From patchwork Tue Apr 17 18:37:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133570 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035663ljb; Tue, 17 Apr 2018 11:37:55 -0700 (PDT) X-Google-Smtp-Source: AIpwx49DtO4q/ykV+IMbrRfOxy8uAGiQdZmFiInbZ2tWJmpiK6bU+SRUasAFHDz83Kj+Wha3+Uhi X-Received: by 2002:a17:902:8606:: with SMTP id f6-v6mr3074697plo.258.1523990275578; Tue, 17 Apr 2018 11:37:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990275; cv=none; d=google.com; s=arc-20160816; b=lo0/W6Ukm3nKgjxiGQTR3gvwmmgJf7MyXWKLGz1lfl0wWMbixasuNZbguVc+bBDxER xI7XpkdhPZmt4CVLZCSFa2PL1r+RRyLE5zPconncn2OarSSOWVxiC0ejcgrWCA/jXUId lUQGnvj4hufANFtfcLis015NHMWBY0W3wLh2uX+YDWP30avp0kSeVE7uoYATtD14nnY2 lBWz1B/hnE4IdQURoVGjzmA+9XLDE/e8Yoe3adD0GmzfuVXh8GX4LC01ZtRyzh76bEwA MntLiRWlqKZ2d6NKzOTsvy3hMGKXjG54N6z4FNpT62G5TspGT+ua9AjXBjPYXqtxdoRw yMpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=LMD5f0EwKBjsG6J9F8f4uIaYPevd2L8RCUaeSal7aGQ=; b=C+RkM3Ahe6KRsS80+dCxnOqj36LOqHFi4djxQXkQVGj8w/kbugj6HBlczcZaAJIVJg GO+LhqS5GLy8q0JY6Ql+ORZ8qAaV2sfg/PQ1urLbneJot/lcy8bdB+9a/eKNCg3/+y8w D092o0O75njY2c8x549lWqTPapvdidYiGce2KiiRmqsxoJmKokZwjNv4WjGlwuM8tVXk BQDETtjZRtkPR/e9cZqHxHzaC3R930f1KlZ0jhmmr6foC7otFDMl2ptQJ6yzq7gKTmp3 4irNJK0fjAz93BLaqQzKRcEj7yGearFNYqY8PRYiQUjqNpVhR6gbkWEwkXdR8kksgSHn QjQQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d1-v6si11557233plr.410.2018.04.17.11.37.55; Tue, 17 Apr 2018 11:37:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752617AbeDQShw (ORCPT + 29 others); Tue, 17 Apr 2018 14:37:52 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:46940 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752327AbeDQSht (ORCPT ); Tue, 17 Apr 2018 14:37:49 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 7010415AD; Tue, 17 Apr 2018 11:37:48 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id E9FD43F587; Tue, 17 Apr 2018 11:37:45 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 01/11] arm64: add pointer authentication register bits Date: Tue, 17 Apr 2018 19:37:25 +0100 Message-Id: <20180417183735.56985-2-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The ARMv8.3 pointer authentication extension adds: * New fields in ID_AA64ISAR1 to report the presence of pointer authentication functionality. * New control bits in SCTLR_ELx to enable this functionality. * New system registers to hold the keys necessary for this functionality. * A new ESR_ELx.EC code used when the new instructions are affected by configurable traps This patch adds the relevant definitions to and for these, to be used by subsequent patches. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Marc Zyngier Cc: Suzuki K Poulose Cc: Will Deacon --- arch/arm64/include/asm/esr.h | 3 ++- arch/arm64/include/asm/sysreg.h | 30 ++++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/arch/arm64/include/asm/esr.h b/arch/arm64/include/asm/esr.h index ce70c3ffb993..022785162281 100644 --- a/arch/arm64/include/asm/esr.h +++ b/arch/arm64/include/asm/esr.h @@ -30,7 +30,8 @@ #define ESR_ELx_EC_CP14_LS (0x06) #define ESR_ELx_EC_FP_ASIMD (0x07) #define ESR_ELx_EC_CP10_ID (0x08) -/* Unallocated EC: 0x09 - 0x0B */ +#define ESR_ELx_EC_PAC (0x09) +/* Unallocated EC: 0x0A - 0x0B */ #define ESR_ELx_EC_CP14_64 (0x0C) /* Unallocated EC: 0x0d */ #define ESR_ELx_EC_ILL (0x0E) diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index 6171178075dc..426f0eb90101 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -171,6 +171,19 @@ #define SYS_TTBR1_EL1 sys_reg(3, 0, 2, 0, 1) #define SYS_TCR_EL1 sys_reg(3, 0, 2, 0, 2) +#define SYS_APIAKEYLO_EL1 sys_reg(3, 0, 2, 1, 0) +#define SYS_APIAKEYHI_EL1 sys_reg(3, 0, 2, 1, 1) +#define SYS_APIBKEYLO_EL1 sys_reg(3, 0, 2, 1, 2) +#define SYS_APIBKEYHI_EL1 sys_reg(3, 0, 2, 1, 3) + +#define SYS_APDAKEYLO_EL1 sys_reg(3, 0, 2, 2, 0) +#define SYS_APDAKEYHI_EL1 sys_reg(3, 0, 2, 2, 1) +#define SYS_APDBKEYLO_EL1 sys_reg(3, 0, 2, 2, 2) +#define SYS_APDBKEYHI_EL1 sys_reg(3, 0, 2, 2, 3) + +#define SYS_APGAKEYLO_EL1 sys_reg(3, 0, 2, 3, 0) +#define SYS_APGAKEYHI_EL1 sys_reg(3, 0, 2, 3, 1) + #define SYS_ICC_PMR_EL1 sys_reg(3, 0, 4, 6, 0) #define SYS_AFSR0_EL1 sys_reg(3, 0, 5, 1, 0) @@ -417,9 +430,13 @@ #define SYS_ICH_LR15_EL2 __SYS__LR8_EL2(7) /* Common SCTLR_ELx flags. */ +#define SCTLR_ELx_ENIA (1 << 31) +#define