Re: [PATCH v13 04/40] prctl: arch-agnostic prctl for shadow stack

On Tue, Oct 01, 2024 at 11:58:43PM +0100, Mark Brown wrote: Three architectures (x86, aarch64, riscv) have announced support for shadow stacks with fairly similar functionality. While x86 is using arch_prctl() to control the functionality neither arm64 nor riscv uses that interface so this patch

[PATCH v13 40/40] KVM: selftests: arm64: Add GCS registers to get-reg-list

GCS adds new registers GCSCR_EL1, GCSCRE0_EL1, GCSPR_EL1 and GCSPR_EL0. Add these to those validated by get-reg-list. Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- tools/testing/selftests/kvm/aarch64/get-reg-list.c | 28 ++ 1 file changed, 28 insertions(+)

[PATCH v13 09/40] arm64/gcs: Add manual encodings of GCS instructions

Define C callable functions for GCS instructions used by the kernel. In order to avoid ambitious toolchain requirements for GCS support these are manually encoded, this means we have fixed register numbers which will be a bit limiting for the compiler but none of these should be used in sufficientl

[PATCH v13 00/40] arm64/gcs: Provide support for GCS in userspace

The arm64 Guarded Control Stack (GCS) feature provides support for hardware protected stacks of return addresses, intended to provide hardening against return oriented programming (ROP) attacks and to make it easier to gather call stacks for applications such as profiling. When GCS is active a sec

[PATCH v13 03/40] arm64/mm: Restructure arch_validate_flags() for extensibility

Currently arch_validate_flags() is written in a very non-extensible fashion, returning immediately if MTE is not supported and writing the MTE check as a direct return. Since we will want to add more checks for GCS refactor the existing code to be more extensible, no functional change intended. Re

[PATCH v13 01/40] mm: Introduce ARCH_HAS_USER_SHADOW_STACK

Since multiple architectures have support for shadow stacks and we need to select support for this feature in several places in the generic code provide a generic config option that the architectures can select. Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Deepak Gupt

[PATCH v13 07/40] arm64/gcs: Document the ABI for Guarded Control Stacks

Add some documentation of the userspace ABI for Guarded Control Stacks. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Acked-by: Yury Khrustalev Signed-off-by: Mark Brown --- Documentation/arch/arm64/gcs.rst | 230 + Documentation/arch/ar

[PATCH v13 06/40] arm64: Document boot requirements for Guarded Control Stacks

FEAT_GCS introduces a number of new system registers, we require that access to these registers is not trapped when we identify that the feature is present. There is also a HCRX_EL2 control to make GCS operations functional. Since if GCS is enabled any function call instruction will cause a fault

[PATCH v13 04/40] prctl: arch-agnostic prctl for shadow stack

Three architectures (x86, aarch64, riscv) have announced support for shadow stacks with fairly similar functionality. While x86 is using arch_prctl() to control the functionality neither arm64 nor riscv uses that interface so this patch adds arch-agnostic prctl() support to get and set status of s

[PATCH v13 05/40] mman: Add map_shadow_stack() flags

In preparation for adding arm64 GCS support make the map_shadow_stack() SHADOW_STACK_SET_TOKEN flag generic and add _SET_MARKER. The existing flag indicates that a token usable for stack switch should be added to the top of the newly mapped GCS region while the new flag indicates that a top of stac

[PATCH v13 02/40] mm: Define VM_HIGH_ARCH_6

The addition of protection keys means that on arm64 we now use all of the currently defined VM_HIGH_ARCH_x bits. In order to allow us to allocate a new flag for GCS pages define VM_HIGH_ARCH_6. Signed-off-by: Mark Brown --- include/linux/mm.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a

[PATCH v13 12/40] arm64/cpufeature: Runtime detection of Guarded Control Stack (GCS)

Add a cpufeature for GCS, allowing other code to conditionally support it at runtime. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown --- arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/kernel/cpufeature.c | 20 ar

