From patchwork Thu May 3 13:20:21 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 134892 Delivered-To: patch@linaro.org Received: by 10.46.151.6 with SMTP id r6csp1919974lji; Thu, 3 May 2018 06:20:43 -0700 (PDT) X-Google-Smtp-Source: AB8JxZpvMfsYshzUvWH6U95szW/rp3srkCIfGMOhx5K5pPqvuCw20vxGhfLsDWjq232SgaxRnsuW X-Received: by 2002:a17:902:20cb:: with SMTP id v11-v6mr23484411plg.82.1525353642887; Thu, 03 May 2018 06:20:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1525353642; cv=none; d=google.com; s=arc-20160816; b=pZK2lN6Mjns60O/uQMj5LJcpccfhh7Y6CWq7+FSJLiPrdcnyKLD7X6Bv4ZpkEU7z1w WZcBpgyqcoC+yj7mfuCixe5b0kbqzqVFMxulJdrnCeSLkLvPeJUlXQw+dyOvKSZhDKWm MQncw0Wv+u36j/2Cs1R5tyoX7Xd6vEPukYUxoeRgDvwLzujmyBMVn4pnnWKhJ8Biwd/L V5G5I9K4sScI40Pg6tt5pvPeekpZfnwas8R67BbGWYFJKPOXq+9B6EF4WM4ovJ4+4ak1 d78KE15tLFegKLvYyKuaPglUkap1jDKU6o1yM2CPtNnUCvgId/YUaNdhCJysPas36Icn e5dQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=chB1Ia79hrv2ZkxQ40RcLnDEKqC3V7T6qtOYUm6C/aI=; b=fL9BcZTXHCWEeYVewwuci3FbHsz1J/pO8tN3Y+J+ikzOZnk9uv8DBozR83q48O4PPY bpvftjGmMOKmAEdjuY49D7INVTW2HwwxEZFqf1e3Pj0VMREVqraBAg61nfCH0Iksk2Xi goWK3gVwF7IWvAJV19z9yN/UDcl8lfL78A1MD5TDu1ElVluzT2Js68XL9V1wpEH2bx+d 9cOLlHc4oNAnjI7jGejwepPK36J7eeUZRGbMrfjnnUuX0jx8QIMWx+b5cWwsAoDGfGPU z5V7lRkyMOh1K6eDH1KZl1yIan9l2AYqNcWiNN7gRVCgPq/D14q4OsLgaecy1aREJplG sKWg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o10-v6si11518191pgq.148.2018.05.03.06.20.42; Thu, 03 May 2018 06:20:42 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751361AbeECNUk (ORCPT + 29 others); Thu, 3 May 2018 09:20:40 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:41552 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750922AbeECNUj (ORCPT ); Thu, 3 May 2018 09:20:39 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id BC43D1435; Thu, 3 May 2018 06:20:38 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id AA2783F487; Thu, 3 May 2018 06:20:36 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org, kvmarm@lists.cs.columbia.edu, catalin.marinas@arm.com, christoffer.dall@arm.com, drjones@redhat.com, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, awallis@codeaurora.org Subject: [PATCHv4 00/10] ARMv8.3 pointer authentication userspace support Date: Thu, 3 May 2018 14:20:21 +0100 Message-Id: <20180503132031.25705-1-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This series adds support for the ARMv8.3 pointer authentication extension, enabling userspace return address protection with recent versions of GCC. Since RFC [1]: * Make the KVM context switch (semi-lazy) * Rebase to v4.13-rc1 * Improve pointer authentication documentation * Add hwcap documentation * Various minor cleanups Since v1 [2]: * Rebase to v4.15-rc1 * Settle on per-process keys * Strip PACs when unwinding userspace * Don't expose an XPAC hwcap (this is implied by ID registers) * Leave APIB, ABPDA, APDB, and APGA keys unsupported for now * Support IMP DEF algorithms * Rely on KVM ID register emulation * Various cleanups Since v2 [3]: * Unify HCR_EL2 initialization * s/POINTER_AUTHENTICATION/PTR_AUTH/ * Drop KVM support (for now) * Drop detection of generic authentication Since v3 [4]: * Drop KVM logging to kvm_debug() * Init keys in init_new_context() * Drop mm_hooks changes * Commit message cleanups * Minor formatting fixups * Fold in acks and other tags While there are use-cases for keys other than APIAKey, the only software that I'm aware of with pointer authentication support is GCC, which only makes use of APIAKey. I'm happy to add support for other keys as users appear. I've pushed the series to the arm64/pointer-auth branch [5] of my linux tree. The aarch64 bootwrapper [6] does the necessary EL3 setup. Extension Overview ================== The ARMv8.3 pointer authentication extension adds functionality to detect modification of pointer values, mitigating certain