SCTLR_ELx_ENIB (1 << 30) +#define SCTLR_ELx_ENDA (1 << 27) #define SCTLR_ELx_EE (1 << 25) #define SCTLR_ELx_IESB (1 << 21) #define SCTLR_ELx_WXN (1 << 19) +#define SCTLR_ELx_ENDB (1 << 13) #define SCTLR_ELx_I (1 << 12) #define SCTLR_ELx_SA (1 << 3) #define SCTLR_ELx_C (1 << 2) @@ -510,11 +527,24 @@ #define ID_AA64ISAR0_AES_SHIFT 4 /* id_aa64isar1 */ +#define ID_AA64ISAR1_GPI_SHIFT 28 +#define ID_AA64ISAR1_GPA_SHIFT 24 #define ID_AA64ISAR1_LRCPC_SHIFT 20 #define ID_AA64ISAR1_FCMA_SHIFT 16 #define ID_AA64ISAR1_JSCVT_SHIFT 12 +#define ID_AA64ISAR1_API_SHIFT 8 +#define ID_AA64ISAR1_APA_SHIFT 4 #define ID_AA64ISAR1_DPB_SHIFT 0 +#define ID_AA64ISAR1_APA_NI 0x0 +#define ID_AA64ISAR1_APA_ARCHITECTED 0x1 +#define ID_AA64ISAR1_API_NI 0x0 +#define ID_AA64ISAR1_API_IMP_DEF 0x1 +#define ID_AA64ISAR1_GPA_NI 0x0 +#define ID_AA64ISAR1_GPA_ARCHITECTED 0x1 +#define ID_AA64ISAR1_GPI_NI 0x0 +#define ID_AA64ISAR1_GPI_IMP_DEF 0x1 + /* id_aa64pfr0 */ #define ID_AA64PFR0_CSV3_SHIFT 60 #define ID_AA64PFR0_CSV2_SHIFT 56 From patchwork Tue Apr 17 18:37:26 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133571 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035704ljb; Tue, 17 Apr 2018 11:37:58 -0700 (PDT) X-Google-Smtp-Source: AIpwx49ok9i0580GVMjtOc6rIVwNAcreNUwA22tPfnEakL1W8Qnv6ukBb2527cVEWqwnKmrFa5H0 X-Received: by 2002:a17:902:8543:: with SMTP id d3-v6mr3089916plo.20.1523990277904; Tue, 17 Apr 2018 11:37:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990277; cv=none; d=google.com; s=arc-20160816; b=sJcw7bYDjs7L65TGQtD5neDWJ43IYYesoHGz9kUrJxcdaS1o+8U8AxdEe7xW+uY1j0 n0G4ZFUoAjG6VosN2EhvHsUbVxpDATGaEx9cRWHYKp5yn1wIxohjwXVEy+wZvwez5uvD DxburbYot5TTXbfIek5Ww7Jq1/RCSRMcmFp5MBjzZKKA0TVu9t25WjI1hztL7lVcEsUP 4mz4joiR0SCoJhYWKNYJdVwCzaaRoKHOZXT9/pzFUzlSe+T5Qo6j8HRGteROOZOsX5jf +rgL4lTRWfWlLLEHIFs85s8LAPzSLWlNjk6zOCS99GR9V/JvsGCafi3SwPOAukgHKo5l YNHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=9MokD4Vczhq6ZyBMb42q4qiVtAiIrGFUOP4SNzShwx0=; b=gyJHMopC8b/32bYhIMqlr9I7u+T1A1iCcrS9rrORhqQzrkqQW1ySUXgb42eMPjeW85 zEC61hrQ/6l8qurw0sgdaOdrdEiyqmUuG1Ri86fvQb/6iY/Piy1EVaiH49wtCvnOsDYy KQsTgPwf2Ec+Abrr5gqgH0LVIlnnjRl/LrgUd4Aiw5Ap48ezyl8M85KhA0uvH8ePEcws M3ZSeHJDRjDYFjpOrlEx0cpCswA+wTBuoNqPMhhLP5EG6dJV9PgU3sx5/2hz9Nduouv8 u+BSD092EjIPuQO/4icnX2qIEXikS6klNaoAFXVdcLHzxjXB48/MskF+wfBu5i/ttmpP kBVQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d1-v6si11557233plr.410.2018.04.17.11.37.57; Tue, 17 Apr 2018 11:37:57 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752670AbeDQShy (ORCPT + 29 others); Tue, 17 Apr 2018 14:37:54 -0400 Received: from foss.arm.com ([217.140.101.70]:46958 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQShw (ORCPT ); Tue, 17 Apr 2018 14:37:52 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 122E115B2; Tue, 17 Apr 2018 11:37:52 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 8C2D03F587; Tue, 17 Apr 2018 11:37:49 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 02/11] arm64/kvm: consistently handle host HCR_EL2 flags Date: Tue, 17 Apr 2018 19:37:26 +0100 Message-Id: <20180417183735.56985-3-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In KVM we define the configuration of HCR_EL2 for a VHE HOST in HCR_HOST_VHE_FLAGS, but we don't ahve a similar definition for the non-VHE host flags, and open-code HCR_RW. Further, in head.S we open-code the flags for VHE and non-VHE configurations. In future, we're going to want to configure more flags for the host, so lets add a HCR_HOST_NVHE_FLAGS defintion, adn consistently use both HCR_HOST_VHE_FLAGS and HCR_HOST_NVHE_FLAGS in the kvm code and head.S. We now use mov_q to generate the HCR_EL2 value, as we use when configuring other registers in head.S. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Christoffer Dall Cc: Marc Zyngier Cc: Will Deacon Cc: kvmarm@lists.cs.columbia.edu --- arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/kernel/head.S | 5 ++--- arch/arm64/kvm/hyp/switch.