From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0EFB2EB64DD for ; Fri, 11 Aug 2023 15:10:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=/1NkI98dnbZGDDNLwWj+XkVdiWeZsi0midVFGBTVx6s=; b=AGXdN4VvNfpWoR 6WVp3dHea6W11XsTItd6br+u0jCpbuoPF9An40sR5f7X1u+FYuhbu4+CFh4GRe/berJBsRKMo7U+3 mvQDvEuMsLiO5wcogpJT0AaBN8nFu9Rmbjjpf2aTQ8vbuSPw5T57omcbtvwkDacWIOKOAvIebGhYs GUts0oKHzT9j+Ui5l/kTjxK+gLV/PvurtBHOcHPAKezB60KrYiNMLVfBiAGwCVoWQ/ZTYQjOpz7LJ OTcBO8kck/2CCJYxsesN/sY1anMyohuNvGHqA58m2A16emK1xXqtUyL7am+4fWZIaVJFXyfZxsRD1 1Y6RGLaWy2Bkw/52tZRw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qUTls-00AuBY-1W; Fri, 11 Aug 2023 15:09:48 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qUTlp-00Au8I-1v; Fri, 11 Aug 2023 15:09:46 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0548F6741A; Fri, 11 Aug 2023 15:09:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91028C433C8; Fri, 11 Aug 2023 15:09:35 +0000 (UTC) Date: Fri, 11 Aug 2023 16:09:33 +0100 From: Catalin Marinas To: Mark Brown Cc: Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org Subject: Re: [PATCH v4 17/36] arm64/mm: Handle GCS data aborts Message-ID: References: <20230807-arm64-gcs-v4-0-68cfa37f9069@kernel.org> <20230807-arm64-gcs-v4-17-68cfa37f9069@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20230807-arm64-gcs-v4-17-68cfa37f9069@kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230811_080945_730736_DDA218AF X-CRM114-Status: GOOD ( 21.08 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Aug 07, 2023 at 11:00:22PM +0100, Mark Brown wrote: > @@ -510,6 +527,26 @@ static vm_fault_t __do_page_fault(struct mm_struct *mm, > */ > if (!(vma->vm_flags & vm_flags)) > return VM_FAULT_BADACCESS; > + > + if (vma->vm_flags & VM_SHADOW_STACK) { > + /* > + * Writes to a GCS must either be generated by a GCS > + * operation or be from EL1. > + */ > + if (is_write_abort(esr) && > + !(is_gcs_fault(esr) || is_el1_data_abort(esr))) > + return VM_FAULT_BADACCESS; Related to my PIE permissions comment: when do we have a valid EL1 data write abort that's not a GCS fault? Does a faulting GCSSTTR set the ESR_ELx_GCS bit? > + } else { > + /* > + * GCS faults should never happen for pages that are > + * not part of a GCS and the operation being attempted > + * can never succeed. > + */ > + if (is_gcs_fault(esr)) > + return VM_FAULT_BADACCESS; If one does a GCS push/store to a non-GCS page, do we get a GCS fault or something else? I couldn't figure out from the engineering spec. If the hardware doesn't generate such exceptions, we might as well remove this 'else' branch. But maybe it does generate a GCS-specific fault as you added a similar check in is_invalid_el0_gcs_access(). > @@ -595,6 +644,19 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr, > if (!vma) > goto lock_mmap; > > + /* > + * We get legitimate write faults for GCS pages from GCS > + * operations and from EL1 writes to EL0 pages but just plain What are the EL1 writes to the shadow stack? Would it not use copy_to_user_gcs()? -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel