Hi All,
This patch series introduces the mm reservation interface to manage
the owning capability of the allocated addresses. Looking for feedback
regarding interface names, interface directory structure, reservation layer
outside the VMA(current approach) vs reservation layer inside the VMA etc.
Below are the implemented features in brief:
1) Reservation interface to implement the different PCuABI reservation rules.
This reservations sits outside the VMA layer and can be used before and after
the VMA updates. Currently all interfaces supports only mmap_lock locked version.
2) The reservation interfaces and owning capability helpers are created as a library
so that they can be used by different components (i.e. mm, elf loaders etc.).
3) munmap() syscall allows shrinking the mappings but reservation range remains fixed
so they cannot be mapped again until the last mapping in the reservation range is unmapped.
4) mremap() trying to remap new size lesser then old size behaves same as munmap. mremap()
with new size larger than old size and with MREMAP_MAYMOVE flag will move the reservation
also if the mapped range is same as reservation range.
4) Reservation bound constraint checks added for mprotect, madvise,
mlock, mincore and msync syscall.
5) Helpers added to validate the capability address permission constraints.
6) Capability permission constraint checks added for mmap, mremap and mprotect syscall.
7) Details about several rules implemented can be found in PCuABI spec here [1].
Limitations/Unimplemented works:
1) Users of vm_mmap/vm_munmap() i.e. filesystems, loaders etc are not
modified to preserve capability addresses so patch 6
"mm/(mmap, munmap): Limit reservation for only syscalls" added to
limit reservation to syscalls.
2) Patch 15 "lib/cap_addr_mgmt: Reduce the maximum protection check impact"
added to boot in the busybox.
3) Cover remaning memory addressing syscalls.
Testing:
1) Chaitanya v2 selftests [2].
2) Busybox boot.
The whole series can be found here [3].
[1]: https://git.morello-project.org/morello/kernel/linux/-/wikis/Morello-pure-c…
[2]: https://git.morello-project.org/chaitanya_prakash/linux.git review/mmap_testcase
[3]: https://git.morello-project.org/amitdaniel/linux.git review/purecap_mm_reservation_v1
Thanksm,
Amit Daniel
Amit Daniel Kachhap (19):
uapi: errno.h: Introduce PCuABI memory reservation error
mm: Add capability reservation interfaces for PCuABI
lib/cap_addr_mgmt: Add capability bound helpers for PCuABI
mm/(mmap, mremap): Add flags to ignore reservation in unmap functions
mm/mmap: Use the PCuABI reservations in mmap/munmap
mm/(mmap, munmap): Limit reservation for only syscalls
mm/mremap: Add the PCuABI reservation interfaces
mm/mprotect: Add the PCuABI reservation interfaces
mm/madvise: Add the PCuABI reservation interfaces
mm/mlock: Add the PCuABI reservation interfaces
mm/mincore: Add the PCuABI reservation interfaces
mm/msync: Add the PCuABI reservation interfaces
uapi: mman-common.h: Helpers for maximum capability permissions
lib/cap_addr_mgmt: Add capability permission helpers for PCuABI
lib/cap_addr_mgmt: Reduce the maximum protection check impact
mm/mmap: Disable MAP_GROWSDOWN mapping flag for PCuABI
mm/mmap: Add capability permission constraints for PCuABI
mm/mremap: Add capability permission constraints for PCuABI
mm/mprotect: Add capability permission constraints for PCuABI
arch/arm64/include/asm/cap_addr_mgmt.h | 22 +++
fs/aio.c | 2 +-
include/linux/cap_addr_mgmt.h | 167 +++++++++++++++++
include/linux/cheri.h | 3 +
include/linux/mm.h | 20 +-
include/linux/mm_types.h | 3 +
include/uapi/asm-generic/errno.h | 2 +
include/uapi/asm-generic/mman-common.h | 6 +
io_uring/advise.c | 2 +-
ipc/shm.c | 2 +-
kernel/fork.c | 8 +
lib/Makefile | 1 +
lib/cap_addr_mgmt.c | 250 +++++++++++++++++++++++++
mm/damon/vaddr.c | 2 +-
mm/internal.h | 4 +-
mm/madvise.c | 27 ++-
mm/mincore.c | 18 +-
mm/mlock.c | 37 +++-
mm/mmap.c | 134 +++++++++++--
mm/mprotect.c | 22 ++-
mm/mremap.c | 117 ++++++++++--
mm/msync.c | 17 +-
mm/nommu.c | 2 +-
mm/util.c | 16 +-
24 files changed, 808 insertions(+), 76 deletions(-)
create mode 100644 arch/arm64/include/asm/cap_addr_mgmt.h
create mode 100644 include/linux/cap_addr_mgmt.h
create mode 100644 lib/cap_addr_mgmt.c
--
2.25.1
Hi All,
I am glad to inform you on the availability of a new version of our SDK and
base rootfs images for Morello (1.6.1). After months of hard work we are happy
to share with you what we put together.