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) -- 2.11.0 Reviewed-by: Christoffer Dall diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h index 6dd285e979c9..89b3dda7e3cb 100644 --- a/arch/arm64/include/asm/kvm_arm.h +++ b/arch/arm64/include/asm/kvm_arm.h @@ -86,6 +86,7 @@ HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \ HCR_FMO | HCR_IMO) #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF) +#define HCR_HOST_NVHE_FLAGS (HCR_RW) #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H) /* TCR_EL2 Registers bits */ diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index b0853069702f..651a06b1980f 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -494,10 +494,9 @@ ENTRY(el2_setup) #endif /* Hyp configuration. */ - mov x0, #HCR_RW // 64-bit EL1 + mov_q x0, HCR_HOST_NVHE_FLAGS cbz x2, set_hcr - orr x0, x0, #HCR_TGE // Enable Host Extensions - orr x0, x0, #HCR_E2H + mov_q x0, HCR_HOST_VHE_FLAGS set_hcr: msr hcr_el2, x0 isb diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c index d9645236e474..cdae330e15e9 100644 --- a/arch/arm64/kvm/hyp/switch.c +++ b/arch/arm64/kvm/hyp/switch.c @@ -143,7 +143,7 @@ static void __hyp_text __deactivate_traps_nvhe(void) mdcr_el2 |= MDCR_EL2_E2PB_MASK << MDCR_EL2_E2PB_SHIFT; write_sysreg(mdcr_el2, mdcr_el2); - write_sysreg(HCR_RW, hcr_el2); + write_sysreg(HCR_HOST_NVHE_FLAGS, hcr_el2); write_sysreg(CPTR_EL2_DEFAULT, cptr_el2); } From patchwork Tue Apr 17 18:37:27 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133572 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035756ljb; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+0KPIjNg86vV4JY2q35yW6hVFP01AJ5YiOoipPcBIrbMG9lCumIX5ZGjv+9jNco4VX+cmN X-Received: by 2002:a17:902:5497:: with SMTP id e23-v6mr2998781pli.308.1523990281719; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990281; cv=none; d=google.com; s=arc-20160816; b=jaRNvuB2Dg9t2wx8weTRVyk1Vr04DgQYan6He2h6sGbnZJLf8W67l2GRwpsGaIU6lj 8tx7I/avjoQxmtMaG0hueWQLtLXnFaZOK+DrWgnJIS0vtwo7ElSY2TMxexuejwMulN0R /aOVBdrPUAFlzrsAVzr0nGQsQb6R4v03xagN4f+rjHAXU5j8uYluDaB3YXvcV2gJUzeF X9/IX3q3VZed8cjAdvN7zlcJMjNrw31Pu8AgR3tPHqW5v6IypYjPCdhnRBcgWdPcvbGK mJ5ZxdUHV7fAQbSiGix64Dt5GS/VsHivGi474LqfJjlfwvQeZRWNfQys9G9pPv6macsy 81Sg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=11Y/EXDvdfE23Qa+nugO8bDiHjjD5M9j94ICNBI+C/Y=; b=aNd8AgJGHr3a2pR6c29uYET2GZyhvzViTwNm24LoxIv5THtf84JlXpkMBCKAbQa+al RP3wg05HHAwfYRn5OSFzSO/Srk7tee3Hw15onaJ+vNIfwNft5Xt5ZeagHoyJfPySBoTZ Py3LS5ZqGKdb1suyyKttJMsLf4Ob++6ov48tbOeqw5ZlPYltoDCCnjEt0PPMfjtiogZj PXncLdxq4B62SkIgG10WYc6tkU4Ee6gPQs0Q79rr8Jooj0GQhBcVoAOUeRde7IOdCc/a YBpzCoRK8oyiM8wQLDLhK3dYD9sg8tUwA+WRAT7b3+VobwePzVsxaaN1jd56UXQgBYVg iQEQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a5-v6si15012195pls.571.2018.04.17.11.38.01; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752710AbeDQSh6 (ORCPT + 29 others); Tue, 17 Apr 2018 14:37:58 -0400 Received: from foss.arm.com ([217.140.101.70]:46974 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQShz (ORCPT ); Tue, 17 Apr 2018 14:37:55 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 721E515BE; Tue, 17 Apr 2018 11:37:55 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id EBDD73F587; Tue, 17 Apr 2018 11:37:52 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 03/11] arm64/kvm: hide ptrauth from guests Date: Tue, 17 Apr 2018 19:37:27 +0100 Message-Id: <20180417183735.56985-4-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In subsequent patches we're going to expose ptrauth to the host kernel and userspace, but things are a bit trickier for guest kernels. For the time being, let's hide ptrauth from KVM guests. Regardless of how well-behaved the guest kernel is, guest userspace could attempt to use ptrauth instructions, triggering a trap to EL2, resulting in noise from kvm_handle_unknown_ec(). So let's write up a handler for the PAC trap, which silently injects an UNDEF into the guest, as if the feature were really missing. Signed-off-by: Mark Rutland Cc: Christoffer Dall Cc: Marc Zyngier Cc: kvmarm@lists.cs.columbia.edu --- arch/arm64/kvm/handle_exit.c | 18 ++++++++++++++++++ arch/arm64/kvm/sys_regs.c | 9 +++++++++ 2 files changed, 27 insertions(+) -- 2.11.0 Reviewed-by: Andrew Jones Reviewed-by: Christoffer Dall diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c index e5e741bfffe1..5114ad691eae 100644 --- a/arch/arm64/kvm/handle_exit.c +++ b/arch/arm64/kvm/handle_exit.c @@ -173,6 +173,23 @@ static int handle_sve(struct kvm_vcpu *vcpu, struct kvm_run *run) return 1; } +/* + * Guest usage of a ptrauth instruction (which the guest EL1 did not turn into + * a NOP), or guest