December 2023 - linux-morello - op-lists.linaro.org

by Kevin Brodsky

Hi, This series is a collection of various cleanups for compat64: - Patch 1 makes use of the new in_compat64_syscall() helper introduced by Zach in his BPF series to unify the way we check whether we are handling a compat64 syscall. - Patch 2-4 aim to restore compat_binfmt_elf as close to its original shape as possible, by using most of the existing definitions for compat64 as well as compat32. - Patch 5 converts remaining uses of #ifdef CONFIG_COMPAT to CONFIG_COMPAT32 when the corresponding code is specific to AArch32. - Patch 6 fixes the number of ASLR bits in compat64, which should be the same as in native and not the AArch32 value. Aside from making things a little clearer and removing some unused code in compat64, patch 4 and 5 bring minor functional improvements. See the commit messages for details. Review branch: https://git.morello-project.org/kbrodsky-arm/linux/-/commits/morello/compat… Cheers, Kevin Kevin Brodsky (6): treewide: Use in_compat64_syscall() for compat64 checks arm64: Only define COMPAT_ELF_HWCAP* in compat32 arm64/elf: Only define compat_elf_read_implies_exec in compat32 fs/compat_binfmt_elf: Align compat64 with compat32 arm64: Disable remaining 32-bit handling in compat64 arm64: Kconfig: Use native mmap_rnd_bits in compat64 arch/arm64/Kconfig | 2 +- arch/arm64/include/asm/arch_timer.h | 2 +- arch/arm64/include/asm/elf.h | 50 ++++++++++----------- arch/arm64/include/asm/fpsimd.h | 2 +- arch/arm64/include/asm/hwcap.h | 4 +- arch/arm64/include/asm/mmu.h | 2 +- arch/arm64/include/asm/processor.h | 8 ++-- arch/arm64/include/asm/ptrace.h | 2 +- arch/arm64/include/asm/seccomp.h | 2 +- arch/arm64/include/asm/unistd.h | 6 ++- arch/arm64/kernel/cpufeature.c | 14 +++--- arch/arm64/kernel/cpuinfo.c | 8 ++-- arch/arm64/kernel/entry-common.c | 6 +-- arch/arm64/kernel/traps.c | 4 +- arch/arm64/mm/init.c | 2 +- drivers/mmc/core/block.c | 11 ++--- fs/compat_binfmt_elf.c | 68 +++++++++++++---------------- include/linux/elfcore-compat.h | 7 +++ io_uring/io_uring.c | 2 +- io_uring/uring_cmd.c | 2 +- kernel/futex/syscalls.c | 2 +- net/ipv4/tcp.c | 18 +++----- 22 files changed, 109 insertions(+), 115 deletions(-) -- 2.42.1

9 months, 1 week

2
9
0 0

[PATCH] io_uring/cmd: Convert compat64 pointers for OP_{G,S}ETSOCKOPT

by Kevin Brodsky

struct io_uring_sqe::optval is a strange field, because in reality it is part of the cmd payload (for IORING_OP_URING_CMD). The layout of this payload is not converted before the SQE is submitted (in convert_compat64_io_uring_sqe()), because it is specific to each .uring_cmd handler. Even if we wanted to handle all the conversions upfront, it would be difficult to achieve as the target file (and thus the .uring_cmd handler) has not been determined at that point. Since optval is a user pointer, we need to perform the usual conversion for compat64. This is done by getting a pointer to the payload using io_uring_sqe_cmd(), and then interpreting that payload as either __u64 or __kernel_uintptr_t. The optval field is no longer used, as it is not meaningful in compat64. Since struct io_uring_sqe is uapi, the field is retained for userspace usage. Signed-off-by: Kevin Brodsky <kevin.brodsky(a)arm.com> --- Another patch for the branch rebased on 6.7. Testing it with checked uaccess revealed that additional handling was needed for compat64. The OP_{G,S}ETSOCKOPT commands were introduced by [1]. The patch is available in my 6.7-based branch: https://git.morello-project.org/kbrodsky-arm/linux/-/commits/morello/next-6… [1] https://lore.kernel.org/all/20231016134750.1381153-1-leitao@debian.org/ io_uring/uring_cmd.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index 4c4431e9616b..db184905c20d 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -214,6 +214,17 @@ int io_uring_cmd_import_fixed(void __user *ubuf, unsigned long len, int rw, } EXPORT_SYMBOL_GPL(io_uring_cmd_import_fixed); +static inline void __user *sqe_get_optval(const struct io_uring_sqe *sqe) +{ + if (IS_ENABLED(CONFIG_COMPAT64) && in_compat_syscall()) { + const __u64 *val = io_uring_sqe_cmd(sqe); + return compat_ptr(READ_ONCE(*val)); + } else { + const __kernel_uintptr_t *val = io_uring_sqe_cmd(sqe); + return (void __user *)READ_ONCE(*val); + } +} + static inline int io_uring_cmd_getsockopt(struct socket *sock, struct io_uring_cmd *cmd, unsigned int issue_flags) @@ -226,7 +237,7 @@ static inline int io_uring_cmd_getsockopt(struct socket *sock, if (level != SOL_SOCKET) return -EOPNOTSUPP; - optval = (void __user *)READ_ONCE(cmd->sqe->optval); + optval = sqe_get_optval(cmd->sqe); optname = READ_ONCE(cmd->sqe->optname); optlen = READ_ONCE(cmd->sqe->optlen); @@ -249,7 +260,7 @@ static inline int io_uring_cmd_setsockopt(struct socket *sock, void __user *optval; sockptr_t optval_s; - optval = (void __user *)READ_ONCE(cmd->sqe->optval); + optval = sqe_get_optval(cmd->sqe); optname = READ_ONCE(cmd->sqe->optname); optlen = READ_ONCE(cmd->sqe->optlen); level = READ_ONCE(cmd->sqe->level); -- 2.42.1