Honoring our motto "Let Linux developers focus on the porting of their own
application", we feel that this is another steps in the right direction.
[Morello SDK]
In less than 10 minutes you should be able to setup a docker container with
everything you need to build an application for Morello.
- Documentation: https://sdk.morello-project.org/
- Code repository: https://git.morello-project.org/morello/morello-sdk
New in 1.6.1:
- Dynamic linking support for llvm/musl.
- Experimental C++ support for llvm/musl.
- Initial version of GCC/GLibC (with static linking).
If you want to try a demo of the SDK that runs on a Morello FVP (for more
information on what is an FVP: www.morello-project.org) please have a look below:
[Morello Linux]
In less than 10 minutes you should be able to setup a docker container with
everything you need to build and boot into a Morello Debian environment.
- Documentation: https://linux.morello-project.org/
- Code repository: https://git.morello-project.org/morello/morello-linux
Note: The documentation covers the instructions for Linux but if you know what
you are doing and are familiar with docker no one stops you from running our
solution on Windows or Mac.
New in 1.6.1:
- New kernel based on Linux 6.4.
- Graphic environment support with 3D acceleration (compat mode only).
- Shared folders support on FVP to simplify development.
Note: This release does not include a new version of the Android environment.
Further Android releases are now deprecated. Ongoing releases will focus on
the Morello Linux Environment.
Are we done with it?
No, by any mean. This is just the beginning and we need your help and
collaboration to make sure that we improve our solution to meet developers
needs: your needs!
So why don't you try it and let us know your thoughts?
Thanks and Regards,
Vincenzo
Hi,
The top of the master branch has been tagged [1] as part of the
integration drop 1.6.1.
Below is the changelog for kernel users, since the previous integration
drop (1.6).
PCuABI-related changes
----------------------
An important milestone has been reached regarding the support for the
pure-capability kernel-user ABI (PCuABI). So far, our efforts have been
focused on functional support for the ABI, and we have reached a
satisfactory level of compliance. We are now progressively shifting
towards the security aspects of the ABI, in other words checking
capabilities provided by userspace and narrowing the bounds and
permissions of those provided to userspace, as per the PCuABI
specification [2]. A few aspects have now been implemented, see the last
two items below.
* The io_uring and AIO subsystems have been modified to operate on full
capabilities in PCuABI. See the PCuABI specification [3] for further
details concerning io_uring (update for AIO coming soon).
* The futex_waitv syscall has been modified to read full capabilities in
PCuABI. Updated struct definitions are available in the PCuABI
specification [4] (in addition to the relevant uapi headers).
* The bounds of all user capabilities have been narrowed to the user
address space (48-bit by default), in both PCuABI and the standard
AArch64 ABI.
* Capabilities passed to the futex syscall are now checked for validity
by directly using them to access memory.
Other changes
-------------
* All CHERI/Morelo-related documentation can now be found under
Documentation/cheri [5] (or linked from there).
* Support for kernel modules has been enabled.
* The following drivers have been enabled in
morello_transitional_pcuabi_defconfig: NFS (including NFS rootfs),
TUN, TAP, CoreSight.
* The Morello kselftests can now be built with GCC.
* The branch has been rebased on the 6.4 upstream release. No
Morello-related user-visible change is expected, see this email [6]
for details.
Bug fixes
---------
* The fcntl syscall used to treat its optional third argument as a
64-bit integer, where the command expects an integer, instead of the
documented 32-bit. In certain cases, it also assumed that the upper 32
bits are zeroes. This cannot be guaranteed in general, especially not
in the Morello purecap variadic PCS. fnctl now always treats an
integer argument as 32-bit. This issue has also been fixed
upstream [7].