EL1 access to a ptrauth register. + */ +static int kvm_handle_ptrauth(struct kvm_vcpu *vcpu, struct kvm_run *run) +{ + /* + * We don't currently suport ptrauth in a guest, and we mask the ID + * registers to prevent well-behaved guests from trying to make use of + * it. + * + * Inject an UNDEF, as if the feature really isn't present. + */ + kvm_inject_undefined(vcpu); + return 1; +} + static exit_handle_fn arm_exit_handlers[] = { [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec, [ESR_ELx_EC_WFx] = kvm_handle_wfx, @@ -195,6 +212,7 @@ static exit_handle_fn arm_exit_handlers[] = { [ESR_ELx_EC_BKPT32] = kvm_handle_guest_debug, [ESR_ELx_EC_BRK64] = kvm_handle_guest_debug, [ESR_ELx_EC_FP_ASIMD] = handle_no_fpsimd, + [ESR_ELx_EC_PAC] = kvm_handle_ptrauth, }; static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 806b0b126a64..eee399c35e84 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -1000,6 +1000,15 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz) task_pid_nr(current)); val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT); + } else if (id == SYS_ID_AA64ISAR1_EL1) { + const u64 ptrauth_mask = (0xfUL << ID_AA64ISAR1_APA_SHIFT) | + (0xfUL << ID_AA64ISAR1_API_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPA_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPI_SHIFT); + if (val & ptrauth_mask) + pr_err_once("kvm [%i]: ptrauth unsupported for guests, suppressing\n", + task_pid_nr(current)); + val &= ~ptrauth_mask; } else if (id == SYS_ID_AA64MMFR1_EL1) { if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT)) pr_err_once("kvm [%i]: LORegions unsupported for guests, suppressing\n", From patchwork Tue Apr 17 18:37:28 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133573 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035807ljb; Tue, 17 Apr 2018 11:38:04 -0700 (PDT) X-Google-Smtp-Source: AIpwx4/rIijPehGZPMqhMaVV4IleaIxzCstOLUPsDNB90CnOJe9wPUsS0xlKL3FyiABe0VM3rLDQ X-Received: by 10.167.130.85 with SMTP id e21mr3027153pfn.86.1523990284457; Tue, 17 Apr 2018 11:38:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990284; cv=none; d=google.com; s=arc-20160816; b=JhZ/Mo1vYOkG3JMkax4JYWPAB8/Fbx7/Qqi/shn3PRyYZXNzbiAbdjxzKOMws/3W+h 8KVlWGO5o4ldLF1vBOSBQQ2O8yukIDiuFdDU8FgtYGMMtINQ9eABKXw4U0wfcO2EII7A 3PzZ6rT0tWbBgj1l515aeKp45obUSGr1/gQAJlCwe0NShthL4affPGOpxdqcq5Mc/4Ww xfEuQCfRT3J56kDSnoTfxeFwmERo/tGrt3RlYGH2IfIKS8grC7pvCidiMGXQcrePKX0c kjTEICdaTj8UojNtzfLOw//widKuZZNOTzfvwbZUQVoqDOyFHnabGRKgbrdkqtlGR+wM QE3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=Fn8xtB+CwNlvAku6GAuXB7RMe1286hdtILaL+6SVwIU=; b=DmqEFs4GznLldcRRpLCtnOGmDBuPUwnsugt/5bXeCMtIKDs2hGfrLoHeqAwaqE0mrt tDTZwL43IiON0bUy+wCP031TtprCNUzQhsw43bwAsxhD83kxEz9Mc4iCrJ8jVxlVZBlJ NTf2RYxDAyOcU7tTJrvv4bSmXNPxePyXuNrH57e7GGRk/cDWOwzKp+hXY3gejey4hF8K qJ5yKydbhk8yWLDt5f9/CRLBt3SZrBsz9RHpsATZ/TXPOmBz4ksl2F8UswDiqtywiRgd 6QArB8s8QElqD50So36Acikm6CNUS4hGqWhaxhAh14ZiEPBJ1CVLMoG0l27mgusupb64 7j/w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a5-v6si15012195pls.571.2018.04.17.11.38.04; Tue, 17 Apr 2018 11:38:04 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752747AbeDQSiA (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:00 -0400 Received: from foss.arm.com ([217.140.101.70]:46984 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQSh6 (ORCPT ); Tue, 17 Apr 2018 14:37:58 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id A6B4915BF; Tue, 17 Apr 2018 11:37:58 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 2C7953F587; Tue, 17 Apr 2018 11:37:56 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 04/11] arm64: Don't trap host pointer auth use to EL2 Date: Tue, 17 Apr 2018 19:37:28 +0100 Message-Id: <20180417183735.56985-5-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org To allow EL0 (and/or EL1) to use pointer authentication functionality, we must ensure that pointer authentication instructions and accesses to pointer authentication keys are not trapped to EL2. This patch ensures that HCR_EL2 is configured appropriately when the kernel is booted at EL2. For non-VHE kernels we set HCR_EL2.{API,APK}, ensuring that EL1 can access keys and permit EL0 use of instructions. For VHE kernels host EL0 (TGE && E2H) is unaffected by these settings, and it doesn't matter how we configure HCR_EL2.