[PATCH v13 11/40] arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1

There is a control HCRX_EL2.GCSEn which must be set to allow GCS features to take effect at lower ELs and also fine grained traps for GCS usage at EL0 and EL1. Configure all these to allow GCS usage by EL0 and EL1. We also initialise GCSCR_EL1 and GCSCRE0_EL1 to ensure that we can execute functio

[PATCH v13 08/40] arm64/sysreg: Add definitions for architected GCS caps

The architecture defines a format for guarded control stack caps, used to mark the top of an unused GCS in order to limit the potential for exploitation via stack switching. Add definitions associated with these. Reviewed-by: Thiago Jung Bauermann Acked-by: Catalin Marinas Signed-off-by: Mark Br

[PATCH v13 14/40] mm: Define VM_SHADOW_STACK for arm64 when we support GCS

Use VM_HIGH_ARCH_5 for guarded control stack pages. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown --- Documentation/filesystems/proc.rst | 2 +- include/linux/mm.h | 12 +++- 2 files changed, 12 insertions(+), 2 deletions(-)

[PATCH v13 18/40] arm64/hwcap: Add hwcap for GCS

Provide a hwcap to enable userspace to detect support for GCS. Signed-off-by: Mark Brown --- Documentation/arch/arm64/elf_hwcaps.rst | 4 arch/arm64/include/asm/hwcap.h | 1 + arch/arm64/include/uapi/asm/hwcap.h | 3 ++- arch/arm64/kernel/cpufeature.c | 3 +++ arch/arm

[PATCH v13 24/40] arm64/mm: Implement map_shadow_stack()

As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory i

[PATCH v13 25/40] arm64/signal: Set up and restore the GCS context for signal handlers

When invoking a signal handler we use the GCS configuration and stack for the current thread. Since we implement signal return by calling the signal handler with a return address set up pointing to a trampoline in the vDSO we need to also configure any active GCS for this by pushing a frame for th

Re: [PATCH v13 16/40] KVM: arm64: Manage GCS access and registers for guests

On Tue, 01 Oct 2024 23:58:55 +0100, Mark Brown wrote: > @@ -4714,6 +4735,10 @@ void kvm_calculate_traps(struct kvm_vcpu *vcpu) > kvm->arch.fgu[HFGxTR_GROUP] |= (HFGxTR_EL2_nPOR_EL1 | > HFGxTR_EL2_nPOR_EL0); > > + if (!kvm_has_gcs(k

Re: [PATCH RFC v4 0/9] tun: Introduce virtio-net hashing feature

On 2024/10/02 1:31, Stephen Hemminger wrote: On Tue, 1 Oct 2024 14:54:29 +0900 Akihiko Odaki wrote: On 2024/09/30 0:33, Stephen Hemminger wrote: On Sun, 29 Sep 2024 16:10:47 +0900 Akihiko Odaki wrote: On 2024/09/29 11:07, Jason Wang wrote: On Fri, Sep 27, 2024 at 3:51 PM Akihiko Odaki

[PATCH 29/33] riscv: kernel command line option to opt out of user cfi

This commit adds a kernel command line option using which user cfi can be disabled. Signed-off-by: Deepak Gupta --- arch/riscv/kernel/usercfi.c | 20 1 file changed, 20 insertions(+) diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c index 40c32258b6ec..

[PATCH 26/33] riscv/hwprobe: zicfilp / zicfiss enumeration in hwprobe

Adding enumeration of zicfilp and zicfiss extensions in hwprobe syscall. Signed-off-by: Deepak Gupta --- arch/riscv/include/uapi/asm/hwprobe.h | 2 ++ arch/riscv/kernel/sys_hwprobe.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/arch/riscv/include/uapi/asm/hwprobe.h b/arch/riscv/

[PATCH 30/33] riscv: create a config for shadow stack and landing pad instr support

