Hi,
This series is a follow-up to the RFC "New CHERI API and rehauled
user_ptr.h", with a slightly different scope to make it more
self-contained.
There are two main focuses for this series:
1. Introducing linux/cheri.h. There is no fundamental change compared to
v1 here.
2. Deriving all capabilities from an appropriate userspace root
capability (cheri_user_root_*) instead of morello_root_cap. v1 started
this by reimplementing uaddr_to_user_ptr*, this series finishes up
the work.
The focus of v1, adding generic functions to linux/user_ptr.h, has been
dropped and will reappear in a separate series.
Some more details on the choice of root capabilities (see the comment in
patch 5 regarding cheri_user_root_*):
* In purecap, the PCuABI spec gives us good guidance on which root
capability we should use where. Namely:
- cheri_user_root_cap for almost all capabilities. The permissions
correspond to the maximum permissions obtainable via mmap(). As we
progress through the second phase, the bounds/permissions of
capabilities derived from this root will be restricted as specified,
and DDC will be set to null.
- cheri_user_root_{seal,cid}_cap for the AT_CHERI_{SEAL,CID}_CAP.
These capabilities exist precisely because their permissions
(Seal/Unseal/CompartmentID) are not provided in regular
capabilities (derived from cheri_user_root_cap).
- cheri_user_root_all_cap for capabilities created via (privileged)
ptrace. See patch 13 for some details on this.
* In hybrid, the de facto ABI is what Documentation/arm64/morello.rst
says. As there is no mechanism to obtain special permissions, all
capabilities are derived from cheri_user_root_all_cap. The
documentation is updated accordingly.
This series introduces functional changes by restricting the
bounds/permissions of all userspace capabilities, but these restrictions
should not affect any valid use-case. More specifically:
* In purecap, the bounds of all capabilities are restricted to the user
address space. See above for details on permissions.
* In hybrid, the bounds of capabilities are also restricted to the user
address space. All relevant permissions remain available. CSP is no
longer initialised to a valid capability, as this is neither required
nor documented.
More detailed changelog below.
v1..v2:
* Addressing review comments:
- Reformatted the function documentation to make kernel-doc -v
(mostly) happy.
- Added some comment clarifying what CHERI_PERM_SW_VMEM is about.
- Renamed ARCH_HAS_CHERI_H to HAVE_ARCH_CHERI_H.
- Renamed cheri_root*_cap_userspace to cheri_user_root_*cap and added
some description of each.
- Renamed cheri_check_cap_data_access() to cheri_check_cap().
* New patches:
- Derive compat_ptr() from cheri_user_root_all_cap (deriving from DDC
proved more complicated than expected, created a ticket for that [1])
- Derive AT_CHERI_{SEAL,CID}_CAP from cheri_user_root_{seal,cid}_cap
- Initialisation of capability registers from cheri_user_root_* (with
a clear separation between purecap and hybrid)
- Capabilities created via (privileged) ptrace now derived from
cheri_user_root_all_cap
- Remove morello_root_cap (no longer used)
- Update documentation to reflect cheri_user_root_all_cap being the
new root capability in hybrid
* Other changes:
- As per a recent update to the PCuABI spec, the BranchSealedPair is
no longer part of the rootcap permission set. It is still needed in
certain user capabilities, so moved it from CHERI_PERMS_ROOTCAP to
explicit addition to cheri_user_root_cap in morello.c.
- Added cheri_user_root_all_cap, the "root of roots" with all
permissions. cheri_user_root_cid_cap is now derived from it too, so
its bounds are not the whole address space any more.
- Patch 8/9 (new functions in user_ptr.h) dropped.
- Rebased on next.