{API,APK}, so we don't bother setting them. This does not enable support for KVM guests, since KVM manages HCR_EL2 itself when running VMs. Signed-off-by: Mark Rutland Cc: Christoffer Dall Cc: Catalin Marinas Cc: Marc Zyngier Cc: Will Deacon Cc: kvmarm@lists.cs.columbia.edu --- arch/arm64/include/asm/kvm_arm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h index 89b3dda7e3cb..4d57e1e58323 100644 --- a/arch/arm64/include/asm/kvm_arm.h +++ b/arch/arm64/include/asm/kvm_arm.h @@ -23,6 +23,8 @@ #include /* Hyp Configuration Register (HCR) bits */ +#define HCR_API (UL(1) << 41) +#define HCR_APK (UL(1) << 40) #define HCR_TEA (UL(1) << 37) #define HCR_TERR (UL(1) << 36) #define HCR_TLOR (UL(1) << 35) @@ -86,7 +88,7 @@ HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \ HCR_FMO | HCR_IMO) #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF) -#define HCR_HOST_NVHE_FLAGS (HCR_RW) +#define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK) #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H) /* TCR_EL2 Registers bits */ From patchwork Tue Apr 17 18:37:29 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133574 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035912ljb; Tue, 17 Apr 2018 11:38:11 -0700 (PDT) X-Google-Smtp-Source: AIpwx48ZPx6Yxz2S2D66jsWItDn9xmpT5NxBFTfx5RZ59toaKoamhvlJoLxsAAR9SNaNFqVZC28Y X-Received: by 10.98.40.68 with SMTP id o65mr2952731pfo.103.1523990290913; Tue, 17 Apr 2018 11:38:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990290; cv=none; d=google.com; s=arc-20160816; b=p1HRH7gHLZgDMY0o/alPP5w4YzvUDmLy73gQ9G9NMXlt1v9Ci+vb4FIBmiu0pDKHpu A/Uqy83GFrZ38jhLXq7KYs1m8jkGyGS1w3uDl8I8R0HJl5BpHQX0FS/JdmMr+oAdgFc6 oBLO/KHv2Ta+Q4OIcUglAvlFHGm9vGqHSFeXlwt/XDfpIhsSmC7Isu+idXNr/95xTZ/I mJHAuIkjtNvgfN+Hd6lWGTpWNmaYfR96kNaKp5/EWmT+fnGuLMu7I2qKd4EuNpAw0vV7 x1uzKtHeBXELwh3G7sFnpsYVRO+/NHWmp89CFW4l+vOLlLdzGDa3sM0tVjDZCZTOvo11 WDGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=XRqeiWN62iYC/SKfswSUlXoSTH6ynOz0k/prXfeTS9Y=; b=SKgVR6j0saRUe5wyg3R0U0fzjPg4VgJKxVDp3U0fBJDoplpKSJNVLRwsDnU9A7RFck A2UotpatJTd5XcEiSWUPx0myKukhqAXOMtV0EnjDexiv6+3LZlF3xZn0ObdjuAtkjLi9 Ah43KpjfNkCKfKITF6hkk4eyRp38r53Fa0xcNPR7mksoWuZtIbeDmlRlnbnvyT3qKgW6 NRpo/LdCkvcf+FVI0csJka5iKRqxiy6xzRbwZ8e7ZwWrR8Y5OB/IToibSUxsZS4l5kQ6 IJaWHtCFrcMLD9rXzTbW3WyK+dju6i9rZLudQg+EdP4W6scXl03bdlLePAml7IBe0CAs oN2A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l5si3602879pgp.644.2018.04.17.11.38.10; Tue, 17 Apr 2018 11:38:10 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752810AbeDQSiG (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:06 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:47006 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQSiC (ORCPT ); Tue, 17 Apr 2018 14:38:02 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id E6DD61435; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 6CE593F587; Tue, 17 Apr 2018 11:37:59 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 05/11] arm64/cpufeature: detect pointer authentication Date: Tue, 17 Apr 2018 19:37:29 +0100 Message-Id: <20180417183735.56985-6-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org So that we can dynamically handle the presence of pointer authentication functionality, wire up probing code in cpufeature.c. >From ARMv8.3 onwards, ID_AA64ISAR1 is no longer entirely RES0, and now has four fields describing the presence of pointer authentication functionality: * APA - address authentication present, using an architected algorithm * API - address authentication present, using an IMP DEF algorithm * GPA - generic authentication present, using an architected algorithm * GPI - generic authentication present, using an IMP DEF algorithm For the moment we only care about address authentication, so we only need to check APA and API. It is assumed that if all CPUs support an IMP DEF algorithm, the same algorithm is used across all CPUs. Note that when we implement KVM support, we will also need to ensure that CPUs have uniform support for GPA and GPI. