From: Catalin Marinas <catalin.marinas@arm.com>
To: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>, Jonathan Corbet <corbet@lwn.net>,
Andrew Morton <akpm@linux-foundation.org>,
Marc Zyngier <maz@kernel.org>,
Oliver Upton <oliver.upton@linux.dev>,
James Morse <james.morse@arm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Arnd Bergmann <arnd@arndb.de>, Oleg Nesterov <oleg@redhat.com>,
Eric Biederman <ebiederm@xmission.com>,
Kees Cook <keescook@chromium.org>, Shuah Khan <shuah@kernel.org>,
"Rick P. Edgecombe" <rick.p.edgecombe@intel.com>,
Deepak Gupta <debug@rivosinc.com>,
Ard Biesheuvel <ardb@kernel.org>,
Szabolcs Nagy <Szabolcs.Nagy@arm.com>,
"H.J. Lu" <hjl.tools@gmail.com>,
Paul Walmsley <paul.walmsley@sifive.com>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org,
kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org,
linux-arch@vger.kernel.org, linux-mm@kvack.org,
linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-riscv@lists.infradead.org
Subject: Re: [PATCH v4 09/36] arm64/mm: Allocate PIE slots for EL0 guarded control stack
Date: Fri, 11 Aug 2023 15:23:12 +0100 [thread overview]
Message-ID: <ZNZEUEqJuHrdEa/c@arm.com> (raw)
In-Reply-To: <20230807-arm64-gcs-v4-9-68cfa37f9069@kernel.org>
On Mon, Aug 07, 2023 at 11:00:14PM +0100, Mark Brown wrote:
> diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
> index eed814b00a38..b157ae0420ed 100644
> --- a/arch/arm64/include/asm/pgtable-prot.h
> +++ b/arch/arm64/include/asm/pgtable-prot.h
> @@ -131,15 +131,23 @@ extern bool arm64_use_ng_mappings;
> /* 6: PTE_PXN | PTE_WRITE */
> /* 7: PAGE_SHARED_EXEC PTE_PXN | PTE_WRITE | PTE_USER */
> /* 8: PAGE_KERNEL_ROX PTE_UXN */
> -/* 9: PTE_UXN | PTE_USER */
> +/* 9: PAGE_GCS_RO PTE_UXN | PTE_USER */
> /* a: PAGE_KERNEL_EXEC PTE_UXN | PTE_WRITE */
> -/* b: PTE_UXN | PTE_WRITE | PTE_USER */
> +/* b: PAGE_GCS PTE_UXN | PTE_WRITE | PTE_USER */
> /* c: PAGE_KERNEL_RO PTE_UXN | PTE_PXN */
> /* d: PAGE_READONLY PTE_UXN | PTE_PXN | PTE_USER */
> /* e: PAGE_KERNEL PTE_UXN | PTE_PXN | PTE_WRITE */
> /* f: PAGE_SHARED PTE_UXN | PTE_PXN | PTE_WRITE | PTE_USER */
>
> +#define _PAGE_GCS (_PAGE_DEFAULT | PTE_UXN | PTE_WRITE | PTE_USER)
> +#define _PAGE_GCS_RO (_PAGE_DEFAULT | PTE_UXN | PTE_USER)
> +
> +#define PAGE_GCS __pgprot(_PAGE_GCS)
> +#define PAGE_GCS_RO __pgprot(_PAGE_GCS_RO)
> +
> #define PIE_E0 ( \
> + PIRx_ELx_PERM(pte_pi_index(_PAGE_GCS), PIE_GCS) | \
> + PIRx_ELx_PERM(pte_pi_index(_PAGE_GCS_RO), PIE_R) | \
> PIRx_ELx_PERM(pte_pi_index(_PAGE_EXECONLY), PIE_X_O) | \
> PIRx_ELx_PERM(pte_pi_index(_PAGE_READONLY_EXEC), PIE_RX) | \
> PIRx_ELx_PERM(pte_pi_index(_PAGE_SHARED_EXEC), PIE_RWX) | \
> @@ -147,6 +155,8 @@ extern bool arm64_use_ng_mappings;
> PIRx_ELx_PERM(pte_pi_index(_PAGE_SHARED), PIE_RW))
>
> #define PIE_E1 ( \
> + PIRx_ELx_PERM(pte_pi_index(_PAGE_GCS), PIE_RW) | \
> + PIRx_ELx_PERM(pte_pi_index(_PAGE_GCS_RO), PIE_R) | \
Had some thoughts on this. Why do we need the EL1 GCS attributes to map
to RW? The instructions we'd use to write the shadow stack are the GCS
'T' variants that run as user already.