Review branch:
https://git.morello-project.org/kbrodsky-arm/linux/-/commits/cheri_ptr_api_…
Thanks,
Kevin
[1] https://git.morello-project.org/morello/kernel/linux/-/issues/40
Kevin Brodsky (15):
pps: Add missing #include
linux/user_ptr.h: Remove kaddr_to_user_ptr()
linux/user_ptr.h: Improve comment formatting
arm64: uapi: Add asm/cheri.h
linux/cheri.h: Introduce CHERI helpers
arm64: morello: Implement cheri.h
fs/binfmt_elf: Use appropriate caps for AT_CHERI_{SEAL,CID}_CAP
arm64: compat: Use appropriate root cap in compat_ptr() in PCuABI
linux/user_ptr.h: Generic PCuABI impl for uaddr_to_user_ptr*
arm64: Remove asm/user_ptr.h
arm64: morello: Initialise user capabilities from cheri_user_root_*
arm64: morello: Initialise user DDC from cheri_user_root_*
arm64: morello: Build arbitrary user caps using appropriate root
arm64: morello: Remove morello_root_cap
arm64: morello: Update root capability in documentation
Documentation/arm64/morello.rst | 23 +++--
Documentation/core-api/user_ptr.rst | 8 --
arch/Kconfig | 2 +-
arch/arm64/Kconfig | 2 +-
arch/arm64/include/asm/cheri.h | 11 +++
arch/arm64/include/asm/compat.h | 9 +-
arch/arm64/include/asm/morello.h | 12 ++-
arch/arm64/include/asm/user_ptr.h | 43 ---------
arch/arm64/include/uapi/asm/cheri.h | 11 +++
arch/arm64/kernel/morello.c | 143 +++++++++++++++++-----------
arch/arm64/kernel/process.c | 2 +-
arch/arm64/kernel/ptrace.c | 2 +-
arch/arm64/lib/morello.S | 17 ++--
drivers/pps/pps.c | 1 +
fs/binfmt_elf.c | 10 +-
include/linux/cheri.h | 132 +++++++++++++++++++++++++
include/linux/user_ptr.h | 69 ++++++--------
lib/Makefile | 3 +
lib/cheri.c | 72 ++++++++++++++
lib/user_ptr.c | 26 +++++
20 files changed, 413 insertions(+), 185 deletions(-)
create mode 100644 arch/arm64/include/asm/cheri.h
delete mode 100644 arch/arm64/include/asm/user_ptr.h
create mode 100644 arch/arm64/include/uapi/asm/cheri.h
create mode 100644 include/linux/cheri.h
create mode 100644 lib/cheri.c
create mode 100644 lib/user_ptr.c
--
2.38.1
Hi,
This is to announce that the morello/next branch has been rebased from
5.18 to
6.1. Make sure to reset/rebase any local branch tracking next.
morello/master will also move to 6.1 (aligning with next) within the
next few
weeks. The final 5.18-based commit has been tagged morello-last-5.18.
Some important notes for all users and developers:
- HWCAP2_MORELLO is now `1ul << 63` instead of `1ul << 31` (the lower 32
bits
of HWCAP2 are now fully allocated, and new hwcaps are being allocated
in the
upper 32 bits).
- When running on the Morello board, make sure to use the latest
firmware, for
instance from [0.1], as an issue present in older firmware versions
may prevent
the kernel from booting.
- When running on FVP, make sure to use the latest FVP build [0.2].
Older builds
may cause random failures while running the kernel or userspace.
[0.1] https://git.morello-project.org/morello/board-firmware
[0.2] https://developer.arm.com/downloads/-/arm-ecosystem-fvps
The rest of this email is a changelog for the rebased patches.
-----------------
Noteworthy changes:
- "arm64: morello: Disable trapping early and unconditionally" fixed not to
skip the initialisation of SCTLR_EL1 in init_kernel_el(). The original
patch (on 5.10) was correct, but I didn't notice that the automatic
merge went
wrong when rebasing on 5.18, and somehow that only started causing trouble
when rebasing the patch again on 6.1.
- "arm64: uaccess: Support capabilities in __uaccess_mask_ptr()" needed
to be
rewritten due to [1]. The new implementation is similar to the
original, but
now diverges from the !PCuABI case. See commit message for details.
- New patch addressing a Clang issue that the rebase on 6.1 revealed:
"vmlinux.lds.h: Work around Clang issue when targeting PCuABI"
(see commit message for details and link to CHERI-LLVM issue).
- Removed setting of KSFT_KHDR_INSTALL in "kselftests/arm64: Add build
support
for the C testing environment", as this functionality was removed by [2].
make headers_install now needs to be run manually before building the
kselftests.