This patch creates a config for shadow stack support and landing pad instr support. Shadow stack support and landing instr support can be enabled by selecting `CONFIG_RISCV_USER_CFI`. Selecting `CONFIG_RISCV_USER_CFI` wires up path to enumerate CPU support and if cpu support exists, kernel will sup

[PATCH 15/33] riscv/mm: Implement map_shadow_stack() syscall

As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for shadow stack memory since they lead to windows where memory is a

[PATCH 23/33] riscv signal: save and restore of shadow stack for signal

Save shadow stack pointer in sigcontext structure while delivering signal. Restore shadow stack pointer from sigcontext on sigreturn. As part of save operation, kernel uses `ssamoswap` to save snapshot of current shadow stack on shadow stack itself (can be called as a save token). During restore o

[PATCH 10/33] riscv: usercfi state for task and save/restore of CSR_SSP on trap entry/exit

Carves out space in arch specific thread struct for cfi status and shadow stack in usermode on riscv. This patch does following - defines a new structure cfi_status with status bit for cfi feature - defines shadow stack pointer, base and size in cfi_status structure - defines offsets to new member

[PATCH 09/33] riscv: zicfiss / zicfilp extension csr and bit definitions

zicfiss and zicfilp extension gets enabled via b3 and b2 in *envcfg CSR. menvcfg controls enabling for S/HS mode. henvcfg control enabling for VS while senvcfg controls enabling for U/VU mode. zicfilp extension extends *status CSR to hold `expected landing pad` bit. A trap or interrupt can occur b

[PATCH 08/33] riscv: zicfiss / zicfilp enumeration

This patch adds support for detecting zicfiss and zicfilp. zicfiss and zicfilp stands for unprivleged integer spec extension for shadow stack and branch tracking on indirect branches, respectively. This patch looks for zicfiss and zicfilp in device tree and accordinlgy lights up bit in cpu feature

[PATCH 12/33] riscv mm: manufacture shadow stack pte

This patch implements creating shadow stack pte (on riscv). Creating shadow stack PTE on riscv means that clearing RWX and then setting W=1. Signed-off-by: Deepak Gupta Reviewed-by: Alexandre Ghiti --- arch/riscv/include/asm/pgtable.h | 10 ++ 1 file changed, 10 insertions(+) diff --gi

[PATCH 19/33] riscv: Implements arch agnostic shadow stack prctls

Implement architecture agnostic prctls() interface for setting and getting shadow stack status. prctls implemented are PR_GET_SHADOW_STACK_STATUS, PR_SET_SHADOW_STACK_STATUS and PR_LOCK_SHADOW_STACK_STATUS. As part of PR_SET_SHADOW_STACK_STATUS/PR_GET_SHADOW_STACK_STATUS, only PR_SHADOW_STACK_ENA

[PATCH 20/33] riscv: Implements arch agnostic indirect branch tracking prctls

prctls implemented are: PR_SET_INDIR_BR_LP_STATUS, PR_GET_INDIR_BR_LP_STATUS and PR_LOCK_INDIR_BR_LP_STATUS. On trap entry, ELP state is recorded in sstatus image on stack and SR_ELP in CSR_STATUS is cleared. Signed-off-by: Deepak Gupta --- arch/riscv/include/asm/usercfi.h | 16 - arch/

[PATCH 13/33] riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs

pte_mkwrite creates PTEs with WRITE encodings for underlying arch. Underlying arch can have two types of writeable mappings. One that can be written using regular store instructions. Another one that can only be written using specialized store instructions (like shadow stack stores). pte_mkwrite ca

[PATCH 14/33] riscv mmu: write protect and shadow stack

`fork` implements copy on write (COW) by making pages readonly in child and parent both. ptep_set_wrprotect and pte_wrprotect clears _PAGE_WRITE in PTE. Assumption is that page is readable and on fault copy on write happens. To implement COW on shadow stack pages, clearing up W bit makes them XWR