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Suzuki K Poulose Cc: Will Deacon --- arch/arm64/include/asm/cpucaps.h | 5 ++++- arch/arm64/kernel/cpufeature.c | 47 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h index bc51b72fafd4..9dcb4d1b14f5 100644 --- a/arch/arm64/include/asm/cpucaps.h +++ b/arch/arm64/include/asm/cpucaps.h @@ -48,7 +48,10 @@ #define ARM64_HAS_CACHE_IDC 27 #define ARM64_HAS_CACHE_DIC 28 #define ARM64_HW_DBM 29 +#define ARM64_HAS_ADDRESS_AUTH_ARCH 30 +#define ARM64_HAS_ADDRESS_AUTH_IMP_DEF 31 +#define ARM64_HAS_ADDRESS_AUTH 32 -#define ARM64_NCAPS 30 +#define ARM64_NCAPS 33 #endif /* __ASM_CPUCAPS_H */ diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 536d572e5596..01b1a7e7d70f 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -142,6 +142,10 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_LRCPC_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_FCMA_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_JSCVT_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_PTR_AUTH), + FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_API_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_PTR_AUTH), + FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_APA_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR1_DPB_SHIFT, 4, 0), ARM64_FTR_END, }; @@ -1025,6 +1029,22 @@ static void cpu_copy_el2regs(const struct arm64_cpu_capabilities *__unused) } #endif +#ifdef CONFIG_ARM64_PTR_AUTH +static bool has_address_auth(const struct arm64_cpu_capabilities *entry, + int __unused) +{ + u64 isar1 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1); + bool api, apa; + + apa = cpuid_feature_extract_unsigned_field(isar1, + ID_AA64ISAR1_APA_SHIFT) > 0; + api = cpuid_feature_extract_unsigned_field(isar1, + ID_AA64ISAR1_API_SHIFT) > 0; + + return apa || api; +} +#endif /* CONFIG_ARM64_PTR_AUTH */ + static const struct arm64_cpu_capabilities arm64_features[] = { { .desc = "GIC system register CPU interface", @@ -1201,6 +1221,33 @@ static const struct arm64_cpu_capabilities arm64_features[] = { .cpu_enable = cpu_enable_hw_dbm, }, #endif +#ifdef CONFIG_ARM64_PTR_AUTH + { + .desc = "Address authentication (architected algorithm)", + .capability = ARM64_HAS_ADDRESS_AUTH_ARCH, + .type = ARM64_CPUCAP_SYSTEM_FEATURE, + .sys_reg = SYS_ID_AA64ISAR1_EL1, + .sign = FTR_UNSIGNED, + .field_pos = ID_AA64ISAR1_APA_SHIFT, + .min_field_value = ID_AA64ISAR1_APA_ARCHITECTED, + .matches = has_cpuid_feature, + }, + { + .desc = "Address authentication (IMP DEF algorithm)", + .capability = ARM64_HAS_ADDRESS_AUTH_IMP_DEF, + .type = ARM64_CPUCAP_SYSTEM_FEATURE, + .sys_reg = SYS_ID_AA64ISAR1_EL1, + .sign = FTR_UNSIGNED, + .field_pos = ID_AA64ISAR1_API_SHIFT, + .min_field_value = ID_AA64ISAR1_API_IMP_DEF, + .matches = has_cpuid_feature, + }, + { + .capability = ARM64_HAS_ADDRESS_AUTH, + .type = ARM64_CPUCAP_SYSTEM_FEATURE, + .matches = has_address_auth, + }, +#endif /* CONFIG_ARM64_PTR_AUTH */ {}, }; From patchwork Tue Apr 17 18:37:30 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133580 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5037112ljb; Tue, 17 Apr 2018 11:39:31 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+fconptjX4s9xzU3azq9aq/Pjdpl+BMmE4/bGoTJCDpZWtgrFmDcg0O0ZR0vxJ/fq1Xq+j X-Received: by 10.99.117.26 with SMTP id q26mr2629134pgc.338.1523990371234; Tue, 17 Apr 2018 11:39:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990371; cv=none; d=google.com; s=arc-20160816; b=T8h5KGFRu5mOr5VLjN4/MhVMUy5Ut7OQU3u7TnucxpPVKfy1r02kkXxw5IMyqOXZMm goXT0Q9on+dh1JiV/T3cZkjpBa3/fKYaFvh/nnPSK0+SxBZP2khK9se9oOLMQlJltYg9 WMmhz//DFxbUBVRfPqWt8QRm/+SNhXKnyInEZpdpRF0myZXU65BWsDlVQ3OEeT6QIdjG +dZf1yZTZGbzOCG43x3UPT7iaLrNnCFSTg2jyCUWeJIGY6pswTQ91LcoCAIipYtuDETO Hcp0aD75JEJQN/ntmCZSdgJ1Kh7ELaVSIl2bDriutGUKDuOzkviPAJrs5WXiXa290n5D V2sA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=5NyX8p96FaCEcF45M2ds34bhzDARufpfc/JRPjLZ5mU=; b=NSsz8QREHSSQ8r0tT2IAyK7IBcGS62jeu2Ywl19VbMix30uul4uIkjWzX74DW47T+C ghb8hyz14ZE63HKp85So7lyleIZM16BYgtUlNOjP+7gsBCbJsgheC3tz4OCvaKDNca2D LKmjHKyklfz0QQDDxMM9Vt0stOoTsfzMS0hEv+K+/HDjpMGlJGj0ZCQI2TjRkfzC6h/p EABE9GIFZAWi0n6MyUAZrNf9chYR0qcmjNK8233ioZklAnOA2gTpbPraOnHbUPULHBKD B1RTDVPLfQnsIFsuHUwrQyFNgq8ITL06ZEpPOzZ60tupcw1Q3i6gGGIRaP8zyd8lMkDs 43PQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n4si12077415pgp.558.2018.04.17.11.39.27; Tue, 17 Apr 2018 11:39:31 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753197AbeDQSjW (ORCPT + 29 others); Tue, 17 Apr 2018 14:39:22 -0400 Received: from foss.arm.com ([217.140.101.70]:47026 