From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F7DEC4167B for ; Sat, 9 Dec 2023 23:49:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 388A06B007D; Sat, 9 Dec 2023 18:49:08 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3396B6B0081; Sat, 9 Dec 2023 18:49:08 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2000A6B0082; Sat, 9 Dec 2023 18:49:08 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 0AF426B007D for ; Sat, 9 Dec 2023 18:49:08 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id D6E03A1577 for ; Sat, 9 Dec 2023 23:49:07 +0000 (UTC) X-FDA: 81548923134.11.BACD0E3 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by imf08.hostedemail.com (Postfix) with ESMTP id 04B6E160017 for ; Sat, 9 Dec 2023 23:49:05 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=linaro.org header.s=google header.b=dKOiBitw; dmarc=pass (policy=none) header.from=linaro.org; spf=pass (imf08.hostedemail.com: domain of thiago.bauermann@linaro.org designates 209.85.214.177 as permitted sender) smtp.mailfrom=thiago.bauermann@linaro.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1702165746; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=OPCNY52nyiQdIzlwx6EU4oIvd2oaUqsRoubFMnhv/R4=; b=qiDgURi17MmLmyaR2BjbWn9AzoLwga5Yj4SSnNeFyFSBQZIcuoNQ8n65v665rmS/N1G/1Y vJp3lz8wMHFGInExZwy/dg9nCAySEQgzQYmDcVDu6GYWOIe73mnre7yacbkUGDV8Txc1tb LBTlYjPC++pwBPRdrc4QDRd1xTRBjYg= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=linaro.org header.s=google header.b=dKOiBitw; dmarc=pass (policy=none) header.from=linaro.org; spf=pass (imf08.hostedemail.com: domain of thiago.bauermann@linaro.org designates 209.85.214.177 as permitted sender) smtp.mailfrom=thiago.bauermann@linaro.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1702165746; a=rsa-sha256; cv=none; b=NRpGFG6tsVIherDdIq1vV/aEhfzUasepsmqEowB7NpEnUywOb8w1cuWOYzl1ux/UPalYc/ a3tfFkcwCkZbQ8bGIAKxVLxeOXG9fXnF9hXwdheb+JmPOXZFuGZTo9qbQRwZuEkuPWWvPo 6QELG6Ly8SKgSHWLekaZaR1hD8ZqFIE= Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-1d04dba2781so22312105ad.3 for ; Sat, 09 Dec 2023 15:49:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1702165745; x=1702770545; darn=kvack.org; h=mime-version:message-id:date:in-reply-to:subject:cc:to:from :user-agent:references:from:to:cc:subject:date:message-id:reply-to; bh=OPCNY52nyiQdIzlwx6EU4oIvd2oaUqsRoubFMnhv/R4=; b=dKOiBitw3jm0HS++BpXwG3vzyZX7f7v85E3paVnh9t2ukzezBz2NvMEEFbHSBhagbU TSHdTBm72k35EqQzhQ788XRMTndaXR5r6268TJdyNvl5bTBSMM6TgPP17rUsdBZV0hF/ 2k9pre+wOgy/Zg1TYUMtWC1BpYYav7LH/J4ufsk6PYc0FQdVjdyla8wDQCuZcmw5Ufef Yp06BLLGxCB2iaXqQPdHBG/PTDehrkMGU59jXzzHQcXcTYLxCnr142q6LAhJd1wx7W1X HpdXrk7WWUrCRJfZhQLHRDVe4Ym/9j3OuBzu0KpESAdNPQ7mhpN4gG3UcZj2OFUEC5yR D6kQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702165745; x=1702770545; h=mime-version:message-id:date:in-reply-to:subject:cc:to:from :user-agent:references:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=OPCNY52nyiQdIzlwx6EU4oIvd2oaUqsRoubFMnhv/R4=; b=fQA2wafDI22uuKHPRmmKJ+1ZHULFVcpN1rCv3SvIGaoQShNMFwiNSVm5n9kkZJp/hU 7oiKTsApMH2JcMcF6KZkuM0oRa+5jTdtiDHAuKczkI9FoHcvw+qHCyHIHFmsfWHG6Rwu 