* In a standard AArch64 process (compat64), a stale SP value could be
set when delivering two signal consecutively. Additionally, if the
interrupted context was running in Restricted, the signal was
incorrectly delivered on the Restricted stack (instead of Executive).
Both of these issues have been fixed.
Contributions
-------------
Kudos to everyone who has contributed to Morello Linux! Here are the
contributors and number of patches since the previous integration drop:
28 Kevin Brodsky <kevin.brodsky(a)arm.com>
20 Tudor Cretu <tudor.cretu(a)arm.com>
13 Amit Daniel Kachhap <amit.kachhap(a)arm.com>
11 Luca Vizzarro <Luca.Vizzarro(a)arm.com>
3 Pawel Zalewski <pzalewski(a)thegoodpenguin.co.uk>
2 Harrison Marcks <hmarcks(a)thegoodpenguin.co.uk>
2 Kristina Martsenko <kristina.martsenko(a)arm.com>
2 Vincenzo Frascino <vincenzo.frascino(a)arm.com>
1 Harry Ramsey <harry.ramsey(a)arm.com>
Special thanks are also extended to everyone who has assisted in
reviewing these patches.
Cheers,
Kevin
[1]
https://git.morello-project.org/morello/kernel/linux/-/commits/morello-rele…
[2]
https://git.morello-project.org/morello/kernel/linux/-/wikis/Morello-pure-c…
[3]
https://git.morello-project.org/morello/kernel/linux/-/wikis/Morello-pure-c…
[4]
https://git.morello-project.org/morello/kernel/linux/-/wikis/Morello-pure-c…
[5]
https://git.morello-project.org/morello/kernel/linux/-/tree/morello-release…
[6]
https://op-lists.linaro.org/archives/list/linux-morello@op-lists.linaro.org…
[7]
https://lore.kernel.org/linux-fsdevel/20230414152459.816046-1-Luca.Vizzarro…
Hi Menna,
Please always keep the list in copy for any communication.
On 7/12/23 14:32, Menna Mahmoud wrote:
> Hi Vincenzo,
>
> On Wed, 12 Jul 2023 at 16:24, Vincenzo Frascino <vincenzo.frascino(a)arm.com>
> wrote:
>
>> Hi Menna,
>>
>> On 7/12/23 14:01, Menna Mahmoud wrote:
>>> Where fvp.dtb exists? , I couldn't find it.
>>
>> Is the dtb file you are generating to with the kernel compilation.
>> You need to copy it over and *rename* it as fvp.dtb.
>>
>
> Sorry for disturbing, but which one:
>
> ```
> menna@menna:~/Desktop/optee-project/linux/arch/arm64/boot/dts$ ls
> actions amlogic broadcom intel microchip renesas tesla
> allwinner apm cavium lg nuvoton rockchip ti
> altera apple exynos Makefile nvidia socionext toshiba
> amazon arm freescale marvell qcom sprd xilinx
> amd bitmain hisilicon mediatek realtek synaptics
> menna@menna:~/Desktop/optee-project/linux/arch/arm64/boot/dts$ cd arm
> menna@menna:~/Desktop/optee-project/linux/arch/arm64/boot/dts/arm$ ls
> corstone1000.dtsi foundation-v8-gicv3.dtb fvp-base-revc.dtb
> juno-r1.dts juno-scmi.dtsi
> corstone1000-fvp.dtb foundation-v8-gicv3.dts fvp-base-revc.dts
> juno-r1-scmi.dtb Makefile
> corstone1000-fvp.dts foundation-v8-gicv3.dtsi juno-base.dtsi
> juno-r1-scmi.dts rtsm_ve-aemv8a.dtb
> corstone1000-mps3.dtb foundation-v8-gicv3-psci.dtb juno-clocks.dtsi
> juno-r2.dtb rtsm_ve-aemv8a.dts
> corstone1000-mps3.dts foundation-v8-gicv3-psci.dts juno-cs-r1r2.dtsi
> juno-r2.dts rtsm_ve-motherboard.dtsi
> foundation-v8.dtb foundation-v8-psci.dtb juno.dtb
> juno-r2-scmi.dtb rtsm_ve-motherboard-rs2.dtsi
> foundation-v8.dts foundation-v8-psci.dts juno.dts
> juno-r2-scmi.dts vexpress-v2f-1xv7-ca53x2.dtb
> foundation-v8.dtsi foundation-v8-psci.dtsi
> juno-motherboard.dtsi juno-scmi.dtb vexpress-v2f-1xv7-ca53x2.dts
> foundation-v8-gicv2.dtsi foundation-v8-spin-table.dtsi juno-r1.dtb
> juno-scmi.dts vexpress-v2m-rs1.dtsi
> menna@menna:~/Desktop/optee-project/linux/arch/arm64/boot/dts/arm$
>
> ```
>
This is not the morello kernel you compiled with the OPTEE fixes.