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752760AbeDQSiF (ORCPT ); Tue, 17 Apr 2018 14:38:05 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 3B84215AD; Tue, 17 Apr 2018 11:38:05 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id B52943F587; Tue, 17 Apr 2018 11:38:02 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 06/11] asm-generic: mm_hooks: allow hooks to be overridden individually Date: Tue, 17 Apr 2018 19:37:30 +0100 Message-Id: <20180417183735.56985-7-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently, an architecture must either implement all of the mm hooks itself, or use all of those provided by the asm-generic implementation. When an architecture only needs to override a single hook, it must copy the stub implementations from the asm-generic version. To avoid this repetition, allow each hook to be overridden indiviually, by placing each under an #ifndef block. As architectures providing their own hooks can't include this file today, this shouldn't adversely affect any existing hooks. Signed-off-by: Mark Rutland Cc: Arnd Bergmann Cc: linux-arch@vger.kernel.org --- include/asm-generic/mm_hooks.h | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.11.0 Acked-by: Arnd Bergmann diff --git a/include/asm-generic/mm_hooks.h b/include/asm-generic/mm_hooks.h index 8ac4e68a12f0..2b3ee15d3702 100644 --- a/include/asm-generic/mm_hooks.h +++ b/include/asm-generic/mm_hooks.h @@ -7,31 +7,42 @@ #ifndef _ASM_GENERIC_MM_HOOKS_H #define _ASM_GENERIC_MM_HOOKS_H +#ifndef arch_dup_mmap static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm) { return 0; } +#endif +#ifndef arch_exit_mmap static inline void arch_exit_mmap(struct mm_struct *mm) { } +#endif +#ifndef arch_unmap static inline void arch_unmap(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long start, unsigned long end) { } +#endif +#ifndef arch_bprm_mm_init static inline void arch_bprm_mm_init(struct mm_struct *mm, struct vm_area_struct *vma) { } +#endif +#ifndef arch_vma_access_permitted static inline bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write, bool execute, bool foreign) { /* by default, allow everything */ return true; } +#endif + #endif /* _ASM_GENERIC_MM_HOOKS_H */ From patchwork Tue Apr 17 18:37:31 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133575 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035982ljb; Tue, 17 Apr 2018 11:38:15 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+C5ZCYKJK6k6oxS/308QAuXkiaXI8QAj3C8tywKxOO4xzmT62l6UePlaW8O4VDf+7OtoXJ X-Received: by 2002:a17:902:4d45:: with SMTP id o5-v6mr3001153plh.84.1523990295483; Tue, 17 Apr 2018 11:38:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990295; cv=none; d=google.com; s=arc-20160816; b=uH0suXcLpmwIEPkcggHQ8LoN4z+wek7RMVyj6dZlQmH1LNPHArnIgCo5HghG14cwyZ 7kihCylmAlbHDyfzVKpX3x/4etufEovo59zULML/O60RjlNhNNbARpDz6MDRsFT+LsIW q9vVpZx5qRnFPmXRNLdHGU3O/AQVpLI2PyNtyqOxfOpJf7IUE2Abl6XoCBvtKzYg29EF 62QhSm9P2xhAPSotsb8GFHROEEveMW7MBs6lCkOLkBj/NFLUfoN/NgCIaWSHSNSU3qHu EBxhNn0JyYLnKStvBgL7AM34ttAhoyF12EulNxyyEOE5Dc3HIHW1ElkcUaZUn4Ct0Sar F3gA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=S2yKRzuojZKrb7rEru+zLTieZuWCMPdlwVDdvNKYhQs=; b=P69UpMZBzlCAj7sJT9p9Z8csDCIRutvGsvSSfCCYfgr57p7RCgu05Q3kp0Wbn9t7rk cn3OjAUIEF8HnEdvWFobK9lf0NisZj8zRuqxaMuBTYkq8UmdaUCQCRrifkL815Ke4PHm y4ol03k8wsMhJzXXOP2VKv8oT+1lqJnN6o35tbvBslsi9VbKtsri3BgMFimxos5kMzAp /LcZJGygnBLppjsGDxd1sktsUcg7VrAQ2qz2q3Vul3Y8DTUJsuhNHA1193ekruQessTm XoAwnz3vFxByNWE4YH9t5MenZ4vVVPdx5kuHxTlKT+LBTxsKG2CVXduR4eTFYQDxT3Jh q/CA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l5si3602879pgp.644.2018.04.17.11.38.15; Tue, 17 Apr 2018 11:38:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752888AbeDQSiM (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:12 -0400 Received: from foss.arm.com ([217.140.101.70]:47038 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQSiJ (ORCPT ); Tue, 17 Apr 2018 14:38:09 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id BDCDA15B2; Tue, 17 Apr 2018 11:38:08 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 43E263F587; Tue, 17 Apr 2018 11:38:06 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 07/11] arm64: add basic pointer authentication support Date: Tue, 17 Apr 2018 19:37:31 +0100 Message-Id: <20180417183735.56985-8-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch adds basic support for pointer authentication, allowing userspace to make use of APIAKey. The kernel maintains an APIAKey value for each process (shared by all threads within), which is initialised to a random value at exec() time. To describe that address authentication instructions are available, the ID_AA64ISAR0.