53YKERsS5jBUx1V5pk2+ZhFJzeENHTfDblwVWVAvsFQ0UdO2JkuSAiNbrLovXtXnrn3v 7tJqdAtfr/9GCE1z0wu64/fBnlEX1bKR77LCLM9kJhRkb49lecnpkI0jiNjIPoDoWLkz otg094KiXXirRYGa/Jb7T71oJZW0OP1L5jHnDoRGogklXkcdw+npmF+pmPOccYq5DLgx 7V4A== X-Gm-Message-State: AOJu0Yxs2C7ZoCaGmxo8TKSiSPBIL//Q69LbDZSVEN45+FyXazCNgwCG w/tM3x5TIz0VHuyQOEM2ICdyZw== X-Google-Smtp-Source: AGHT+IEJJXjirbJfGvEGv9wlC7QhPL3oJqPTSZjXXGeMs1qcfj17IHUevHGTEfzPXl+gH/HmXyzIBw== X-Received: by 2002:a17:902:c64a:b0:1d0:c41b:1d1e with SMTP id s10-20020a170902c64a00b001d0c41b1d1emr919404pls.73.1702165744705; Sat, 09 Dec 2023 15:49:04 -0800 (PST) Received: from localhost ([2804:14d:7e39:8470:ded6:9593:9f4f:5c29]) by smtp.gmail.com with ESMTPSA id n2-20020a170902d2c200b001cfcf3dd317sm3918148plc.61.2023.12.09.15.49.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 09 Dec 2023 15:49:04 -0800 (PST) References: <20231122-arm64-gcs-v7-0-201c483bd775@kernel.org> <20231122-arm64-gcs-v7-26-201c483bd775@kernel.org> User-agent: mu4e 1.10.8; emacs 29.1 From: Thiago Jung Bauermann To: Mark Brown Cc: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org Subject: Re: [PATCH v7 26/39] arm64/ptrace: Expose GCS via ptrace and core files In-reply-to: <20231122-arm64-gcs-v7-26-201c483bd775@kernel.org> Date: Sat, 09 Dec 2023 20:49:02 -0300 Message-ID: <877clney35.fsf@linaro.org> MIME-Version: 1.0 Content-Type: text/plain X-Rspamd-Queue-Id: 04B6E160017 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: fppb43akdhyof8f6neo4kq9nfkkdp4r4 X-HE-Tag: 1702165745-851238 X-HE-Meta: U2FsdGVkX19mILP3awAarTp00o596QLle3XFp+ivOiw6w8oruxkKAOK247lD95l+7vRX6y0NxUn/A8MbfqIF0ETIzU4aGFNY7F/T0Y5F16oudx9shbz9k8meHqcgmPk07zcG2ZuW5XOieOUtZ45zhqe5H8e8zhD0QoPY0nuvBt2u8q4OACZ8MtiDbeu+6ul57SuLhr0S5GUdc7SMvAl09o2vqdiTwp+eOftKLD3G2rmggPW/nkg0FiXhu7v4B6iADn7t4bJ9c/Gl4MhcYn5Cv2TgNBxHeebfO5tYHDQTO1j7m2Mjm2bvxLB1lLdo102Ypi7wYM75ZjY0GXymsr+w8Z+XKdLBcLzvRVqp+Bxd/5ouLIWQFfmXOA9PLHdlS9/dBjrLKDFYUM1JWA0PGTvduDvq84qsYYBYb5PC9TmL8IKYwqLIP3K4IV33mQw2by6rPdBk+BYfcuupvnzWQRoB92/pPuB/rk2BwkI1w86QPTO0Pc7qqUdzQzqKg4opYKKANXdigT8nAktWpdncsKLmBFBdDbf9eSWduFftjPRPDh/xneKCVZ9WMhMykcucIffGeFiM5dlbtbqN0j4LPtQpGbNF3JAeg5sxhlT3t5vlsCoIPcv+kYSVISvT4rZXYz33D3bDmOYYLlx1JhR30mMdGnAHM9ZyrvDNA4SWwFDOd0BWECSFayIVg2NnzOzdl0kpjK2qP1LdHFcGJTAHLxCjFVUDeqZEHdQt5Dgm4CkOBZXGEDnXVoz+3gJLIEQ9c7322gZHOpcU3igIuvo2l2vVwEoqqAkQNMHa7EPVzpzKYWRFzC/Orwd2QrHa5xsJdZDL6R1eApkMLllG4bGMl0scdhU5NGjY1cBP2UomhE+Yx1FzhFDqzs1QjUKfAHrmAu/XhwStz1vcXAoo2M1b+1DlEsL2nBWs1T1yw+bveLrbEC1dE5qhNIW6+egLPJmLELT6P40B1uAZ8yaP8U45dgN nncKTFdV Z+RytOzSEFDNbYTikNO/LkuXP/mJMdZOOeRyv5Gw9RLJLBuzD/QM8IT0ZAoiStajgcStn3xznbVdYHd2GTWNRkJO9HzQH5VuxVjS606g8f4/nLS9BcMha/qkoNxcCEoZJlgSn9SM1/Nm43jCI2/UsU+6FBouRN0sRK7BuLmyjornkC/V6JCIKvo+VRu/A9pwf3q6Xmyi6H0LoexL/n7KfZ2cwuOVsg24WCCuUuFlvNNO6fpP9NteigiXx68isuEnKtHHvsP2mcWDNeiqY7kusHNpSJKNCvDaRVxXKgS9qpWQqCwmPproPANkr9Fz8F9yqcMoE93WsBNPmSnJPeH7/MVH2VZ71gyfdn6v2C6QpBwpi5qPT2DMQh+n6BDMGhTUHd96mLju6x/OXtuf2mpIexzQVJCn82IiJze3KLY+zboLhQfQqiBkqB8SQz/z8bNR+y/F+NFwnveuiQZg7/X5pWuuDhQoLsJnFDCduccJiJgZHP/X0bVTbBgRjERqwqGcd1oOt X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Mark Brown writes: > Provide a new register type