[PATCHv2,11/12] arm64: enable pointer authentication

Message ID	20171127163806.31435-12-mark.rutland@arm.com
State	Superseded
Headers	show Delivered-To: patch@linaro.org Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; From: Mark Rutland <mark.rutland@arm.com> To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@linaro.org, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, yao.qi@arm.com, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org Subject: [PATCHv2 11/12] arm64: enable pointer authentication Date: Mon, 27 Nov 2017 16:38:05 +0000 Message-Id: <20171127163806.31435-12-mark.rutland@arm.com> In-Reply-To: <20171127163806.31435-1-mark.rutland@arm.com> References: <20171127163806.31435-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk
Series	ARMv8.3 pointer authentication userspace support \| expand [PATCHv2,00/12] ARMv8.3 pointer authentication userspace support [PATCHv2,01/12] asm-generic: mm_hooks: allow hooks to be overridden individually [PATCHv2,02/12] arm64: add pointer authentication register bits [PATCHv2,03/12] arm64/cpufeature: add ARMv8.3 id_aa64isar1 bits [PATCHv2,04/12] arm64/cpufeature: detect pointer authentication [PATCHv2,05/12] arm64: Don't trap host pointer auth use to EL2 [PATCHv2,06/12] arm64: add basic pointer authentication support [PATCHv2,07/12] arm64: expose user PAC bit positions via ptrace [PATCHv2,08/12] arm64: perf: strip PAC when unwinding userspace [PATCHv2,09/12] arm64/kvm: preserve host HCR_EL2 value [PATCHv2,10/12] arm64/kvm: context-switch ptrauth registers [PATCHv2,11/12] arm64: enable pointer authentication [PATCHv2,12/12] arm64: docs: document pointer authentication

Message ID

20171127163806.31435-12-mark.rutland@arm.com

State

Superseded

Headers

Received-SPF: pass (google.com: best guess record for domain of
	linux-kernel-owner@vger.kernel.org designates 209.132.180.67
	as permitted sender) client-ip=209.132.180.67; 
From: Mark Rutland <mark.rutland@arm.com>
To: linux-arm-kernel@lists.infradead.org
Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@linaro.org,
	kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org,
	marc.zyngier@arm.com, mark.rutland@arm.com, suzuki.poulose@arm.com,
	will.deacon@arm.com, yao.qi@arm.com,
	kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org,
	awallis@codeaurora.org
Subject: [PATCHv2 11/12] arm64: enable pointer authentication
Date: Mon, 27 Nov 2017 16:38:05 +0000
Message-Id: <20171127163806.31435-12-mark.rutland@arm.com>
In-Reply-To: <20171127163806.31435-1-mark.rutland@arm.com>
References: <20171127163806.31435-1-mark.rutland@arm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Series

ARMv8.3 pointer authentication userspace support | expand

Commit Message

Mark Rutland Nov. 27, 2017, 4:38 p.m. UTC

Now that all the necessary bits are in place for userspace / KVM guest
pointer authentication, add the necessary Kconfig logic to allow this to
be enabled.

Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
---
 arch/arm64/Kconfig | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

-- 
2.11.0

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a93339f5178f..f7cb4ca8a6fc 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1013,6 +1013,29 @@  config ARM64_PMEM
 
 endmenu
 
+menu "ARMv8.3 architectural features"
+
+config ARM64_POINTER_AUTHENTICATION
+	bool "Enable support for pointer authentication"
+	default y
+	help
+	  Pointer authentication (part of the ARMv8.3 Extensions) provides
+	  instructions for signing and authenticating pointers against secret
+	  keys, which can be used to mitigate Return Oriented Programming (ROP)
+	  and other attacks.
+
+	  This option enables these instructions at EL0 (i.e. for userspace).
+
+	  Choosing this option will cause the kernel to initialise secret keys
+	  for each process at exec() time, with these keys being
+	  context-switched along with the process.
+
+	  The feature is detected at runtime. If the feature is not present in
+	  hardware it will not be advertised to userspace nor will it be
+	  enabled.
+
+endmenu
+
 config ARM64_SVE
 	bool "ARM Scalable Vector Extension support"
 	default y

[PATCHv2,11/12] arm64: enable pointer authentication

Commit Message

Patch