[PATCH 27/33] riscv: Add Firmware Feature SBI extensions definitions

From: Clément Léger Add necessary SBI definitions to use the FWFT extension. Signed-off-by: Clément Léger --- arch/riscv/include/asm/sbi.h | 27 +++ 1 file changed, 27 insertions(+) diff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h index 98f631b0

[PATCH 16/33] riscv/shstk: If needed allocate a new shadow stack on clone

Userspace specifies CLONE_VM to share address space and spawn new thread. `clone` allow userspace to specify a new stack for new thread. However there is no way to specify new shadow stack base address without changing API. This patch allocates a new shadow stack whenever CLONE_VM is given. In cas

[PATCH 21/33] riscv/traps: Introduce software check exception

zicfiss / zicfilp introduces a new exception to priv isa `software check exception` with cause code = 18. This patch implements software check exception. Additionally it implements a cfi violation handler which checks for code in xtval. If xtval=2, it means that sw check exception happened because

[PATCH 31/33] riscv: Documentation for landing pad / indirect branch tracking

Adding documentation on landing pad aka indirect branch tracking on riscv and kernel interfaces exposed so that user tasks can enable it. Signed-off-by: Deepak Gupta --- Documentation/arch/riscv/index.rst | 1 + Documentation/arch/riscv/zicfilp.rst | 115 +++

[PATCH 28/33] riscv: enable kernel access to shadow stack memory via FWFT sbi call

Kernel will have to perform shadow stack operations on user shadow stack. Like during signal delivery and sigreturn, shadow stack token must be created and validated respectively. Thus shadow stack access for kernel must be enabled. In future when kernel shadow stacks are enabled for linux kernel,

[PATCH 02/33] mm: helper `is_shadow_stack_vma` to check shadow stack vma

VM_SHADOW_STACK (alias to VM_HIGH_ARCH_5) is used to encode shadow stack VMA on three architectures (x86 shadow stack, arm GCS and RISC-V shadow stack). In case architecture doesn't implement shadow stack, it's VM_NONE Introducing a helper `is_shadow_stack_vma` to determine shadow stack vma or not.

[PATCH 01/33] mm: Introduce ARCH_HAS_USER_SHADOW_STACK

From: Mark Brown Since multiple architectures have support for shadow stacks and we need to select support for this feature in several places in the generic code provide a generic config option that the architectures can select. Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Signe

[PATCH 00/33] riscv control-flow integrity for usermode

v5 for cpu assisted riscv user mode control flow integrity. zicfiss and zicfilp [1] are ratified riscv CPU extensions. Changes in this version are - rebased on v6.12-rc1 - Fixed schema related issues in device tree file - Fixed some of the documentation related issues in zicfilp/ss.rst (style is

[PATCH 03/33] riscv: Enable cbo.zero only when all harts support Zicboz

From: Samuel Holland Currently, we enable cbo.zero for usermode on each hart that supports the Zicboz extension. This means that the [ms]envcfg CSR value may differ between harts. Other features, such as pointer masking and CFI, require setting [ms]envcfg bits on a per-thread basis. The combinati

[PATCH 06/33] riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv

riscv will need an implementation for exit_thread to clean up shadow stack when thread exits. If current thread had shadow stack enabled, shadow stack is allocated by default for any new thread. Signed-off-by: Deepak Gupta Reviewed-by: Charlie Jenkins --- arch/riscv/Kconfig | 1 + arch

[PATCH 07/33] riscv: zicfilp / zicfiss in dt-bindings (extensions.yaml)

Make an entry for cfi extensions in extensions.yaml. Signed-off-by: Deepak Gupta --- Documentation/devicetree/bindings/riscv/extensions.yaml | 14 ++ 1 file changed, 14 insertions(+) diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bin

[PATCH 17/33] prctl: arch-agnostic prctl for shadow stack

From: Mark Brown Three architectures (x86, aarch64, riscv) have announced support for shadow stacks with fairly similar functionality. While x86 is using arch_prctl() to control the functionality neither arm64 nor riscv uses that interface so this patch adds arch-agnostic prctl() support to get

