From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11036C52D6F for ; Wed, 21 Aug 2024 15:37:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4ADAC940008; Wed, 21 Aug 2024 11:37:17 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 435CF940007; Wed, 21 Aug 2024 11:37:17 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2AF6A940008; Wed, 21 Aug 2024 11:37:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 0D26F940007 for ; Wed, 21 Aug 2024 11:37:17 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 99EFD80E22 for ; Wed, 21 Aug 2024 15:37:16 +0000 (UTC) X-FDA: 82476656472.10.231DBAA Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf04.hostedemail.com (Postfix) with ESMTP id 4CF9240023 for ; Wed, 21 Aug 2024 15:37:12 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=none; spf=pass (imf04.hostedemail.com: domain of cmarinas@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=cmarinas@kernel.org; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=arm.com (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1724254553; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=n9+JbGoNDMnaaV8Ekm54wdMmtAy2mLY9DWwJHqg9IeE=; b=W+zlDY3A0NqztVwBZyCOYM4EdqWUdbwsDuzhb7K+HNgISEn6TfwNXD2FbPFDFMcJcJ9ByH SVx8Nl2KTny7qJSchzwZBEhfSodPBPTOADTq4sT4MQuu8DCqmwvb8nuzed+3kY8kY4exwy vJcQjyaA+aHigSOLyp7/qGjuxS0Ydlo= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1724254553; a=rsa-sha256; cv=none; b=s7AeH39gCgey5HLjSt0kPYrKPniYFNQjlf8jfNmBYuB6oHRl+rzofIyOnQ066xD4wbcc92 8t0ILcesV+8Bfy2N6D5kFhFBA0QOO3TqjET8pQXJvmL5zPvZYiPQ2D7BhKQXWpOpcnzSA6 IC7u1KcY4NJ/J2Qi+YXi0POdnoLq7dY= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=none; spf=pass (imf04.hostedemail.com: domain of cmarinas@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=cmarinas@kernel.org; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=arm.com (policy=none) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id ED86DCE0E69; Wed, 21 Aug 2024 15:37:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BBEF4C4AF09; Wed, 21 Aug 2024 15:37:01 +0000 (UTC) Date: Wed, 21 Aug 2024 16:36:59 +0100 From: Catalin Marinas To: Mark Brown Cc: Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , Kees Cook , "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , Florian Weimer , Christian Brauner , Thiago Jung Bauermann , Ross Burton , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org Subject: Re: [PATCH v10 22/40] arm64/mm: Implement map_shadow_stack() Message-ID: References: <20240801-arm64-gcs-v10-0-699e2bd2190b@kernel.org> <20240801-arm64-gcs-v10-22-699e2bd2190b@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240801-arm64-gcs-v10-22-699e2bd2190b@kernel.org> X-Stat-Signature: xmkmf7mhkp7soie9rncfei4zwg6tnziu X-Rspamd-Queue-Id: 4CF9240023 X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1724254632-298479 X-HE-Meta: U2FsdGVkX1/aQ9HXbPRI/k9m3uv+IZblrRyNiYf8aLXsKCif3dDj4+e7spB9103EBLPbuIjLuRgXM9jiYYUQT8QDemKFcq7TbCNLCFb2Y82Y2XTftaG1K37J5C9Ec7HhFJnvJ6rw1yPA2Z/WfFT8SRT3+v+DFLGX6cz191iyUrhEpbW1jRWph9bIApAGM5JMs/wU3oL8o+fWHbe9+Dl23u3tD7A5SaswzcPJ5qsc38Gtg8FbUqkhEsXY/pXFElnPFBuBeoxI7LgyN154u04z744HnkqK02kgaG4q4vc2RZSjiYvh06LIzEx1Quv8S7K1lGcoyFqq8w6pJkxsa+2SQCtYEMQZNCckDHqJyZJLslAhn4edw5H/I02TrgSVheIlHWO5oIlxUGGNrVmYJJ3Gl0DKWAIKsLg5yhcZIXTH24y7Q+pNDPf+ScR5sy/putPZmwI2Qag+0AmIDU5JykpawRvI9j6D0KmSK00KFemJFzb2clHl4SfX5dS/ddM+DjSJRy3pgG+r5BbofHs1j5dFIRJYL4FHN2DqKpQLm0KnpxCJpnHe/UIV0rbq4ZR1BfyMttKGwODR5M+5/o4hG1Ed72SQCCC/rDqeb46AuwJ9TobW/wlwpQp7bEkkeEZDuL1LDVdoqfqACLE9Gv9QsHedMO5cEKvM9N6aZPx5lgV96DeEo9R+4CZf5mNWydi7kIEs+pRNVdhyjR/5YzunO1aF13lSzW8bG8NRa8MLuU5A2zSk90xD1BDUZBKEEsnEZm92Vxl2J/90QJ6n5fL4k7hVKKHLKaaSKW0BHftu54uXXxbrgrD38KU/IYUY/2HsR+60HqIlLNkbtOpplJhpVuKmaxvuzLT2UwTglkDk94xjWcLAGKxV+I4YScTPQhjOqeCclItvYys7IkLz+OPt7mAiX3g/0pIwkKaDL6pvyW4OHF5u/lLfICrHEz7W3rudy/nz+X/03WZGTX/ovILjNzQ KoEpofZH qi60FzRmoRrqExDvRS7oAEkEVkNaINtBs4d/XCDpc6GCQ9v7soOHJzNGyYFPDjWROckZveMtANIPrMx0nTaBlZmXp8ssWm4XmorsukP8QbrVwYVvVIHrschTts5OW9mA0wAOS0t0e35UkhM+1oSzxEeIYjRwP9rNP2kfN45YgQ9p7P7O/NatRmdh2nm/Xp1EBeINhizZvNMUVProOQGd3WOs7uDJUY+NfRMpjrOBmmVjcgkC/m7YBdVasVpw/cGkK74RrtZhcmgg0v3w0cZR65wRzB/mARLAo7q7j/2v7sDyiJzI9mTi0mWuF/XteoO762jFoRZiDEZw90MOa/0VCIidRo6EgT+6uB+Tzj024gg7YfcVAOClqWT+4lGC2fIBQH+30URIa2ij1FKBVHX0VUUICvEpr+iaag9sdHr7fHxbIXiQjXZit7RDEigu8s5RlYTlIbnh+KNkSnyuYOBwRgDWy/jyo1cUAo/kPfmQPaKJM0Cn/rkILr6NO7ep0ZrJICpQGnwBLkD9IMtI= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Aug 01, 2024 at 01:06:49PM +0100, Mark Brown wrote: > +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) > +{ > + unsigned long alloc_size; > + unsigned long __user *cap_ptr; > + unsigned long cap_val; > + int ret = 0; > + int cap_offset; > + > + if (!system_supports_gcs()) > + return -EOPNOTSUPP; > + > + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) > + return -EINVAL; > + > + if (addr && (addr % PAGE_SIZE)) > + return -EINVAL; > + > + if (size == 8 || size % 8) > + return -EINVAL; Nitpicks: use PAGE_ALIGNED and IS_ALIGNED(size, 8). > + > + /* > + * An overflow would result in attempting to write the restore token > + * to the wrong location. Not catastrophic, but just return the right > + * error code and block it. > + */ > + alloc_size = PAGE_ALIGN(size); > + if (alloc_size < size) > + return -EOVERFLOW; > + > + addr = alloc_gcs(addr, alloc_size); > + if (IS_ERR_VALUE(addr)) > + return addr; > + > + /* > + * Put a cap token at the end of the allocated region so it > + * can be switched to. > + */ > + if (flags & SHADOW_STACK_SET_TOKEN) { > + /* Leave an extra empty frame as a top of stack marker? */ > + if (flags & SHADOW_STACK_SET_MARKER) > + cap_offset = 2; > + else > + cap_offset = 1; > + > + cap_ptr = (unsigned long __user *)(addr + size - > + (cap_offset * sizeof(unsigned long))); > + cap_val = GCS_CAP(cap_ptr); > + > + put_user_gcs(cap_val, cap_ptr, &ret); > + if (ret != 0) { > + vm_munmap(addr, size); > + return -EFAULT; > + } > + > + /* Ensure the new cap is viaible for GCS */ > + gcsb_dsync(); s/viaible/visible/ On the comment itself, the barrier does not ensure visibility in absolute term, it's all about ordering relative to other accesses. It might be good to clarify what we actually need in terms of ordering. One aspect came up in an earlier patch was around thread creation. For the current CPU, subsequent GCS accesses in program order will see this token. Classic LDR/STR won't without the barrier. I think this matters when we check the token in the clone3() implementation. Maybe write something along the lines of "ensure the new cap is ordered before standard memory accesses to the same location". Anyway, the patch looks fine. Reviewed-by: Catalin Marinas