That kernel should have a "morello-fvp.dtb" which you need to rename into "fvp.dtb".
Thanks.
>>
>> --
>> Regards,
>> Vincenzo
>>
>
--
Regards,
Vincenzo
This patch series enables macvlan and macvtap support on the morello
board. MACVLAN is an important part of containerised hosts.
V2 adds "Signed off" message
0001 makes changes to tap.c such that CHERI capabilities can be used
and "pointer or value" arguments are addressed in a compat function
0002 enables MACVLAN and MACVTAP support in the tree
The change has been tested using Docker
Harrison Marcks (2):
net: tap: make PCuABI compliant
arm64: morello: enable MACVLAN by default
.../morello_transitional_pcuabi_defconfig | 2 ++
drivers/net/tap.c | 17 +++++++++++++++--
2 files changed, 17 insertions(+), 2 deletions(-)
--
2.34.1
Hi,
The morello/next branch has been rebased from v6.1 to v6.4. Make sure to
reset/rebase any local branch tracking next. The final 6.1-based commit has been
tagged morello-last-6.1.
There should be no user-visible change following this rebase, aside from upstream
changes between 6.1 and 6.4. The rest of this email provides a detailed changelog
for developers.
Cheers,
Kevin
--------------
Noteworthy changes:
- Reverted access_ok() to its original interface by dropping "uaccess: Allow any
address/pointer type for access_ok()". This was motivated by the
incompatibility that patch created with [1], and the weak justification
behind it. We almost always have (or should have) a user pointer available
when calling access_ok(), so changing its interface creates more problems
than it solves. Related changes:
* Added "uaccess: Fix user pointer downcast" and "arm64: uaccess: Extract
user address before untagging" to replace that patch.
* Dropped "kernel/fork: Remove unnecessary cast when using access_ok()"
* Replaced "mm/(gup, mincore): Remove unnecessary cast when using access_ok()"
with:
- "mm/gup: Create user pointer when calling access_ok()"
- "mm/mincore: Temporarily create a user pointer for access_ok()"
* Updated "Documentation: core-api: Add a new document about user pointers"
accordingly.
- The upsizing in "io_uring: Enlarge struct io_cmd_data in PCuABI" had to be
revised upwards due to [2] and [3] (each adding 16 bytes to struct io_sr_msg
due to alignment requirements). struct io_cmd_data is now 2 cachelines
instead of 1.5 (96 -> 128 bytes).
- Tweaked "io_uring: Implement compat versions of uAPI structs and handle them"
to align it with following upstream patch series:
* "User mapped provided buffer rings" [4]: aligned with the renaming of
struct io_uring_buf_reg::pad to ::flags; moved the ring size calculation
from io_alloc_pbuf_ring() and io_pin_pbuf_ring() to
io_register_pbuf_ring(), in order to calculate the size of the ring
correctly in the compat case in both cases (without duplicating it).
* "io_uring: Pass the whole sqe to commands" [5]: as a result of this
series, io_uring commands get a pointer to a full (native) SQE, even in
compat. To avoid giving them access to uninitialised memory,
changed convert_compat64_io_uring_sqe() to zero out the end of the cmd
array in the output SQE.
- Used new vm_flags accessor in "io_uring: Allow capability tag access on the
shared memory" and "aio: Allow capability tag access on the shared memory",
following [6].
- Updated a few more prototypes to pass user_data as __kernel_uintptr_t in
"io_uring: Use user pointer type in the uAPI structs", due to [7].
- [8] provides a similar functionality to "module: Allow arch overrides for ELF
arch check". The latter was dropped and "module: Enable module loading for
PCuABI kernels" was adapted to use the interface introduced by [8] (thanks
Kristina).