classes of attack such as stack smashing, and making return oriented programming attacks harder The extension introduces the concept of a pointer authentication code (PAC), which is stored in some upper bits of pointers. Each PAC is derived from the original pointer, another 64-bit value (e.g. the stack pointer), and a secret 128-bit key. New instructions are added which can be used to: * Insert a PAC into a pointer * Strip a PAC from a pointer * Authenticate strip a PAC from a pointer If authentication succeeds, the code is removed, yielding the original pointer. If authentication fails, bits are set in the pointer such that it is guaranteed to cause a fault if used. These instructions can make use of four keys: * APIAKey (A.K.A. Instruction A key) * APIBKey (A.K.A. Instruction B key) * APDAKey (A.K.A. Data A key) * APDBKey (A.K.A. Data B Key) A subset of these instruction encodings have been allocated from the HINT space, and will operate as NOPs on any ARMv8-A parts which do not feature the extension (or if purposefully disabled by the kernel). Software using only this subset of the instructions should function correctly on all ARMv8-A parts. Additionally, instructions are added to authenticate small blocks of memory in similar fashion, using APGAKey (A.K.A. Generic key). This Series =========== This series enables the use of instructions using APIAKey, which is initialised and maintained per-process (shared by all threads). This series does not add support for APIBKey, APDAKey, APDBKey, nor APGAKey. I've given this some basic testing with a homebrew test suite. More ideally, we'd add some tests to the kernel source tree. For the time being, pointer authentication functionality is hidden from guests via ID register trapping. Thanks, Mark. [1] http://lists.infradead.org/pipermail/linux-arm-kernel/2017-April/498941.html [2] https://lkml.kernel.org/r/1500480092-28480-1-git-send-email-mark.rutland@arm.com [3] https://lkml.kernel.org/r/20171127163806.31435-1-mark.rutland@arm.com [4] https://lkml.kernel.org/r/20180417183735.56985-1-mark.rutland@arm.com [5] git://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git arm64/pointer-auth [6] git://git.kernel.org/pub/scm/linux/kernel/git/mark/boot-wrapper-aarch64.git Mark Rutland (10): arm64: add pointer authentication register bits arm64/kvm: consistently handle host HCR_EL2 flags arm64/kvm: hide ptrauth from guests arm64: Don't trap host pointer auth use to EL2 arm64/cpufeature: detect pointer authentication arm64: add basic pointer authentication support arm64: expose user PAC bit positions via ptrace arm64: perf: strip PAC when unwinding userspace arm64: enable pointer authentication arm64: docs: document pointer authentication Documentation/arm64/booting.txt | 8 +++ Documentation/arm64/elf_hwcaps.txt | 6 ++ Documentation/arm64/pointer-authentication.txt | 84 ++++++++++++++++++++++++ arch/arm64/Kconfig | 23 +++++++ arch/arm64/include/asm/cpucaps.h | 5 +- arch/arm64/include/asm/esr.h | 3 +- arch/arm64/include/asm/kvm_arm.h | 3 + arch/arm64/include/asm/mmu.h | 5 ++ arch/arm64/include/asm/mmu_context.h | 11 +++- arch/arm64/include/asm/pointer_auth.h | 90 ++++++++++++++++++++++++++ arch/arm64/include/asm/sysreg.h | 30 +++++++++ arch/arm64/include/uapi/asm/hwcap.h | 1 + arch/arm64/include/uapi/asm/ptrace.h | 7 ++ arch/arm64/kernel/cpufeature.c | 56 ++++++++++++++++ arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/head.S | 5 +- arch/arm64/kernel/perf_callchain.c | 5 +- arch/arm64/kernel/ptrace.c | 38 +++++++++++ arch/arm64/kvm/handle_exit.c | 18 ++++++ arch/arm64/kvm/hyp/switch.c | 2 +- arch/arm64/kvm/sys_regs.c | 8 +++ include/uapi/linux/elf.h | 1 + 22 files changed, 402 insertions(+), 8 deletions(-) create mode 100644 Documentation/arm64/pointer-authentication.txt create mode 100644 arch/arm64/include/asm/pointer_auth.h -- 2.11.0