[PATCH 18/33] prctl: arch-agnostic prctl for indirect branch tracking

Three architectures (x86, aarch64, riscv) have support for indirect branch tracking feature in a very similar fashion. On a very high level, indirect branch tracking is a CPU feature where CPU tracks branches which uses memory operand to perform control transfer in program. As part of this tracking

[PATCH 11/33] riscv/mm : ensure PROT_WRITE leads to VM_READ | VM_WRITE

`arch_calc_vm_prot_bits` is implemented on risc-v to return VM_READ | VM_WRITE if PROT_WRITE is specified. Similarly `riscv_sys_mmap` is updated to convert all incoming PROT_WRITE to (PROT_WRITE | PROT_READ). This is to make sure that any existing apps using PROT_WRITE still work. Earlier `protect

[PATCH 33/33] kselftest/riscv: kselftest for user mode cfi

Adds kselftest for RISC-V control flow integrity implementation for user mode. There is not a lot going on in kernel for enabling landing pad for user mode. cfi selftest are intended to be compiled with zicfilp and zicfiss enabled compiler. Thus kselftest simply checks if landing pad and shadow sta

[PATCH 32/33] riscv: Documentation for shadow stack on riscv

Adding documentation on shadow stack for user mode on riscv and kernel interfaces exposed so that user tasks can enable it. Signed-off-by: Deepak Gupta --- Documentation/arch/riscv/index.rst | 1 + Documentation/arch/riscv/zicfiss.rst | 176 +++ 2 files change

Re: [PATCH 17/33] prctl: arch-agnostic prctl for shadow stack

On Tue, Oct 01, 2024 at 09:06:22AM -0700, Deepak Gupta wrote: > From: Mark Brown > This is based on a patch originally written by Deepak Gupta but later > modified by Mark Brown for arm's GCS patch series. > > Signed-off-by: Mark Brown > Co-developed-by: Deepak Gupta > --- You need to add you

[PATCH 05/33] riscv: Call riscv_user_isa_enable() only on the boot hart

From: Samuel Holland Now that the [ms]envcfg CSR value is maintained per thread, not per hart, riscv_user_isa_enable() only needs to be called once during boot, to set the value for the init task. This also allows it to be marked as __init. Reviewed-by: Andrew Jones Reviewed-by: Conor Dooley R

[PATCH 24/33] riscv/kernel: update __show_regs to print shadow stack register

Updating __show_regs to print captured shadow stack pointer as well. On tasks where shadow stack is disabled, it'll simply print 0. Signed-off-by: Deepak Gupta Reviewed-by: Alexandre Ghiti --- arch/riscv/kernel/process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ar

Re: [PATCH RFC v4 0/9] tun: Introduce virtio-net hashing feature

On Tue, 1 Oct 2024 14:54:29 +0900 Akihiko Odaki wrote: > On 2024/09/30 0:33, Stephen Hemminger wrote: > > On Sun, 29 Sep 2024 16:10:47 +0900 > > Akihiko Odaki wrote: > > > >> On 2024/09/29 11:07, Jason Wang wrote: > >>> On Fri, Sep 27, 2024 at 3:51 PM Akihiko Odaki > >>> wrote: > >

[PATCH 25/33] riscv/ptrace: riscv cfi status and state via ptrace and in core files

Expose a new register type NT_RISCV_USER_CFI for risc-v cfi status and state. Intentionally both landing pad and shadow stack status and state are rolled into cfi state. Creating two different NT_RISCV_USER_XXX would not be useful and wastage of a note type. Enabling or disabling of feature is not

[PATCH 22/33] riscv: signal: abstract header saving for setup_sigcontext

From: Andy Chiu The function save_v_state() served two purposes. First, it saved extension context into the signal stack. Then, it constructed the extension header if there was no fault. The second part is independent of the extension itself. As a result, we can pull that part out, so future exte

