * GCSPR_EL0 should be pointing at a capped GCS, read the cap... + */ + gcsb_dsync(); + ret = copy_from_user(&cap, (__user void*)gcspr_el0, sizeof(cap)); + if (ret) + return -EFAULT; + + /* + * ...then check that the cap is the actual GCS before + * restoring it. + */ + if (!gcs_signal_cap_valid(gcspr_el0, cap)) + return -EINVAL; + + current->thread.gcspr_el0 = gcspr_el0 + sizeof(cap); + write_sysreg_s(current->thread.gcspr_el0, SYS_GCSPR_EL0); + + return 0; +} + +#else +static int gcs_restore_signal(void) { return 0; } +#endif + SYSCALL_DEFINE0(rt_sigreturn) { struct pt_regs *regs = current_pt_regs(); @@ -841,6 +915,9 @@ SYSCALL_DEFINE0(rt_sigreturn) if (restore_altstack(&frame->uc.uc_stack)) goto badframe; + if (gcs_restore_signal()) + goto badframe; + return regs->regs[0]; badframe: @@ -1071,7 +1148,52 @@ static int get_sigframe(struct rt_sigframe_user_layout *user, return 0; } -static void setup_return(struct pt_regs *regs, struct k_sigaction *ka, +#ifdef CONFIG_ARM64_GCS + +static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig) +{ + unsigned long __user *gcspr_el0; + unsigned long cap[2]; + int ret; + + if (!system_supports_gcs()) + return 0; + + if (!task_gcs_el0_enabled(current)) + return 0; + + /* + * We are entering a signal handler, current register state is + * active. + */ + gcspr_el0 = (unsigned long __user *)read_sysreg_s(SYS_GCSPR_EL0); + + /* + * Push a cap and the GCS entry for the trampoline onto the GCS. + */ + cap[1] = GCS_SIGNAL_CAP(gcspr_el0 - 1); + cap[0] = (unsigned long)sigtramp; + ret = copy_to_user_gcs(gcspr_el0 - 2, cap, ARRAY_SIZE(cap)); + if (ret != 0) + return ret; + + gcsb_dsync(); + + gcspr_el0 -= 2; + write_sysreg_s((unsigned long)gcspr_el0, SYS_GCSPR_EL0); + + return 0; +} +#else + +static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig) +{ + return 0; +} + +#endif + +static int setup_return(struct pt_regs *regs, struct ksignal *ksig, struct rt_sigframe_user_layout *user, int usig) { __sigrestore_t sigtramp; @@ -1079,7 +1201,7 @@ static void setup_return(struct pt_regs *regs, struct k_sigaction *ka, regs->regs[0] = usig; regs->sp = (unsigned long)user->sigframe; regs->regs[29] = (unsigned long)&user->next_frame->fp; - regs->pc = (unsigned long)ka->sa.sa_handler; + regs->pc = (unsigned long)ksig->ka.sa.sa_handler; /* * Signal delivery is a (wacky) indirect function call in @@ -1119,12 +1241,14 @@ static void setup_return(struct pt_regs *regs, struct k_sigaction *ka, sme_smstop(); } - if (ka->sa.sa_flags & SA_RESTORER) - sigtramp = ka->sa.sa_restorer; + if (ksig->ka.sa.sa_flags & SA_RESTORER) + sigtramp = ksig->ka.sa.sa_restorer; else sigtramp = VDSO_SYMBOL(current->mm->context.vdso, sigtramp); regs->regs[30] = (unsigned long)sigtramp; + + return gcs_signal_entry(sigtramp, ksig); } static int setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set, @@ -1147,7 +1271,7 @@ static int setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set, err |= __save_altstack(&frame->uc.uc_stack, regs->sp); err |= setup_sigframe(&user, regs, set); if (err == 0) { - setup_return(regs, &ksig->ka, &user, usig); + err = setup_return(regs, ksig, &user, usig); if (ksig->ka.sa.sa_flags & SA_SIGINFO) { err |= copy_siginfo_to_user(&frame->info, &ksig->info); regs->regs[1] = (unsigned long)&frame->info; diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 4a0a736800c0..ac7013fb05f3 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -6,6 +6,7 @@ #include #include +#include #include static unsigned long alloc_gcs(unsigned long addr, unsigned long size,