9 months, 2 weeks

1
1
0 0

[PATCH] io_uring: Use full pointers for IORING_SETUP_NO_MMAP

by Kevin Brodsky

Commit 03d89a2de25b ("io_uring: support for user allocated memory for rings/sqes") introduced struct io_{s,c}qring_offsets::user_addr to allow the user to specify ring mappings themselves. As usual, these fields are typed as __u64, although they are meant to hold pointers. This means that only the mapping address can be passed, and not a full pointer in PCuABI. Move to operating on full pointers and perform the usual adaptations: * __u64 becomes __kernel_uintptr_t (able to hold a full pointer in any ABI) * Propagate the value as a user pointer down to the point of use (__io_uaddr_map()). * To keep the ABI unchanged in compat64, introduce compat handling for io_uring_setup(). struct io_uring_params is both copied in and out, so we need to convert the layout in both directions. Not all fields are necessarily relevant in both cases, but for simplicity's sake and forward-compatibility, all of them are copied. Finally, because the user memory is accessed via a kernel mapping, the provided pointer needs to be explicitly checked before calling pin_user_pages_fast(). Here again, for simplicity's sake, we require a RW pointer in both cases. Write access may not be strictly required for struct io_sqring_offsets::user_addr, but userspace needs to have a writeable mapping / pointer to be able to make use of it at all, so this should not make much difference in practice. Signed-off-by: Kevin Brodsky <kevin.brodsky(a)arm.com> --- This patch is for the branch rebased on 6.7 (currently 6.7-rc5). It was tested against the latest liburing tests with updated Morello patches. The upstream patch mentioned above is part of [1], landed in 6.5. The patch is available at the top of my 6.7-based branch: https://git.morello-project.org/kbrodsky-arm/linux/-/commits/morello/next-6… [1] https://lore.kernel.org/all/20230513141643.1037620-1-axboe@kernel.dk/ include/linux/io_uring_compat.h | 37 ++++++++++ include/uapi/linux/io_uring.h | 4 +- io_uring/io_uring.c | 118 ++++++++++++++++++++++++++++++-- 3 files changed, 150 insertions(+), 9 deletions(-) diff --git a/include/linux/io_uring_compat.h b/include/linux/io_uring_compat.h index 12e541f333f8..5d8dc250c015 100644 --- a/include/linux/io_uring_compat.h +++ b/include/linux/io_uring_compat.h @@ -62,6 +62,43 @@ struct compat_io_uring_cqe { __u64 big_cqe[]; }; +struct compat_io_sqring_offsets { + __u32 head; + __u32 tail; + __u32 ring_mask; + __u32 ring_entries; + __u32 flags; + __u32 dropped; + __u32 array; + __u32 resv1; + __u64 user_addr; +}; + +struct compat_io_cqring_offsets { + __u32 head; + __u32 tail; + __u32 ring_mask; + __u32 ring_entries; + __u32 overflow; + __u32 cqes; + __u32 flags; + __u32 resv1; + __u64 user_addr; +}; + +struct compat_io_uring_params { + __u32 sq_entries; + __u32 cq_entries; + __u32 flags; + __u32 sq_thread_cpu; + __u32 sq_thread_idle; + __u32 features; + __u32 wq_fd; + __u32 resv[3]; + struct compat_io_sqring_offsets sq_off; + struct compat_io_cqring_offsets cq_off; +}; + struct compat_io_uring_files_update { __u32 offset; __u32 resv; diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h index eba3db0a0c3d..0630df584587 100644 --- a/include/uapi/linux/io_uring.h +++ b/include/uapi/linux/io_uring.h @@ -449,7 +449,7 @@ struct io_sqring_offsets { __u32 dropped; __u32 array; __u32 resv1; - __u64 user_addr; + __kernel_uintptr_t user_addr; }; /* @@ -468,7 +468,7 @@ struct io_cqring_offsets { __u32 cqes; __u32 flags; __u32 resv1; - __u64 user_addr; + __kernel_uintptr_t user_addr; }; /* diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 39dc644f56ae..e77a1460e55c 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -208,6 +208,107 @@ static int copy_io_uring_getevents_arg_from_user(struct io_ring_ctx *ctx, return 0; } +static int get_compat64_io_uring_params(struct io_uring_params *params, + const void __user *user_params) +{ + struct compat_io_uring_params compat_params; + + if (copy_from_user(&compat_params, user_params, sizeof(compat_params))) + return -EFAULT; + + params->sq_entries = compat_params.sq_entries; + params->cq_entries = compat_params.cq_entries; + params->flags = compat_params.flags; + params->sq_thread_cpu = compat_params.sq_thread_cpu; + params->sq_thread_idle = compat_params.sq_thread_idle; + params->features = compat_params.features; + params->wq_fd = compat_params.wq_fd; + memcpy(params->resv, compat_params.resv, sizeof(params->resv)); + + params->sq_off.head = compat_params.sq_off.head; + params->sq_off.tail = compat_params.sq_off.tail; + params->sq_off.ring_mask = compat_params.sq_off.ring_mask; + params->sq_off.ring_entries = compat_params.sq_off.ring_entries; + params->sq_off.flags = compat_params.sq_off.flags; + params->sq_off.dropped = compat_params.sq_off.dropped; + params->sq_off.array = compat_params.sq_off.array; + params->sq_off.resv1 = compat_params.sq_off.resv1; + params->sq_off.user_addr = (__kernel_uintptr_t)compat_ptr(compat_params.sq_off.user_addr); + + params->cq_off.head = compat_params.cq_off.head; + params->cq_off.tail = compat_params.cq_off.tail; + params->cq_off.ring_mask = compat_params.cq_off.ring_mask; + params->cq_off.ring_entries = compat_params.cq_off.ring_entries; + params->cq_off.overflow = compat_params.cq_off.overflow; + params->cq_off.cqes = compat_params.cq_off.cqes; + params->cq_off.flags = compat_params.cq_off.flags; + params->cq_off.resv1 = compat_params.cq_off.resv1; + params->cq_off.user_addr = (__kernel_uintptr_t)compat_ptr(compat_params.cq_off.user_addr); + + return 0; +} + +static int copy_io_uring_params_from_user(struct io_uring_params *params, + const void __user *src) +{ + if (IS_ENABLED(CONFIG_COMPAT64) && in_compat_syscall()) + return get_compat64_io_uring_params(params, src); + if (copy_from_user_with_ptr(params, src, sizeof(*params))) + return -EFAULT; + return 0; +} + +static int set_compat64_io_uring_params(void __user *user_params, + const struct io_uring_params *params) +{ + struct compat_io_uring_params compat_params; + + memset(&compat_params, 0, sizeof(compat_params)); + + compat_params.sq_entries = params->sq_entries; + compat_params.cq_entries = params->cq_entries; + compat_params.flags = params->flags; + compat_params.sq_thread_cpu = params->sq_thread_cpu; + compat_params.sq_thread_idle = params->sq_thread_idle; + compat_params.features = params->features; + compat_params.wq_fd = params->wq_fd; + + compat_params.sq_off.head = params->sq_off.head; + compat_params.sq_off.tail = params->sq_off.tail; + compat_params.sq_off.ring_mask = params->sq_off.ring_mask; + compat_params.sq_off.ring_entries = params->sq_off.ring_entries; + compat_params.sq_off.flags = params->sq_off.flags; + compat_params.sq_off.dropped = params->sq_off.dropped; + compat_params.sq_off.array = params->sq_off.array; + compat_params.sq_off.user_addr = (__u64)params->sq_off.user_addr; + + compat_params.cq_off.head = params->cq_off.head; + compat_params.cq_off.tail = params->cq_off.tail; + compat_params.cq_off.ring_mask = params->cq_off.ring_mask; + compat_params.cq_off.ring_entries = params->cq_off.ring_entries; + compat_params.cq_off.overflow = params->cq_off.overflow; + compat_params.cq_off.cqes = params->cq_off.cqes; + compat_params.cq_off.flags = params->cq_off.flags; + compat_params.cq_off.resv1 = params->cq_off.resv1; + compat_params.cq_off.user_addr = (__u64)params->cq_off.user_addr; + + if (copy_to_user(user_params, &compat_params, sizeof(compat_params))) + return -EFAULT; + + return 0; +} + +static int copy_io_uring_params_to_user(struct io_ring_ctx *ctx, + void __user *dst, + const struct io_uring_params *params) +{ + if (io_in_compat64(ctx)) + return set_compat64_io_uring_params(dst, params); + if (copy_to_user_with_ptr(dst, params, sizeof(*params))) + return -EFAULT; + return 0; +} + struct sock *io_uring_get_socket(struct file *file) { #if defined(CONFIG_UNIX) @@ -2745,8 +2846,9 @@ static void io_pages_free(struct page ***pages, int npages) } static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, - unsigned long uaddr, size_t size) + void __user *uptr, size_t size) { + unsigned long uaddr = user_ptr_addr(uptr); struct page **page_array; unsigned int nr_pages; void *page_addr; @@ -2756,6 +2858,8 @@ static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, if (uaddr & (PAGE_SIZE - 1) || !size) return ERR_PTR(-EINVAL); + if (!check_user_ptr_rw(uptr, size)) + return ERR_PTR(-EFAULT); nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; if (nr_pages > USHRT_MAX) @@ -2801,14 +2905,14 @@ static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, return page_to_virt(page_array[0]); } -static void *io_rings_map(struct io_ring_ctx *ctx, unsigned long uaddr, +static void *io_rings_map(struct io_ring_ctx *ctx, void __user *uaddr, size_t size) { return __io_uaddr_map(&ctx->ring_pages, &ctx->n_ring_pages, uaddr, size); } -static void *io_sqes_map(struct io_ring_ctx *ctx, unsigned long uaddr, +static void *io_sqes_map(struct io_ring_ctx *ctx, void __user *uaddr, size_t size) { return __io_uaddr_map(&ctx->sqe_pages, &ctx->n_sqe_pages, uaddr, @@ -3895,7 +3999,7 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, if (!(ctx->flags & IORING_SETUP_NO_MMAP)) rings = io_mem_alloc(size); else - rings = io_rings_map(ctx, p->cq_off.user_addr, size); + rings = io_rings_map(ctx, (void __user *)p->cq_off.user_addr, size); if (IS_ERR(rings)) return PTR_ERR(rings); @@ -3921,7 +4025,7 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, if (!(ctx->flags & IORING_SETUP_NO_MMAP)) ptr = io_mem_alloc(size); else - ptr = io_sqes_map(ctx, p->sq_off.user_addr, size); + ptr = io_sqes_map(ctx, (void __user *)p->sq_off.user_addr, size); if (IS_ERR(ptr)) { io_rings_free(ctx); @@ -4139,7 +4243,7 @@ static __cold int io_uring_create(unsigned entries, struct io_uring_params *p, IORING_FEAT_RSRC_TAGS | IORING_FEAT_CQE_SKIP | IORING_FEAT_LINKED_FILE | IORING_FEAT_REG_REG_RING; - if (copy_to_user(params, p, sizeof(*p))) { + if (copy_io_uring_params_to_user(ctx, params, p)) { ret = -EFAULT; goto err; } @@ -4190,7 +4294,7 @@ static long io_uring_setup(u32 entries, struct io_uring_params __user *params) struct io_uring_params p; int i; - if (copy_from_user(&p, params, sizeof(p))) + if (copy_io_uring_params_from_user(&p, params)) return -EFAULT; for (i = 0; i < ARRAY_SIZE(p.resv); i++) { if (p.resv[i]) -- 2.42.1

9 months, 2 weeks

1
1
0 0

[MORELLO-SDK] Morello Linux 1.7.0

by Vincenzo Frascino

Hi All, I am glad to inform you on the availability of a new version of our SDK and base rootfs images for Morello (1.7.0). After months of hard work we are happy to share with you what we put together. Honoring our motto "Let Linux developers focus on the porting of their own application", we feel that this is another steps in the right direction. [Morello SDK] In less than 10 minutes you should be able to setup a docker container with everything you need to build an application for Morello. - Documentation: https://sdk.morello-project.org/ - Code repository: https://git.morello-project.org/morello/morello-sdk New in 1.7.0: - GDB support with Capabilities. - Support for vDSO in musl. - Initial support for compartments (limited demo of basic cases) [1]. - New versions for compilers and C libraries. [1] https://git.morello-project.org/morello/morello-examples If you want to try a demo of the SDK that runs on a Morello FVP (for more information on what is an FVP: www.morello-project.org) please have a look below: [Morello Linux] In less than 10 minutes you should be able to setup a docker container with everything you need to build and boot into a Morello Debian environment. - Documentation: https://linux.morello-project.org/ - Code repository: https://git.morello-project.org/morello/morello-linux Note: The documentation covers the instructions for Linux but if you know what you are doing and are familiar with docker no one stops you from running our solution on Windows or Mac. New in 1.7.0: - Updated Kernel ABI with initial security support. - Support for vDSO in kernel and C library. - New versions for compilers and C libraries. - Basic Compartment Demos. - Bug fixing and polishing of existing features. Note: This release does not include a new version of the Android environment. Further Android releases are now deprecated. Ongoing releases will focus on the Morello Linux Environment. Are we done with it? No, by any mean. This is just the beginning and we need your help and collaboration to make sure that we improve our solution to meet developers needs: your needs! So why don't you try it and let us know your thoughts? Thanks and Regards, Vincenzo