[PATCH 04/33] riscv: Add support for per-thread envcfg CSR values

From: Samuel Holland Some bits in the [ms]envcfg CSR, such as the CFI state and pointer masking mode, need to be controlled on a per-thread basis. Support this by keeping a copy of the CSR value in struct thread_struct and writing it during context switches. It is safe to discard the old CSR valu

Re: [PATCH 05/12] mm/memory: Add dax_insert_pfn

On Sun, 22 Sep 2024 03:41:57 +0200 Dan Williams wrote: > [ add s390 folks to comment on CONFIG_FS_DAX_LIMITED ] [...] > > @@ -2516,6 +2545,44 @@ static vm_fault_t __vm_insert_mixed(struct > > vm_area_struct *vma, > > return VM_FAULT_NOPAGE; > > } > > > > +vm_fault_t dax_insert_pfn(struc

Re: [PATCH v5 4/5] KVM: selftests: Add test for PSCI SYSTEM_OFF2

On Thu, Sep 26, 2024 at 07:37:59PM +0100, David Woodhouse wrote: > +static void guest_test_system_off2(void) > +{ > + uint64_t ret; > + > + /* assert that SYSTEM_OFF2 is discoverable */ > + GUEST_ASSERT(psci_features(PSCI_1_3_FN_SYSTEM_OFF2) & > + BIT(PSCI_1_3_HIBERNATE

Re: [PATCH v5 2/5] KVM: arm64: Add PSCI v1.3 SYSTEM_OFF2 function for hibernation

Hi David, On Thu, Sep 26, 2024 at 07:37:57PM +0100, David Woodhouse wrote: > @@ -392,6 +403,32 @@ static int kvm_psci_1_x_call(struct kvm_vcpu *vcpu, u32 > minor) > break; > } > break; > + case PSCI_1_3_FN_SYSTEM_OFF2: > + kvm_psci

Re: [PATCH v5 3/5] KVM: arm64: Add support for PSCI v1.2 and v1.3

On Thu, Sep 26, 2024 at 07:37:58PM +0100, David Woodhouse wrote: > From: David Woodhouse Please, add changelogs to your patches. What we really need here is the detail on *why* we can just bump the PSCI version like this, i.e. no new required ABI. On top of that, you could mention that KVM has m

[PATCH] docs: dev-tools: Add documentation for the device focused kselftests

ific USB or PCI devices, but is probably not worth it for most cases. --- base-commit: cea5425829f77e476b03702426f6b3701299b925 change-id: 20241001-kselftest-device-docs-6c8a411109b5 Best regards, -- Nícolas F. R. A. Prado

Re: [PATCH doc] docs: gcov: fix link to LCOV website

On 26.09.2024 15:09, Matthieu Baerts (NGI0) wrote: > The previous website hosted on SourceForge is no longer available since > January 2024 according to archive.org [1]. > > It looks like the website has been officially moved to GitHub in June > 2022 [2]. Best to redirect readers to the new locati

Re: [PATCH v3] kernel-docs: Add new section for Rust learning materials

On Sun, Sep 22, 2024 at 6:04 PM Carlos Bilbao wrote: > > + * Title: **Experiment: Improving the Rust Book** > + > + :Author: Cognitive Engineering Lab at Brown University > + :URL: https://rust-book.cs.brown.edu/ > + :Date: Accessed Sep 22 2024 > + :Keywords: rust, blog. > +

Re: [PATCH 17/33] prctl: arch-agnostic prctl for shadow stack

On Tue, Oct 01, 2024 at 05:15:08PM +0100, Mark Brown wrote: On Tue, Oct 01, 2024 at 09:06:22AM -0700, Deepak Gupta wrote: From: Mark Brown This is based on a patch originally written by Deepak Gupta but later modified by Mark Brown for arm's GCS patch series. Signed-off-by: Mark Brown Co-d