The only instructions we have in the kernel that would run as EL1 on a
user address are the exclusives (futex code or the old deprecated
emulation but we don't care about them in this context). So I wonder
whether the kernel PIE entry could simply be PIE_NONE_O. Would this be
too restrictive for future uses? Given the coherency between a GCS
access and a standard data access, we may want to restrict it now until
we have a use-case.
--
Catalin
next prev parent reply other threads:[~2023-08-11 14:23 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-07 22:00 [PATCH v4 00/36] arm64/gcs: Provide support for GCS in userspace Mark Brown
2023-08-07 22:00 ` [PATCH v4 01/36] prctl: arch-agnostic prctl for shadow stack Mark Brown
2023-08-07 22:00 ` [PATCH v4 02/36] arm64: Document boot requirements for Guarded Control Stacks Mark Brown
2023-08-07 22:00 ` [PATCH v4 03/36] arm64/gcs: Document the ABI " Mark Brown
2023-08-09 14:24 ` Catalin Marinas
2023-08-09 15:34 ` Mark Brown
2023-08-10 8:55 ` Szabolcs Nagy
2023-08-10 11:41 ` Mark Brown
2023-08-10 13:34 ` Szabolcs Nagy
2023-08-10 16:30 ` Mark Brown
2023-08-18 17:29 ` Catalin Marinas
2023-08-18 19:38 ` Mark Brown
2023-08-22 16:49 ` Catalin Marinas
2023-08-22 17:53 ` Mark Brown
2023-08-23 10:09 ` Szabolcs Nagy
2023-08-23 12:51 ` Mark Brown
2023-08-23 16:45 ` Catalin Marinas
2023-08-23 17:18 ` Mark Brown
2023-08-23 17:40 ` Szabolcs Nagy
2023-08-23 18:16 ` Mark Brown
2023-08-24 15:43 ` Catalin Marinas
2023-08-24 17:38 ` Mark Brown
2023-08-30 12:37 ` Szabolcs Nagy
2023-08-30 16:42 ` Mark Brown
2023-08-23 13:11 ` Catalin Marinas
2023-08-23 15:50 ` Mark Brown
2023-09-28 16:59 ` Szabolcs Nagy
2023-10-02 19:49 ` Mark Brown
2023-10-02 21:43 ` Edgecombe, Rick P
2023-10-03 13:38 ` Mark Brown
2023-10-03 8:45 ` Szabolcs Nagy
2023-10-03 14:26 ` Mark Brown
2023-10-05 17:23 ` Catalin Marinas
2023-10-06 12:17 ` Mark Brown
2023-10-06 12:29 ` Eric W. Biederman
2023-10-06 13:23 ` Mark Brown
2023-10-19 17:08 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 04/36] arm64/sysreg: Add new system registers for GCS Mark Brown
2023-08-07 22:00 ` [PATCH v4 05/36] arm64/sysreg: Add definitions for architected GCS caps Mark Brown
2023-08-07 22:00 ` [PATCH v4 06/36] arm64/gcs: Add manual encodings of GCS instructions Mark Brown
2023-08-07 22:00 ` [PATCH v4 07/36] arm64/gcs: Provide copy_to_user_gcs() Mark Brown
2023-08-11 16:36 ` Catalin Marinas
2023-08-16 18:26 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 08/36] arm64/cpufeature: Runtime detection of Guarded Control Stack (GCS) Mark Brown
2023-08-07 22:00 ` [PATCH v4 09/36] arm64/mm: Allocate PIE slots for EL0 guarded control stack Mark Brown
2023-08-11 14:23 ` Catalin Marinas [this message]
2023-08-15 23:21 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 10/36] mm: Define VM_SHADOW_STACK for arm64 when we support GCS Mark Brown
2023-08-07 22:00 ` [PATCH v4 11/36] arm64/mm: Map pages for guarded control stack Mark Brown
2023-08-10 17:20 ` Catalin Marinas
2023-08-07 22:00 ` [PATCH v4 12/36] KVM: arm64: Manage GCS registers for guests Mark Brown
2023-08-07 22:00 ` [PATCH v4 13/36] arm64/gcs: Allow GCS usage at EL0 and EL1 Mark Brown
2023-08-07 22:00 ` [PATCH v4 14/36] arm64/idreg: Add overrride for GCS Mark Brown
2023-08-07 22:00 ` [PATCH v4 15/36] arm64/hwcap: Add hwcap " Mark Brown