9 months, 3 weeks

1
1
0 0

[PATCH 00/12] Switch to capability-based uaccess

by Kevin Brodsky

Hi, This series switches all uaccess routines to operate directly on the user-provided capability pointer in PCuABI, instead of making the access via the extracted 64-bit address. This means that all forms of uaccess now enforce the capability metadata, through the use of capability-based loads and stores, and will fail with -EFAULT following a failed (hardware) capability check. The impacted routines are: - *get_user* (including get_user_ptr) - *put_user* (including put_user_ptr) - *copy_from_user* (including copy_from_user_with_ptr) - *copy_to_user* (including copy_to_user_with_ptr) (Note that futex operations are already checked thanks to Luca's work [1].) Enabling capability checks in uaccess exposed a variety of issues, both in the kernel and in userspace. This series addresses the fallout in the kernel before making the switch: - Patch 1-3 overhaul strnlen_user() to prevent it from reading beyond the bounds of the user pointer, while leaving its implementation unchanged in !PCuABI. - Patch 4-6 fixes various capability propagation issues (surprisingly few of those!). - Patch 7 fixes a bug in a Morello kselftest, detected through capability checking in copy_from_user(). Finally, the switch to capability-based accesses is made: - Patch 8-10 switch {get,put}_user and variants. - Patch 11-12 switch copy_{from,to}_user and variants. After this series, the Morello kselftests and Musl tests still pass, and so do the liburing tests, however the LTP syscalls suite doesn't because of various issues in LTP itself. I have addressed a number of them upstream [2] (series already merged), and will post the remaining fixes to linux-morello-ltp. Because this precise uaccess checking cannot be achieved with most existing sanitisers or hardware memory safety mechanisms, further bugs are likely to be identified in low-level libraries and test suites running in purecap (I have spotted a couple in the Bionic tests). Issue: https://git.morello-project.org/morello/kernel/linux/-/issues/5 Review branch: https://git.morello-project.org/kbrodsky-arm/linux/-/commits/morello/checke… Cheers, Kevin [1] https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [2] https://lore.kernel.org/ltp/20231023135647.2157030-1-kevin.brodsky@arm.com/ Kevin Brodsky (12): linux/user_ptr.h: Introduce user_ptr_{base,limit} lib: Refactor do_strnlen_user() lib: Make strnlen_user() PCuABI-friendly block: Eliminate invalid user pointer casts tty: Convert another ioctl helper to take arg as user_uintptr_t seccomp: Preserve pointers when reading sock_fprog from userspace kselftests/arm64: morello: Fix message size in mmap test arm64: morello: Implement user capability accessors inline arm64: uaccess: Move macros from futex.h to uaccess.h arm64: uaccess: Switch to capability-based {get,put}_user in PCuABI arm64: lib: Simplify copy_*_user register allocation arm64: lib: Switch to capability-based copy_*_user in PCuABI Documentation/core-api/user_ptr.rst | 13 ++ arch/arm64/include/asm/assembler.h | 8 + arch/arm64/include/asm/futex.h | 20 +-- arch/arm64/include/asm/gpr-num.h | 6 +- arch/arm64/include/asm/morello.h | 4 - arch/arm64/include/asm/uaccess.h | 49 +++++- arch/arm64/lib/copy_from_user.S | 33 +++- arch/arm64/lib/copy_template.S | 14 +- arch/arm64/lib/copy_to_user.S | 17 +- arch/arm64/lib/morello.S | 23 --- block/blk-zoned.c | 6 +- block/ioctl.c | 22 +-- drivers/tty/tty_ioctl.c | 2 +- include/linux/blkdev.h | 8 +- include/linux/tty.h | 2 +- include/linux/user_ptr.h | 44 +++++ kernel/seccomp.c | 2 +- lib/strnlen_user.c | 163 +++++++++++++++---- tools/testing/selftests/arm64/morello/mmap.c | 2 +- 19 files changed, 319 insertions(+), 119 deletions(-) -- 2.38.1

10 months, 2 weeks

3
24
0 0

[PATCH RFC v2 00/19] Introduce mm reservation interface for PCuABI

by Amit Daniel Kachhap

Hi All, This patch series introduces the mm reservation interface to manage the owning capability of the allocated addresses. As compared to the RFC v1, this series adds reservation details in the VMA structure. Looking for feedback regarding interface names, interface directory structure etc. Patch [1-11] manages capability bounds via reservation interface. Patch [12-19] adds support for managing capability permissions. Details about several rules implemented can be found in PCuABI spec here [1]. Changes in RFC v2: 1) Removed separate maple tree structures for the reservation interface and modified the vma structure to add the reservation details. As most of the mmap/munmap operations happen per-vma so this reduced the code churnings. However this approach will increase time-complexity of syscalls which operate across vma's such as mlock, madvise etc. get_unmapped_area() which generated free unmapped virtual address may now need more iterations. 2) Added Cheri base representability and length representability modifications. Now get_unmapped_area() will generate CHERI representable addresses. 3) Added new PCuABI changes for mincore() syscall. 4) Added changes for compat64. Future works: 1) Users of vm_mmap/vm_munmap() i.e. filesystems, loaders, kexec etc to be modified to preserve capability addresses. 2) Cover remaining memory addressing syscalls. Testing: 1) All tests by Chaitanya in v4 selftests [2] passes. 2) Purecap/Compat Busybox boot passes after adding [WIP] patches present in [3]. The whole series can be found here [3]. [1]: https://git.morello-project.org/morello/kernel/linux/-/wikis/Morello-pure-c… [2]: https://git.morello-project.org/chaitanya_prakash/linux.git review/purecap_mmap_testcases [3]: https://git.morello-project.org/amitdaniel/linux.git review/purecap_mm_reservation_v2 Thanks, Amit Daniel Amit Daniel Kachhap (19): uapi: errno.h: Introduce PCuABI memory reservation error arm64: morello: Add VM_PCUABI_RESERVE flags mm: Add capability reservation interfaces in vma for PCuABI mm/cap_addr_mgmt: Add capability bound helpers for PCuABI mm/mmap: Modify unmapped address space management code for PCuABI mm/mmap: Use the PCuABI reservations in mmap/munmap mm/mremap: Add the PCuABI reservation interfaces mm/mprotect: Add the PCuABI reservation interfaces mm/madvise: Add the PCuABI reservation interfaces mm/mlock: Add the PCuABI reservation interfaces mm/msync: Add the PCuABI reservation interfaces uapi: mman-common.h: Macros for maximum capability permissions mm/cap_addr_mgmt: Add capability permission helpers for PCuABI mm/cap_addr_mgmt: Reduce the maximum protection check impact mm/mmap: Disable MAP_GROWSDOWN mapping flag for PCuABI mm/mmap: Add capability permission constraints for PCuABI mm/mremap: Add capability permission constraints for PCuABI mm/mprotect: Add capability permission constraints for PCuABI mm/mincore: Add capability constraints for PCuABI arch/arm64/include/asm/cap_addr_mgmt.h | 22 ++ include/linux/cap_addr_mgmt.h | 168 +++++++++++++ include/linux/cheri.h | 3 + include/linux/mm.h | 29 ++- include/linux/mm_types.h | 5 + include/uapi/asm-generic/errno.h | 2 + include/uapi/asm-generic/mman-common.h | 6 + io_uring/advise.c | 2 +- mm/Makefile | 2 +- mm/cap_addr_mgmt.c | 314 +++++++++++++++++++++++++ mm/damon/vaddr.c | 2 +- mm/madvise.c | 27 ++- mm/mincore.c | 46 +++- mm/mlock.c | 38 ++- mm/mmap.c | 182 ++++++++++++-- mm/mprotect.c | 21 +- mm/mremap.c | 109 +++++++-- mm/msync.c | 15 +- mm/util.c | 10 +- 19 files changed, 919 insertions(+), 84 deletions(-) create mode 100644 arch/arm64/include/asm/cap_addr_mgmt.h create mode 100644 include/linux/cap_addr_mgmt.h create mode 100644 mm/cap_addr_mgmt.c -- 2.25.1