[PATCH v13 16/40] KVM: arm64: Manage GCS access and registers for guests

GCS introduces a number of system registers for EL1 and EL0, on systems with GCS we need to context switch them and expose them to VMMs to allow guests to use GCS. In order to allow guests to use GCS we also need to configure HCRX_EL2.GCSEn, if this is not set GCS instructions will be noops and CH

[PATCH v13 17/40] arm64/idreg: Add overrride for GCS

Hook up an override for GCS, allowing it to be disabled from the command line by specifying arm64.nogcs in case there are problems. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Acked-by: Catalin Marinas Signed-off-by: Mark Brown --- Documentation/admin-guide/kernel-paramete

[PATCH v13 10/40] arm64/gcs: Provide put_user_gcs()

In order for EL1 to write to an EL0 GCS it must use the GCSSTTR instruction rather than a normal STTR. Provide a put_user_gcs() which does this. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown --- arch/arm64/include/asm/uaccess.h | 18 +

[PATCH v13 21/40] arm64/gcs: Context switch GCS state for EL0

There are two registers controlling the GCS state of EL0, GCSPR_EL0 which is the current GCS pointer and GCSCRE0_EL1 which has enable bits for the specific GCS functionality enabled for EL0. Manage these on context switch and process lifetime events, GCS is reset on exec(). Also ensure that any ch

[PATCH v13 22/40] arm64/gcs: Ensure that new threads have a GCS

When a new thread is created by a thread with GCS enabled the GCS needs to be specified along with the regular stack. Unfortunately plain clone() is not extensible and existing clone3() users will not specify a stack so all existing code would be broken if we mandated specifying the stack explicit

[PATCH v13 19/40] arm64/traps: Handle GCS exceptions

A new exception code is defined for GCS specific faults other than standard load/store faults, for example GCS token validation failures, add handling for this. These faults are reported to userspace as segfaults with code SEGV_CPERR (protection error), mirroring the reporting for x86 shadow stack

[PATCH v13 27/40] arm64/ptrace: Expose GCS via ptrace and core files

Provide a new register type NT_ARM_GCS reporting the current GCS mode and pointer for EL0. Due to the interactions with allocation and deallocation of Guarded Control Stacks we do not permit any changes to the GCS mode via ptrace, only GCSPR_EL0 may be changed. Reviewed-by: Thiago Jung Bauermann

[PATCH v13 26/40] arm64/signal: Expose GCS state in signal frames

Add a context for the GCS state and include it in the signal context when running on a system that supports GCS. We reuse the same flags that the prctl() uses to specify which GCS features are enabled and also provide the current GCS pointer. We do not support enabling GCS via signal return, there

[PATCH v13 28/40] arm64: Add Kconfig for Guarded Control Stack (GCS)

Provide a Kconfig option allowing the user to select if GCS support is built into the kernel. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas Signed-off-by: Mark Brown --- arch/arm64/Kconfig | 21 + 1 file changed, 21 insertions(+) diff --git a/arch/arm64/K

[PATCH v13 29/40] kselftest/arm64: Verify the GCS hwcap

Add coverage of the GCS hwcap to the hwcap selftest, using a read of GCSPR_EL0 to generate SIGILL without having to worry about enabling GCS. Reviewed-by: Thiago Jung Bauermann Tested-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- tools/testing/selftests/arm64/abi/hwcap.c | 19 +++

[PATCH v13 34/40] kselftest/arm64: Add very basic GCS test program

This test program just covers the basic GCS ABI, covering aspects of the ABI as standalone features without attempting to integrate things. Reviewed-by: Thiago Jung Bauermann Tested-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- tools/testing/selftests/arm64/Makefile| 2 +-

[PATCH v13 13/40] arm64/mm: Allocate PIE slots for EL0 guarded control stack

Pages used for guarded control stacks need to be described to the hardware using the Permission Indirection Extension, GCS is not supported without PIE. In order to support copy on write for guarded stacks we allocate two values, one for active GCSs and one for GCS pages marked as read only prior t