Minor changes:
- Updated "arm64: morello: Disable trapping early and unconditionally" to stash
LR into TPIDR_EL0 in init_kernel_el as [9] causes LR to be clobbered by a
subsequent call (on the Morello board, not FVP).
- Aligned "arm64: morello: Signal handling support" with recent changes to
arch/arm64/kernel/signal.c
- Updated NSIGSEGV in all assertions in "arm64: morello: Handle capability faults"
- Updated "tracing/syscalls: Allow amending metadata macro arguments" to take
care of new uses of SYSCALL_METADATA() in arch code (powerpc).
- Added a #include <linux/user_ptr.h> in "arm64: memory: Always return a u64 in
untagged_addr()", as it looks like asm/signal.h no longer (implicitly)
includes it.
- Extended "fs/ioctl: Modify 3rd argument of fops->unlocked_ioctl to user_uintptr_t"
to handle the ioctl wrappers added by [10].
- Replaced "iov_iter: use copy_from_user_with_ptr for struct iovec" with a new
patch "iov_iter: Use get_user_ptr for PCuABI support", as
copy_iovec_from_user() now uses get_user() instead of copy_from_user() (see
[11]). The new patch was moved earlier in the branch to preserve bisectability.
- Moved "tcp: Explicitly create user pointers" earlier in the branch to preserve
bisectability (without warning).
- "arm64: configs: Add Morello transitional PCuABI defconfig" and "arm64:
morello: Enable basic 9P FS support in transitional defconfig" updated as
per make savedefconfig.
Dropped:
- "arm64: signal: Flatten restore_sigframe() error handling" (it doesn't make
much sense any more, considering recent additions to that function).
- "mm/hugetlb: Use appropriate user pointer conversions" and
"mm/shmem: Use appropriate user pointer conversions" (reverted as part of
the recently merged "New user_ptr helpers for uaccess" series).
- "arm64: entry-ftrace.S: Fix build when CONFIG_ARM64_MORELLO=y" (no longer
needed thanks to [12]).
- Landed in mainline and already included in v6.4:
* "uapi/linux/const.h: Prefer ISO-friendly __typeof__"
* "arm64: compat: Remove defines now in asm-generic"
* "net: Finish up ->msg_control{,_user} split"
* "memfd: Pass argument of memfd_fcntl as int"
- "io_uring/kbuf: Fix size for shared buffer ring" (fixed upstream by [13]).
[1] https://lore.kernel.org/all/20230410174345.4376-2-dev@der-flo.net/
[2] https://lore.kernel.org/all/f1a1ba93-1adf-63fa-6f0f-f3182f165841@kernel.dk/
[3] https://lore.kernel.org/all/0b0d4411-c8fd-4272-770b-e030af6919a0@kernel.dk/
[4] https://lore.kernel.org/io-uring/20230314171641.10542-1-axboe@kernel.dk/
[5] https://lore.kernel.org/all/20230504121856.904491-1-leitao@debian.org/
[6] https://lore.kernel.org/all/20230126193752.297968-3-surenb@google.com/
[7] https://lore.kernel.org/all/20221124093559.3780686-6-dylany@meta.com/
[8] https://lore.kernel.org/all/20221128041539.1742489-2-npiggin@gmail.com/
[9] https://lore.kernel.org/all/20230111102236.1430401-6-ardb@kernel.org/
[10] https://lore.kernel.org/all/20221205123903.159838-3-brgl@bgdev.pl/
[11]
https://lore.kernel.org/all/CAHk-=wiC5OBj36LFKYRONF_B19iyuEjK2WQFJpyZ+-w39m…
[12] https://lore.kernel.org/all/20221103170520.931305-5-mark.rutland@arm.com/
[13] https://lore.kernel.org/all/20230218184141.70891-1-wlukowicz01@gmail.com/
This patch series enables macvlan and macvtap support on the morello
board. MACVLAN is an important part of containerised hosts.
0001 makes changes to tap.c such that CHERI capabilities can be used
and "pointer or value" arguments are addressed in a compat function
0002 enables MACVLAN and MACVTAP support in the tree
The change has been tested using Docker
Harrison Marcks (2):
net: tap: make PCuABI compliant
arm64: morello: enable MACVLAN by default
.../morello_transitional_pcuabi_defconfig | 2 ++
drivers/net/tap.c | 17 +++++++++++++++--
2 files changed, 17 insertions(+), 2 deletions(-)
--
2.34.1