11 months, 1 week

2
32
0 0

[PATCH] uaccess_testing: Testing of capability enforcement in uaccess

by Akram Ahmad

Add tests for capability enforcement via the standard copy routines (copy_{to, from}_user, {get, put}_user), futex operations and the explicit uaccess checks used in iov_iter via readv and writev. Signed-off-by: Akram Ahmad <Akram.Ahmad(a)arm.com> --- Hi everyone, This patch extends kselftests with tests for various uaccess routines. Broadly speaking, this tests the standard uaccess routines, futex operations, and iov_iter (the latter is implemented by testing readv and writev syscalls). The tests currently examine the effects of passing a capability with a cleared tag, invalid permissions, and an invalid base address offset. These are tested separately from one another, and I would especially appreciate any comments on how this could be improved if needed (particularly on the futex test). Thank you and happy holidays! Akram [1] The branch for this patch: https://git.morello-project.org/arkamnite/linux/-/commits/morello%2Fuaccess [2] The issue ticket for this patch: https://git.morello-project.org/morello/kernel/linux/-/issues/58 tools/testing/selftests/Makefile | 1 + .../testing/selftests/arm64/morello/Makefile | 2 +- .../testing/selftests/arm64/morello/uaccess.c | 491 ++++++++++++++++++ 3 files changed, 493 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/arm64/morello/uaccess.c diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index 90a62cf75008..82abe4ddbb29 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -86,6 +86,7 @@ TARGETS += timers endif TARGETS += tmpfs TARGETS += tpm2 +TARGETS += uaccess TARGETS += user TARGETS += vDSO TARGETS += mm diff --git a/tools/testing/selftests/arm64/morello/Makefile b/tools/testing/selftests/arm64/morello/Makefile index ecfa6fc5e989..7b794d3e436c 100644 --- a/tools/testing/selftests/arm64/morello/Makefile +++ b/tools/testing/selftests/arm64/morello/Makefile @@ -17,7 +17,7 @@ CFLAGS += $(CLANG_FLAGS) $(CFLAGS_PURECAP) $(CFLAGS_COMMON) LDFLAGS += $(CLANG_LDFLAGS) $(CLANG_FLAGS) -nostdlib -static SRCS := $(wildcard *.c) $(wildcard *.S) -PROGS := bootstrap clone exit mmap read_write sched signal +PROGS := bootstrap clone exit mmap read_write sched signal uaccess DEPS := $(wildcard *.h) # these are the final executables diff --git a/tools/testing/selftests/arm64/morello/uaccess.c b/tools/testing/selftests/arm64/morello/uaccess.c new file mode 100644 index 000000000000..66d93137b819 --- /dev/null +++ b/tools/testing/selftests/arm64/morello/uaccess.c @@ -0,0 +1,491 @@ +// SPDX-License-Identifier: GPL-2.0 +// Copyright (C) 2023 Arm Limited + +#include <stdint.h> +#include <stddef.h> +#include <stdbool.h> + +#include <asm/fcntl.h> +#include <asm-generic/errno-base.h> +#include <cheriintrin.h> +#include <linux/fs.h> +#include <linux/futex.h> +#include <linux/mman.h> +#include <linux/sysinfo.h> +#include <linux/socket.h> +#include <linux/time.h> +#include <linux/uio.h> + +#include "freestanding.h" + +#define FILE_PERM 0666 +#define MSG_LEN 16 +#define NR_FUTEXES 2 + +static struct futex_waitv waitv[NR_FUTEXES]; +uint32_t futexes[NR_FUTEXES] = {1}; + +static const char file[] = "/my_file.txt"; +static int fd; +static int my_socket; + +static int open_file(void) +{ + return syscall(__NR_openat, 0, file, O_RDWR | O_CREAT, 0666); +} + +static int close_file(int __fd) +{ + return syscall(__NR_close, __fd); +} + +static __always_inline +void copy_to_user1(void) +{ + int result; + struct sysinfo my_sysinfo; + struct sysinfo *p_si = &my_sysinfo; + struct sysinfo my_sysinfo2; + struct sysinfo *p_si2 = &my_sysinfo2 + 10 * sizeof(struct sysinfo); + + result = syscall(__NR_sysinfo, p_si); + TH_LOG("%s: sysinfo with valid capability", __func__); + ASSERT_EQ(result, 0); + + TH_LOG("%s: sysinfo with invalid capability offset", __func__); + result = syscall(__NR_sysinfo, p_si2); + ASSERT_EQ(result, -EFAULT); +} + +static __always_inline +void copy_to_user2(void) +{ + int result; + struct sysinfo my_sysinfo; + struct sysinfo *cap = &my_sysinfo; + + TH_LOG("%s: sysinfo with cleared capability tag", __func__); + cap = (struct sysinfo *)cheri_tag_clear(cap); + result = syscall(__NR_sysinfo, cap); + ASSERT_EQ(result, -EFAULT); +} + +static __always_inline +void copy_to_user3(void) +{ + int result; + struct sysinfo my_sysinfo; + struct sysinfo *cap = &my_sysinfo; + + TH_LOG("%s: sysinfo with no capability permissions", __func__); + cap = (struct sysinfo *)cheri_perms_and(cap, 0); + result = syscall(__NR_sysinfo, cap); + ASSERT_EQ(result, -EFAULT); +} + +TEST(test_copy_to_user) +{ + copy_to_user1(); + copy_to_user2(); + copy_to_user3(); +} + +static __always_inline +void copy_from_user1(void) +{ + int result; + size_t my_offset = sizeof(int); + size_t *good_p = &my_offset; + size_t *bad_p = &my_offset + sizeof(int); + + /** + * Setup the parameters for our syscall: + * fd_in, fd_out: these can be the same fd. + * off_in: the capability pointing to a buffer for the offset + * off_out: NULL, as we do not need this. + * len: MSG_LEN + */ + fd = open_file(); + + result = syscall(__NR_copy_file_range, fd, good_p, fd, NULL, MSG_LEN, 0); + TH_LOG("%s: copy_file_range with valid capability", __func__); + ASSERT_GE(0, result); + + result = syscall(__NR_copy_file_range, fd, bad_p, fd, NULL, MSG_LEN, 0); + TH_LOG("%s: copy_file_range with invalid capability offset", __func__); + ASSERT_EQ(result, -EFAULT); + close_file(fd); +} + +static __always_inline +void copy_from_user2(void) +{ + int result; + size_t my_offset = sizeof(int); + size_t *good_p = &my_offset; + size_t *bad_p = (size_t *)cheri_tag_clear(good_p); + + fd = open_file(); + + result = syscall(__NR_copy_file_range, fd, bad_p, fd, NULL, MSG_LEN, 0); + TH_LOG("%s: copy_file_range with cleared capability tag", __func__); + ASSERT_EQ(result, -EFAULT); + close_file(fd); +} + +static __always_inline +void copy_from_user3(void) +{ + int result; + size_t my_offset = sizeof(int); + size_t *bad_p = (size_t *)cheri_perms_and(&my_offset, 0); + + fd = open_file(); + + result = syscall(__NR_copy_file_range, fd, bad_p, fd, NULL, MSG_LEN, 0); + TH_LOG("%s: copy_file_range with capability with no permissions", __func__); + ASSERT_EQ(result, -EFAULT); + close_file(fd); +} + +TEST(test_copy_from_user) +{ + copy_from_user1(); + copy_from_user2(); + copy_from_user3(); +} + +typedef unsigned short sa_family_t; + +struct sockaddr { + sa_family_t sa_family; + char sa_data[14]; +}; + +static __always_inline +void get_user1(void) +{ + int result; + struct sockaddr sa; + struct sockaddr sa2; + struct sockaddr *my_sockaddr_ptr = &sa2 + sizeof(int) * 1000; + + // socket(AF_INET, SOCK_STREAM, 0) + my_socket = syscall(__NR_socket, 2, 1, 0); + TH_LOG("%s: socket syscall complete", __func__); + ASSERT_GE(my_socket, 0); + + int sa_len = sizeof(sa); + int *my_len_pointer = &sa_len; + + TH_LOG("%s: getsockname with valid capability", __func__); + result = syscall(__NR_getsockname, my_socket, &sa, &sa_len); + ASSERT_EQ(result, 0); + + sa_len = sizeof(sa2); + TH_LOG("%s: getsockname with invalid capability offset", __func__); + result = syscall(__NR_getsockname, my_socket, my_sockaddr_ptr, my_len_pointer); + ASSERT_EQ(result, -EFAULT); +} + +static __always_inline +void get_user2(void) +{ + int result; + struct