[PATCH v13 33/40] kselftest/arm64: Always run signals tests with GCS enabled

Since it is not possible to return from the function that enabled GCS without disabling GCS it is very inconvenient to use the signal handling tests to cover GCS when GCS is not enabled by the toolchain and runtime, something that no current distribution does. Since none of the testcases do anythin

[PATCH v13 30/40] kselftest/arm64: Add GCS as a detected feature in the signal tests

In preparation for testing GCS related signal handling add it as a feature we check for in the signal handling support code. Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- tools/testing/selftests/arm64/signal/test_signals.h | 2 ++ tools/testing/selftests/arm64/signal/te

[PATCH v13 36/40] kselftest/arm64: Add test coverage for GCS mode locking

Verify that we can lock individual GCS mode bits, that other modes aren't affected and as a side effect also that every combination of modes can be enabled. Normally the inability to reenable GCS after disabling it would be an issue with testing but fortunately the kselftest_harness runs each test

[PATCH v13 39/40] kselftest/arm64: Enable GCS for the FP stress tests

While it's a bit off topic for them the floating point stress tests do give us some coverage of context thrashing cases, and also of active signal delivery separate to the relatively complicated framework in the actual signals tests. Have the tests enable GCS on startup, ignoring failures so they c

[PATCH v13 38/40] kselftest/arm64: Add a GCS stress test

Add a stress test which runs one more process than we have CPUs spinning through a very recursive function with frequent syscalls immediately prior to return and signals being injected every 100ms. The goal is to flag up any scheduling related issues, for example failure to ensure that barriers are

[PATCH v13 35/40] kselftest/arm64: Add a GCS test program built with the system libc

There are things like threads which nolibc struggles with which we want to add coverage for, and the ABI allows us to test most of these even if libc itself does not understand GCS so add a test application built using the system libc. Reviewed-by: Thiago Jung Bauermann Tested-by: Thiago Jung Bau

[PATCH v13 37/40] kselftest/arm64: Add GCS signal tests

Do some testing of the signal handling for GCS, checking that a GCS frame has the expected information in it and that the expected signals are delivered with invalid operations. Reviewed-by: Thiago Jung Bauermann Tested-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- tools/testing/self

[PATCH v13 20/40] arm64/mm: Handle GCS data aborts

All GCS operations at EL0 must happen on a page which is marked as having UnprivGCS access, including read operations. If a GCS operation attempts to access a page without this then it will generate a data abort with the GCS bit set in ESR_EL1.ISS2. EL0 may validly generate such faults, for examp

[PATCH v13 31/40] kselftest/arm64: Add framework support for GCS to signal handling tests

Teach the framework about the GCS signal context, avoiding warnings on the unknown context. Reviewed-by: Thiago Jung Bauermann Signed-off-by: Mark Brown --- tools/testing/selftests/arm64/signal/testcases/testcases.c | 7 +++ tools/testing/selftests/arm64/signal/testcases/testcases.h | 1 +

[PATCH v13 32/40] kselftest/arm64: Allow signals tests to specify an expected si_code

Currently we ignore si_code unless the expected signal is a SIGSEGV, in which case we enforce it being SEGV_ACCERR. Allow test cases to specify exactly which si_code should be generated so we can validate this, and test for other segfault codes. Reviewed-by: Thiago Jung Bauermann Signed-off-by: M

[PATCH v13 23/40] arm64/gcs: Implement shadow stack prctl() interface

Implement the architecture neutral prctl() interface for setting the shadow stack status, this supports setting and reading the current GCS configuration for the current thread. Userspace can enable basic GCS functionality and additionally also support for GCS pushes and arbitrary GCS stores. It

[PATCH v13 15/40] arm64/mm: Map pages for guarded control stack

Map pages flagged as being part of a GCS as such rather than using the full set of generic VM flags. This is done using a conditional rather than extending the size of protection_map since that would make for a very sparse array. Reviewed-by: Thiago Jung Bauermann Reviewed-by: Catalin Marinas S