From patchwork Mon Nov 27 16:38:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 119752 Delivered-To: patch@linaro.org Received: by 10.140.22.227 with SMTP id 90csp512702qgn; Mon, 27 Nov 2017 08:39:19 -0800 (PST) X-Google-Smtp-Source: AGs4zMZmzKUaV5ssDJZbJF4TFFOX08JrxnHR1er2eOD5Oz8aBfnDxxfk31OeZ58HJC6FYJwYfjwV X-Received: by 10.84.132.129 with SMTP id e1mr12644917ple.376.1511800759701; Mon, 27 Nov 2017 08:39:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1511800759; cv=none; d=google.com; s=arc-20160816; b=N42Q8uaiFJL4NXnRr+KUd3a/7yZjBnfqtIN/NAMh8zB7gdkN74xSHS+hUDFF7z6305 Vw+iw54cF7ZsS/lhIUtScfwpa5xwp9PRThGadglExap9rqysPlGmKwbAbaqyWvVktV1x iQnUVwVJ6vzsD+aX2Qc9iB8gQ2BvZbLSegUOGqvVcoJctdqtaePFpa/wWb682bSGHD8F BMUAW2WIn5zXwQbRf1nX0n7PYG8oU6ugFoBg5hao3OGCgy7gJGqSpQ58grif1rP8NJCB dnjqYm2yd0iOme7yTRn7ZDqRPMwWpycLZUWCwQQJqg8q1Pzer03NM3Uhrr3wGVEyOjP1 xcYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=InbLVbF6fPxSBn5bbNkgSm4lSvxN1MAxXFdW7w6t7ck=; b=h3uOlkmTsjSQcnuHSLD2gDXj8y5i5x1C2e4d7DR57IKfcAJZNOOE/PlB5Dd284iSyy geZtSmS7iFpueDewwbSvW1W4F+/88JmqgO8yTFbseX716mWtFO67zI0wk3fgRbbf4RVL 6K1+z37YdY4d9fYBJSFEc9NzNb103NFkfV9dBHJ7Yw/MBTjKhjKCMtvahMRidDOsjrgz oCiKm0jg2PaCSbF0vQWgZ/rGh8s5SrBTqtxNRM6Sshub2dvHvOyfjRvxk/ynG4FsVJ1k qpNRo3XGFo9bQy+LFkLNjKKFOpxjGis2yuc1nVw96ZBBoQogFkSNb9dIZTviQEFPmCAa UpGw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z5si1412884pln.408.2017.11.27.08.39.19; Mon, 27 Nov 2017 08:39:19 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932131AbdK0QjQ (ORCPT + 28 others); Mon, 27 Nov 2017 11:39:16 -0500 Received: from foss.arm.com ([217.140.101.70]:40200 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753684AbdK0QjO (ORCPT ); Mon, 27 Nov 2017 11:39:14 -0500 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id E04CF1529; Mon, 27 Nov 2017 08:39:13 -0800 (PST) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 456D43F246; Mon, 27 Nov 2017 08:39:11 -0800 (PST) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@linaro.org, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, yao.qi@arm.com, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org Subject: [PATCHv2 08/12] arm64: perf: strip PAC when unwinding userspace Date: Mon, 27 Nov 2017 16:38:02 +0000 Message-Id: <20171127163806.31435-9-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171127163806.31435-1-mark.rutland@arm.com> References: <20171127163806.31435-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When the kernel is unwinding userspace callchains, we can't expect that the userspace consumer of these callchains has the data necessary to strip the PAC from the stored LR. This patch has the kernel strip the PAC from user stackframes when the in-kernel unwinder is used. This only affects the LR value, and not the FP. This only affects the in-kernel unwinder. When userspace performs unwinding, it is up to userspace to strip PACs as necessary (which can be determined from DWARF information). Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Will Deacon Cc: Yao Qi --- arch/arm64/include/asm/pointer_auth.h | 7 +++++++ arch/arm64/kernel/perf_callchain.c | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h index b08ebec4b806..07788ce755bc 100644 --- a/arch/arm64/include/asm/pointer_auth.h +++ b/arch/arm64/include/asm/pointer_auth.h @@ -79,6 +79,12 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, */ #define ptrauth_pac_mask() GENMASK(54, VA_BITS) +/* Only valid for EL0 TTBR0 instruction pointers */ +static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr) +{ + return ptr & ~ptrauth_pac_mask(); +} + #define mm_ctx_ptrauth_init(ctx) \ ptrauth_keys_init(&(ctx)->ptrauth_keys) @@ -89,6 +95,7 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, ptrauth_keys_dup(&(oldctx)->ptrauth_keys, &(newctx)->ptrauth_keys) #else +#define ptrauth_strip_insn_pac(lr) (lr) #define mm_ctx_ptrauth_init(ctx) #define mm_ctx_ptrauth_switch(ctx) #define mm_ctx_ptrauth_dup(oldctx, newctx) diff --git a/arch/arm64/kernel/perf_callchain.c b/arch/arm64/kernel/perf_callchain.c index bcafd7dcfe8b..928204f6ab08 100644 --- a/arch/arm64/kernel/perf_callchain.c +++ b/arch/arm64/kernel/perf_callchain.c @@ -35,6 +35,7 @@ user_backtrace(struct frame_tail __user *tail, { struct frame_tail buftail; unsigned long err; + unsigned long lr; /* Also check accessibility of one struct frame_tail beyond */ if (!access_ok(VERIFY_READ, tail, sizeof(buftail))) @@ -47,7 +48,9 @@ user_backtrace(struct frame_tail __user *tail, if (err) return NULL; - perf_callchain_store(entry, buftail.lr); + lr = ptrauth_strip_insn_pac(buftail.lr); + + perf_callchain_store(entry, lr); /* * Frame pointers should strictly progress back up the stack