sockaddr sa; + int sa_len = sizeof(sa); + struct sockaddr *p_sockaddr = cheri_tag_clear(&sa); + + // socket(AF_INET, SOCK_STREAM, 0) + my_socket = syscall(__NR_socket, 2, 1, 0); + ASSERT_GE(my_socket, 0); + + result = syscall(__NR_getsockname, my_socket, p_sockaddr, &sa_len); + TH_LOG("%s: getsockname with cleared capability tag", __func__); + ASSERT_EQ(result, -EFAULT); +} + +static __always_inline +void get_user3(void) +{ + int result; + struct sockaddr sa; + int sa_len = sizeof(sa); + struct sockaddr *p_sockaddr = cheri_perms_and(&sa, 0); + + // socket(AF_INET, SOCK_STREAM, 0) + my_socket = syscall(__NR_socket, 2, 1, 0); + ASSERT_GE(my_socket, 0); + + result = syscall(__NR_getsockname, my_socket, p_sockaddr, &sa_len); + TH_LOG("%s: getsockname with no capability permissions", __func__); + ASSERT_EQ(result, -EFAULT); +} + +TEST(test_get_user) +{ + get_user1(); + get_user2(); + get_user3(); +} + +static __always_inline +void put_user1(void) +{ + int result; + struct timeval tv; + struct timeval *p_tv = &tv; + + result = syscall(__NR_gettimeofday, p_tv, NULL); + TH_LOG("%s: gettimeofday with valid capability", __func__); + ASSERT_EQ(result, 0); + + p_tv = &tv + sizeof(struct timeval) * 1000; + result = syscall(__NR_gettimeofday, p_tv, NULL); + TH_LOG("%s: gettimeofday with invalid capability offset", __func__); + ASSERT_EQ(result, -EFAULT); +} + +static __always_inline +void put_user2(void) +{ + int result; + struct timeval tv; + struct timeval *p_tv = &tv; + + p_tv = cheri_tag_clear(p_tv); + result = syscall(__NR_gettimeofday, p_tv, NULL); + TH_LOG("%s: gettimeofday with cleared capability tag", __func__); + ASSERT_EQ(result, -EFAULT); +} + +static __always_inline +void put_user3(void) +{ + int result; + struct timeval tv; + struct timeval *p_tv = &tv; + + p_tv = cheri_perms_and(p_tv, 0); + result = syscall(__NR_gettimeofday, p_tv, NULL); + TH_LOG("%s: gettimeofday with capability with no permissions", __func__); + ASSERT_EQ(result, -EFAULT); +} + +TEST(test_put_user) +{ + put_user1(); + put_user2(); + put_user3(); +} + +static inline int futex_waitv(volatile struct futex_waitv *waiters, unsigned long nr_waiters, + unsigned long flags, struct timespec *timo, clockid_t clockid) +{ + return syscall(__NR_futex_waitv, waiters, nr_waiters, flags, timo, clockid); +} + +static __always_inline +void futex1(void) +{ + struct timespec to; + + for (int i = 0; i < NR_FUTEXES; i++) { + waitv[i].uaddr = (uintptr_t)cheri_tag_clear(&futexes[i]); + waitv[i].flags = FUTEX_32 | FUTEX_PRIVATE_FLAG; + waitv[i].val = i; + waitv[i].__reserved = 0; + // This is necessary otherwise the loop is optimised away + TH_LOG("%s: waitv[%d] initialised", __func__, i); + } + + int res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC); + + ASSERT_EQ(res, -EFAULT); +} + +TEST(test_futex) +{ + futex1(); +} + +static __always_inline +void explicit_readv1(void) +{ + ssize_t bytes_read; + char buf0[2]; + char buf1[4]; + char buf2[6]; + struct iovec iov[3]; + int iovcnt; + + iov[0].iov_base = buf0; + iov[0].iov_len = sizeof(buf0); + iov[1].iov_base = buf1; + iov[1].iov_len = sizeof(buf1); + iov[2].iov_base = buf2; + iov[2].iov_len = sizeof(buf2); + + iovcnt = sizeof(iov) / sizeof(struct iovec); + + fd = open_file(); + TH_LOG("%s: readv with valid capability", __func__); + bytes_read = syscall(__NR_readv, fd, iov, iovcnt); + close_file(fd); + ASSERT_GE(bytes_read, 0); +} + +static __always_inline +void explicit_readv2(void) +{ + ssize_t bytes_read; + char buf0[2]; + char buf1[4]; + char buf2[6]; + struct iovec iov[3]; + int iovcnt; + + iov[0].iov_base = buf0; + iov[0].iov_len = sizeof(buf0); + iov[1].iov_base = buf1; + iov[1].iov_len = sizeof(buf1); + iov[2].iov_base = buf2; + iov[2].iov_len = sizeof(buf2); + + iovcnt = sizeof(iov) / sizeof(struct iovec); + + fd = open_file(); + TH_LOG("%s: readv with invalid capability tag", __func__); + bytes_read = syscall(__NR_readv, fd, cheri_tag_clear(iov), iovcnt); + close_file(fd); + ASSERT_EQ(bytes_read, -EFAULT); +} + +static __always_inline +void explicit_readv3(void) +{ + ssize_t bytes_read; + char buf0[2]; + char buf1[4]; + char buf2[6]; + struct iovec iov[3]; + int iovcnt; + + iov[0].iov_base = cheri_perms_and(buf0, 0); + iov[0].iov_len = sizeof(buf0); + iov[1].iov_base = buf1; + iov[1].iov_len = sizeof(buf1); + iov[2].iov_base = buf2; + iov[2].iov_len = sizeof(buf2); + + iovcnt = sizeof(iov) / sizeof(struct iovec); + + fd = open_file(); + TH_LOG("%s: readv with invalid capability permissions", __func__); + bytes_read = syscall(__NR_readv, fd, cheri_perms_and(iov, 0), iovcnt); + close_file(fd); + ASSERT_EQ(bytes_read, -EFAULT); +} + +static __always_inline +void explicit_writev1(void) +{ + ssize_t bytes_written; + char *buf0 = "Hello I am the first char buffer!\n"; + char *buf1 = "Hello, I am the second char buffer.\n"; + char *buf2 = "Hello, I am the third and final char buffer.\n"; + struct iovec iov[3]; + int iovcnt; + + iov[0].iov_base = buf0; + iov[0].iov_len = sizeof(buf0); + iov[1].iov_base = buf1; + iov[1].iov_len = sizeof(buf1); + iov[2].iov_base = buf2; + iov[2].iov_len = sizeof(buf2); + + iovcnt = sizeof(iov) / sizeof(struct iovec); + + fd = open_file(); + TH_LOG("%s: writev with valid capability", __func__); + bytes_written = syscall(__NR_writev, fd, iov, iovcnt); + close_file(fd); + ASSERT_GE(bytes_written, 0); +} + +static __always_inline +void explicit_writev2(void) +{ + ssize_t bytes_written; + char *buf0 = "Hello I am the first char buffer!\n"; + char *buf1 = "Hello, I am the second char buffer.\n"; + char *buf2 = "Hello, I am the third and final char buffer.\n"; + struct iovec iov[3]; + int iovcnt; + + iov[0].iov_base = buf0; + iov[0].iov_len = sizeof(buf0); + iov[1].iov_base = buf1; + iov[1].iov_len = sizeof(buf1); + iov[2].iov_base = buf2; + iov[2].iov_len = sizeof(buf2); + + iovcnt = sizeof(iov) / sizeof(struct iovec); + + fd = open_file(); + TH_LOG("%s: writev with invalid capability tag", __func__); + bytes_written = syscall(__NR_writev, fd, cheri_tag_clear(iov), iovcnt); + close_file(fd); + ASSERT_EQ(bytes_written, -EFAULT); +} + +static __always_inline +void explicit_writev3(void) +{ + ssize_t bytes_written; + char *buf0 = "Hello I am the first char buffer!\n"; + char *buf1 = "Hello, I am the second char buffer.\n"; + char *buf2 = "Hello, I am the third and final char buffer.\n"; + struct iovec iov[3]; + int iovcnt; + + iov[0].iov_base = cheri_perms_and(buf0, 0); + iov[0].iov_len = sizeof(buf0); + iov[1].iov_base = buf1; + iov[1].iov_len = sizeof(buf1); + iov[2].iov_base = buf2; + iov[2].iov_len = sizeof(buf2); + + iovcnt = sizeof(iov) / sizeof(struct iovec); + + fd = open_file(); + TH_LOG("%s: writev with invalid capability permissions", __func__); + bytes_written = syscall(__NR_writev, fd, cheri_perms_and(iov, 0), iovcnt); + close_file(fd); + ASSERT_EQ(bytes_written, -EFAULT); +} + +/* + * Test readv and writev where the array of iovecs is provided + * by a capability. + */ +TEST(test_explicit_iov_iter) +{ + explicit_readv1(); + explicit_readv2(); + explicit_readv3(); + explicit_writev1(); + explicit_writev2(); + explicit_writev3(); +} + +int main(void) +{ + test_copy_to_user(); + test_copy_from_user(); + test_get_user(); + test_put_user(); + test_futex(); + test_explicit_iov_iter(); + return 0; +} -- 2.34.1