NT_ARM_GCS reporting the current GCS mode > and pointer for EL0. Due to the interactions with allocation and > deallocation of Guarded Control Stacks we do not permit any changes to > the GCS mode via ptrace, only GCSPR_EL0 may be changed. The code allows disabling GCS. Is that unintended? > Signed-off-by: Mark Brown > --- > arch/arm64/include/uapi/asm/ptrace.h | 8 +++++ > arch/arm64/kernel/ptrace.c | 59 ++++++++++++++++++++++++++++++++++++ > include/uapi/linux/elf.h | 1 + > 3 files changed, 68 insertions(+) > > diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h > index 7fa2f7036aa7..0f39ba4f3efd 100644 > --- a/arch/arm64/include/uapi/asm/ptrace.h > +++ b/arch/arm64/include/uapi/asm/ptrace.h > @@ -324,6 +324,14 @@ struct user_za_header { > #define ZA_PT_SIZE(vq) \ > (ZA_PT_ZA_OFFSET + ZA_PT_ZA_SIZE(vq)) > > +/* GCS state (NT_ARM_GCS) */ > + > +struct user_gcs { > + __u64 features_enabled; > + __u64 features_locked; > + __u64 gcspr_el0; > +}; If there's a reserved field in sigframe's gcs_context, isn't it worth it to have a reserved field here as well? > + > #endif /* __ASSEMBLY__ */ > > #endif /* _UAPI__ASM_PTRACE_H */ > diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c > index 20d7ef82de90..f15b8e33561e 100644 > --- a/arch/arm64/kernel/ptrace.c > +++ b/arch/arm64/kernel/ptrace.c > @@ -33,6 +33,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -1409,6 +1410,51 @@ static int tagged_addr_ctrl_set(struct task_struct *target, const struct > } > #endif > > +#ifdef CONFIG_ARM64_GCS > +static int gcs_get(struct task_struct *target, > + const struct user_regset *regset, > + struct membuf to) > +{ > + struct user_gcs user_gcs; > + > + if (target == current) > + gcs_preserve_current_state(); > + > + user_gcs.features_enabled = target->thread.gcs_el0_mode; > + user_gcs.features_locked = target->thread.gcs_el0_locked; > + user_gcs.gcspr_el0 = target->thread.gcspr_el0; > + > + return membuf_write(&to, &user_gcs, sizeof(user_gcs)); > +} > + > +static int gcs_set(struct task_struct *target, const struct > + user_regset *regset, unsigned int pos, > + unsigned int count, const void *kbuf, const > + void __user *ubuf) > +{ > + int ret; > + struct user_gcs user_gcs; > + > + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &user_gcs, 0, -1); > + if (ret) > + return ret; > + > + if (user_gcs.features_enabled & ~PR_SHADOW_STACK_SUPPORTED_STATUS_MASK) > + return -EINVAL; > + > + /* Do not allow enable via ptrace */ > + if ((user_gcs.features_enabled & PR_SHADOW_STACK_ENABLE) && > + !!(target->thread.gcs_el0_mode & PR_SHADOW_STACK_ENABLE)) There should be only one '!' above. Though contrary to the patch description, this code allows disabling GCS. Shouldn't we require that (user_gcs.features_enabled & PR_SHADOW_STACK_ENABLE) == (target->thread.gcs_el0_mode & PR_SHADOW_STACK_ENABLE) ? That would ensure that the GCS mode can't be changed. > + return -EBUSY; > + > + target->thread.gcs_el0_mode = user_gcs.features_enabled; > + target->thread.gcs_el0_locked = user_gcs.features_locked; > + target->thread.gcspr_el0 = user_gcs.gcspr_el0; > + > + return 0; > +} > +#endif -- Thiago