2023-08-07 22:00 ` [PATCH v4 16/36] arm64/traps: Handle GCS exceptions Mark Brown
2023-08-07 22:00 ` [PATCH v4 17/36] arm64/mm: Handle GCS data aborts Mark Brown
2023-08-11 15:09 ` Catalin Marinas
2023-08-15 23:54 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 18/36] arm64/gcs: Context switch GCS state for EL0 Mark Brown
2023-08-11 15:32 ` Catalin Marinas
2023-08-16 18:15 ` Mark Brown
2023-08-22 16:34 ` Catalin Marinas
2023-08-22 17:01 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 19/36] arm64/gcs: Allocate a new GCS for threads with GCS enabled Mark Brown
2023-08-11 16:26 ` Catalin Marinas
2023-08-18 20:15 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 20/36] arm64/gcs: Implement shadow stack prctl() interface Mark Brown
2023-08-07 22:00 ` [PATCH v4 21/36] arm64/mm: Implement map_shadow_stack() Mark Brown
2023-08-11 16:38 ` Catalin Marinas
2023-08-18 17:08 ` Mark Brown
2023-08-22 16:40 ` Catalin Marinas
2023-08-22 17:05 ` Mark Brown
2023-08-15 20:42 ` Edgecombe, Rick P
2023-08-15 21:01 ` Mark Brown
2023-08-07 22:00 ` [PATCH v4 22/36] arm64/signal: Set up and restore the GCS context for signal handlers Mark Brown
2023-08-07 22:00 ` [PATCH v4 23/36] arm64/signal: Expose GCS state in signal frames Mark Brown
2023-08-07 22:00 ` [PATCH v4 24/36] arm64/ptrace: Expose GCS via ptrace and core files Mark Brown
2023-08-07 22:00 ` [PATCH v4 25/36] arm64: Add Kconfig for Guarded Control Stack (GCS) Mark Brown
2023-08-07 22:00 ` [PATCH v4 26/36] kselftest/arm64: Verify the GCS hwcap Mark Brown
2023-08-07 22:00 ` [PATCH v4 27/36] kselftest/arm64: Add GCS as a detected feature in the signal tests Mark Brown
2023-08-07 22:00 ` [PATCH v4 28/36] kselftest/arm64: Add framework support for GCS to signal handling tests Mark Brown
2023-08-07 22:00 ` [PATCH v4 29/36] kselftest/arm64: Allow signals tests to specify an expected si_code Mark Brown
2023-08-07 22:00 ` [PATCH v4 30/36] kselftest/arm64: Always run signals tests with GCS enabled Mark Brown
2023-08-07 22:00 ` [PATCH v4 31/36] kselftest/arm64: Add very basic GCS test program Mark Brown
2023-08-07 22:00 ` [PATCH v4 32/36] kselftest/arm64: Add a GCS test program built with the system libc Mark Brown
2023-08-07 22:00 ` [PATCH v4 33/36] kselftest/arm64: Add test coverage for GCS mode locking Mark Brown
2023-08-07 22:00 ` [PATCH v4 34/36] selftests/arm64: Add GCS signal tests Mark Brown
2023-08-07 22:00 ` [PATCH v4 35/36] kselftest/arm64: Add a GCS stress test Mark Brown
2023-08-07 22:00 ` [PATCH v4 36/36] kselftest/arm64: Enable GCS for the FP stress tests Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZNZEUEqJuHrdEa/c@arm.com \
--to=catalin.marinas@arm.com \
--cc=Szabolcs.Nagy@arm.com \
--cc=akpm@linux-foundation.org \
--cc=aou@eecs.berkeley.edu \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=broonie@kernel.org \
--cc=corbet@lwn.net \
--cc=debug@rivosinc.com \
--cc=ebiederm@xmission.com \
--cc=hjl.tools@gmail.com \
--cc=james.morse@arm.com \
--cc=keescook@chromium.org \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-riscv@lists.infradead.org \
--cc=maz@kernel.org \
--cc=oleg@redhat.com \
--cc=oliver.upton@linux.dev \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=rick.p.edgecombe@intel.com \
--cc=shuah@kernel.org \
--cc=suzuki.poulose@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).