11 months, 1 week

2
1
0 0

[PATCH] selftests/vDSO: Fix type casts in get_sysinfo_ehdr()

by Aditya Deshpande

Cast the return value of getauxptr() from void* to uintptr_t (which is defined as __uintcap_t in purecap) to address compiler warnings. Remove the unnecessary cast on getauxval(), as uintptr_t is defined as unsigned long in non-purecap anyway. Signed-off-by: Aditya Deshpande <aditya.deshpande(a)arm.com> --- Hi all, This is a minor follow up patch to the vDSO series which fixes a compiler warning about implicit type casts. The current state of the vDSO tests shouldn't cause any issues with the release as: 1. This is just a compiler warning - the test code is still functionally correct. 2. The vDSO selftests are built standalone anyways. Thanks, Aditya --- tools/testing/selftests/vDSO/parse_vdso.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/vDSO/parse_vdso.h b/tools/testing/selftests/vDSO/parse_vdso.h index 54ad67f463cc..9c891a12be7d 100644 --- a/tools/testing/selftests/vDSO/parse_vdso.h +++ b/tools/testing/selftests/vDSO/parse_vdso.h @@ -38,9 +38,9 @@ void vdso_init_from_auxv(void *auxv); static inline uintptr_t get_sysinfo_ehdr() { #ifdef __CHERI_PURE_CAPABILITY__ - return getauxptr(AT_SYSINFO_EHDR); + return (uintptr_t)getauxptr(AT_SYSINFO_EHDR); #else - return (uintptr_t)getauxval(AT_SYSINFO_EHDR); + return getauxval(AT_SYSINFO_EHDR); #endif } -- 2.25.1