- A lot of io_uring development has happened since 5.18, the most obvious
change being that fs/io_uring.c has been split into dozens of files under
io_uring/*. Due to this and other changes/additions:
* The following patches have been updated in consequence:
- "io_uring: Fix __capability annotations in PCuABI",
- "io_uring: Fix user pointer downcast"
* New patches:
- "io_uring/net: Make io_recvmsg_prep_multishot() PCuABI-friendly"
(addresses build issues with a new functionality)
- "io_uring: Enlarge struct io_cmd_data in PCuABI"
(addresses an issue revealed by a new assertion, approach agreed with
Tudor)
* Patch dropped as it is no longer needed thanks to some refactoring
upstream:
- "fs/io_uring: Fix usage of err.h macros with user pointers"
- Due to the cross-arch <asm/compat.h> refactoring from [3.1], where many
definitions moved to the asm-generic header:
* "arm64: compat: Fix structs for compat64" is narrowed down to
"asm-generic: Fix struct compat_shmid64_ds for compat64", and a new
patch
"arm64: compat: Only define compat_mode_t as u16 in compat32" is
added to
take care of struct compat_ipc64_perm in a less invasive way.
* "arm64: compat: Fix structs compat_semid64_ds/compat_msqid64_ds" becomes
"asm-generic: Fix structs compat_{semid64,msqid64}_ds for compat64"
(same
diff but in asm-generic instead).
* "arm64: compat: update compat defines to 64-bits" was split in a few
separate patches. See Téo's new version on the list ("[PATCH v5 0/2]
arm64:
compat: update compat defines to 64-bits" and follow-ups).
Other changes:
- "arm64: morello: System register definitions" aligned with the new sysreg
macro generation scheme (arch/arm64/tools/sysreg). Some macro names
changed
as a result, the following commits were adjusted accordingly.
- "lib: Fix user pointer downcasts", "iov_iter: Handle struct iovec and
struct
kvec separately" updated in line with changes to lib/iov_iter.c,
notably the
introduction of ITER_UBUF in [4.1]. [5] also added
iov_iter_aligned_iovec(),
so the second patch was extended to add its counterpart
iov_iter_aligned_kvec() (added my Co-developed-by to that patch).
- "arm64: morello: Add support for TLS as capabilities" updated in line
with [6]
(the prototype of copy_thread() no longer needs changing as it gets
passed a
pointer to the whole struct kernel_clone_args). Added my
Co-developed-by to
that patch too.
- "uaccess: Add tag-preserving routines" updated in line with [7].
- New patch "tracing: Fix signature of unlocked_ioctl callback" to fix a new
ioctl handler (posted by Zachary on the list).
- "arm64: configs: Add Morello transitional PCuABI defconfig" updated as per
make savedefconfig.
- Fixed whitespace errors in a few patches.
Dropped patches:
- "drm/komeda - Fix handling of pending crtc state commit to avoid lock-up"
(alternative fix made it upstream, the rest of the patches in that
series are
also upstream)
- "fs/proc/vmcore: Segregate the user and kernel buffers" (superseded by
[8])
- "arm64/efi: morello: Provide EFI stub version for memcpy/memmove"
(no longer needed thanks to [9])
- "uapi/asm-generic/unistd.h: Use compat_sys_ptrace()" (fixed upstream
by [3.2])
- 6 various cherry-picks from mainline that are present in 6.1, including
Vincenzo's "security/keys: Remove inconsistent __user annotation".
Relevant patch series that landed upstream between 5.18 and 6.1: [3], [4]
[1]
https://lore.kernel.org/all/20220922151053.3520750-1-mark.rutland@arm.com/
[2]
https://lore.kernel.org/all/cover.1657296695.git.guillaume.tucker@collabora…
[3] https://lore.kernel.org/all/20220405071314.3225832-1-guoren@kernel.org/
[3.1]
https://lore.kernel.org/all/20220405071314.3225832-7-guoren@kernel.org/
[3.2]
https://lore.kernel.org/all/20220405071314.3225832-8-guoren@kernel.org/
[4] https://lore.kernel.org/all/YrKWRCOOWXPHRCKg@ZenIV/
[4.1]
https://lore.kernel.org/all/20220622041552.737754-9-viro@zeniv.linux.org.uk/
[5] https://lore.kernel.org/all/20220610195830.3574005-9-kbusch@fb.com/
[6]
https://lore.kernel.org/all/20220506141512.516114-2-ebiederm@xmission.com/
[7] https://lore.kernel.org/all/20220915150417.722975-4-glider@google.com/
[8]
https://lore.kernel.org/all/20211213000636.2932569-4-willy@infradead.org/
[9] https://lore.kernel.org/all/20220910081152.2238369-4-ardb@kernel.org/
Cheers,
Kevin