11 months, 1 week

2
1
0 0

[PATCH v6 00/13] update bpf syscall for PCuABI/compat64

by Zachary Leaf

Hi, Here's v6. The bpf syscall is updated to propagate user pointers as capabilities in the pure-capability kernel-user ABI (PCuABI). It also includes an approach to support the existing aarch64 ABI (compat64). One complication here is from the fact this syscall supports many multiplexed sub-commands, some of which are themselves multiplexed with a number of further nested/multiplexed options. Another complication is that the existing syscall uses a trick of storing user pointers as u64 to avoid needing a compat handler for 32-bit systems. To retain compatibility with the aarch64 ABI and add Morello support, special compat64 conversion and handling is implemented. Inbound (userspace->kernel) conversion between compat64/native struct layouts is handled upfront on entry to the syscall (with the exception of bpf_xyz_info structs - see patch 8). This minimises changes to sub-command handlers. Some sub-commands require conversion back out to userspace and that by necessity is handled where it occurs. Patch 1 is not essential to this series but it's a nice debug feature to have and works[1]. It enables BPF_PROG_TYPE_TRACEPOINT which many eBPF kselftests use. Patches 5,6,8 implement the core compat64 handling. Each commit compiles cleanly but relevant parts will be broken inbetween. Patch 9 fixes the CHECK_ATTR macro to also check configs passed in via compat64. Patch 11 finally enables capabilities in the kernel. Patches 12,13 handles uaccess that occurs in two eBPF helper functions. The rest are setup/helper functions. Testing wise, see associated LTP changes below as posted to LTP mailing list[2]. The eBPF LTP tests are fairly minimal and test only a small part of the changes here. There's a new test to test CHECK_ATTR from patch 9. The kernel kselftests contain many more extensive eBPF tests. They can be built fairly easily natively on aarch64 which is useful for testing compat64. More work needs to be done here though to: a) enable out-of-tree cross-compilation for purecap as well as x86->aarch64 b) replace ptr_to_u64() with casts to uintptr_t in tests c) general libbpf/bpftool enablement and fixes since many tests rely on this d) CONFIG_DEBUG_INFO_BTF required for many tests but this requires the build system to have a recent version of pahole tool Next steps once we have the core kernel support would be porting libbpf and bpftool for purecap plus work on enabling kselftests as above. Kernel branch available at: https://git.morello-project.org/zdleaf/linux/-/tree/morello/bpf_v6 Associated LTP test/changes at: https://git.morello-project.org/zdleaf/morello-linux-test-project/-/tree/mo… Thanks, Zach [1] [PATCH v3 0/5] Restore syscall tracing on Morello https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [2] [PATCH v2 0/3] add eBPF support https://op-lists.linaro.org/archives/list/linux-morello-ltp@op-lists.linaro… ----------------------------------------------------------------------- v6: - Re-work BPF_LINK_CREATE memcpy in convert_compat_bpf_attr() v5: - Simplify BPF_LINK_CREATE handling in bpf/syscall.c:convert_compat_bpf_attr() - Add missing bpf_compat_ptr_field() - Re-work/fix check_attr() to catch missing enum bpf_cmd values [...] [0] [RFC PATCH 0/9] update bpf syscall for PCuABI/compat64 https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [1] [PATCH 00/10] update bpf syscall for PCuABI/compat64 https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [2] [PATCH v2 00/12] update bpf syscall for PCuABI/compat64 https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [3] [PATCH v3 00/12] update bpf syscall for PCuABI/compat64 https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [4] [PATCH v4 00/12] update bpf syscall for PCuABI/compat64 https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… [5] [PATCH v5 00/12] update bpf syscall for PCuABI/compat64 https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org… ----------------------------------------------------------------------- Zachary Leaf (13): arm64: morello: enable syscall tracing arch: rename 32bit_compat to compat32 arch: add compat helpers specific to 64-bit stddef: introduce copy_field helper bpf: compat64: add handler and convert bpf_attr in bpf: compat64: bpf_attr convert out bpf/btf: move zero check into btf.c bpf: compat64: handle bpf_{btf,prog,link}_info bpf: compat64: support CHECK_ATTR macro bpf: copy_{to,from}_user_with_ptr helpers bpf: use user pointer types in uAPI structs bpf: use addr for bpf_copy_from_user_with_task bpf: use addr for bpf_copy_from_user .../morello_transitional_pcuabi_defconfig | 2 +- arch/arm64/include/asm/compat.h | 11 +- arch/arm64/include/asm/ftrace.h | 2 +- arch/arm64/include/asm/mmu_context.h | 2 +- arch/arm64/include/asm/syscall.h | 6 +- arch/arm64/kernel/fpsimd.c | 6 +- arch/arm64/kernel/hw_breakpoint.c | 2 +- arch/arm64/kernel/perf_regs.c | 2 +- arch/arm64/kernel/pointer_auth.c | 6 +- arch/arm64/kernel/process.c | 16 +- arch/arm64/kernel/ptrace.c | 10 +- arch/arm64/kernel/signal.c | 2 +- arch/arm64/kernel/syscall.c | 2 +- arch/mips/include/asm/compat.h | 2 +- arch/parisc/include/asm/compat.h | 2 +- arch/powerpc/include/asm/compat.h | 2 +- arch/s390/include/asm/compat.h | 2 +- arch/sparc/include/asm/compat.h | 4 +- arch/x86/include/asm/compat.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +- drivers/input/input.c | 2 +- drivers/media/rc/bpf-lirc.c | 6 +- fs/ext4/dir.c | 2 +- fs/nfs/dir.c | 2 +- include/linux/bpf.h | 19 + include/linux/bpf_compat.h | 415 +++++++++ include/linux/bpfptr.h | 28 +- include/linux/compat.h | 16 +- include/linux/stddef.h | 3 + include/uapi/linux/bpf.h | 94 +- kernel/bpf/bpf_iter.c | 2 +- kernel/bpf/btf.c | 104 ++- kernel/bpf/cgroup.c | 9 +- kernel/bpf/hashtab.c | 12 +- kernel/bpf/helpers.c | 9 +- kernel/bpf/net_namespace.c | 6 +- kernel/bpf/offload.c | 2 +- kernel/bpf/syscall.c | 842 ++++++++++++++---- kernel/bpf/verifier.c | 20 +- kernel/time/time.c | 2 +- kernel/trace/bpf_trace.c | 6 +- mm/util.c | 2 +- net/bpf/bpf_dummy_struct_ops.c | 8 +- net/bpf/test_run.c | 31 +- net/core/sock_map.c | 6 +- 46 files changed, 1393 insertions(+), 342 deletions(-) create mode 100644 include/linux/bpf_compat.h -- 2.34.1

11 months, 1 week

2
14
0 0

[Announcement] Integration drop 1.7.0 - changelog

by Kevin Brodsky

Hi, The top of the master branch has been tagged [1] as part of the integration drop 1.7.0. Below is the changelog for kernel users, since the previous integration drop (1.6.1). PCuABI-related changes ---------------------- * [Issue #24] A pure-capability vDSO is now provided in PCuABI. * [Issue #7] In a small number of situations, user-provided capabilities are now explicitly checked (validity, bounds and read/write permissions). This covers cases where user memory is accessed via a kernel mapping, instead of the standard approach where user mappings are used (uaccess). A section has also been added to the porting guide [2], as porting some drivers may require adding explicit checking. Note: patches have been posted on the list to enable capability checking in uaccess, but they are yet to be merged. * [Issue #46] The TCP_ZEROCOPY_RECEIVE getsockopt() option has been modified to operate on capabilities in PCuABI. A corresponding section has been added to the PCuABI specification [3]. * [Issue #51] MMC-related ioctl commands have been adapted to operate on capabilities. Other changes ------------- * KSM (Kernel Samepage Merging) is now disabled to avoid false positives when capability tags differ. It is unclear whether KSM would still be worthwhile with the extra overhead of comparing capability tags (issue #62 created to track this). * Internal refactoring to assist with upcoming changes. Contributions ------------- Kudos to everyone who has contributed to Morello Linux! Here are the contributors and number of patches since the previous integration drop: 10 Kevin Brodsky <kevin.brodsky(a)arm.com> 7 Luca Vizzarro <Luca.Vizzarro(a)arm.com> 6 Aditya Deshpande <aditya.deshpande(a)arm.com> 3 Harry Ramsey <harry.ramsey(a)arm.com> 2 Akram Ahmad <Akram.Ahmad(a)arm.com> Special thanks are also extended to everyone who has assisted in reviewing these patches. Cheers, Kevin [1] https://git.morello-project.org/morello/kernel/linux/-/commits/morello-rele… [2] https://git.morello-project.org/morello/kernel/linux/-/blob/morello-release… [3] https://git.morello-project.org/morello/kernel/linux/-/wikis/Morello-pure-c…

11 months, 1 week

1
0
0 0

2024

2023

2022

linux-morello December 2023