{APA,API} fields are exposed to userspace. A new hwcap, APIA, is added to describe that the kernel manages APIAKey. Instructions using other keys (APIBKey, APDAKey, APDBKey) are disabled, and will behave as NOPs. These may be made use of in future patches. No support is added for the generic key (APGAKey), though this cannot be trapped or made to behave as a NOP. Its presence is not advertised with a hwcap. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Ramana Radhakrishnan Cc: Suzuki K Poulose Cc: Will Deacon --- arch/arm64/include/asm/mmu.h | 5 ++ arch/arm64/include/asm/mmu_context.h | 25 +++++++++- arch/arm64/include/asm/pointer_auth.h | 89 +++++++++++++++++++++++++++++++++++ arch/arm64/include/uapi/asm/hwcap.h | 1 + arch/arm64/kernel/cpufeature.c | 9 ++++ arch/arm64/kernel/cpuinfo.c | 1 + 6 files changed, 128 insertions(+), 2 deletions(-) create mode 100644 arch/arm64/include/asm/pointer_auth.h -- 2.11.0 diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h index dd320df0d026..f6480ea7b0d5 100644 --- a/arch/arm64/include/asm/mmu.h +++ b/arch/arm64/include/asm/mmu.h @@ -25,10 +25,15 @@ #ifndef __ASSEMBLY__ +#include + typedef struct { atomic64_t id; void *vdso; unsigned long flags; +#ifdef CONFIG_ARM64_PTR_AUTH + struct ptrauth_keys ptrauth_keys; +#endif } mm_context_t; /* diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h index 39ec0b8a689e..caf0d3010112 100644 --- a/arch/arm64/include/asm/mmu_context.h +++ b/arch/arm64/include/asm/mmu_context.h @@ -29,7 +29,6 @@ #include #include #include -#include #include #include #include @@ -168,7 +167,14 @@ static inline void cpu_replace_ttbr1(pgd_t *pgdp) #define destroy_context(mm) do { } while(0) void check_and_switch_context(struct mm_struct *mm, unsigned int cpu); -#define init_new_context(tsk,mm) ({ atomic64_set(&(mm)->context.id, 0); 0; }) +static inline int init_new_context(struct task_struct *tsk, + struct mm_struct *mm) +{ + atomic64_set(&mm->context.id, 0); + mm_ctx_ptrauth_init(&mm->context); + + return 0; +} #ifdef CONFIG_ARM64_SW_TTBR0_PAN static inline void update_saved_ttbr0(struct task_struct *tsk, @@ -216,6 +222,8 @@ static inline void __switch_mm(struct mm_struct *next) return; } + mm_ctx_ptrauth_switch(&next->context); + check_and_switch_context(next, cpu); } @@ -241,6 +249,19 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next, void verify_cpu_asid_bits(void); void post_ttbr_update_workaround(void); +static inline void arch_dup_mmap(struct mm_struct *oldmm, + struct mm_struct *mm) +{ + mm_ctx_ptrauth_dup(&oldmm->context, &mm->context); +} +#define arch_dup_mmap arch_dup_mmap + +/* + * We need to override arch_dup_mmap before including the generic hooks, which + * are otherwise sufficient for us. + */ +#include + #endif /* !__ASSEMBLY__ */ #endif /* !__ASM_MMU_CONTEXT_H */ diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h new file mode 100644 index 000000000000..a2e8fb91fdee --- /dev/null +++ b/arch/arm64/include/asm/pointer_auth.h @@ -0,0 +1,89 @@ +/* + * Copyright (C) 2016 ARM Ltd. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ +#ifndef __ASM_POINTER_AUTH_H +#define __ASM_POINTER_AUTH_H + +#include + +#include +#include + +#ifdef CONFIG_ARM64_PTR_AUTH +/* + * Each key is a 128-bit quantity which is split accross a pair of 64-bit + * registers (Lo and Hi). + */ +struct ptrauth_key { + unsigned long lo, hi; +}; + +/* + * We give each process its own instruction A key (APIAKey), which is shared by + * all threads. This is inherited upon fork(), and reinitialised upon exec*(). + * All other keys are currently unused, with APIBKey, APDAKey, and APBAKey + * instructions behaving as NOPs. + */ +struct ptrauth_keys { + struct ptrauth_key apia; +}; + +static inline void ptrauth_keys_init(struct ptrauth_keys *keys) +{ + if (!cpus_have_const_cap(ARM64_HAS_ADDRESS_AUTH)) + return; + + get_random_bytes(keys, sizeof(*keys)); +} + +#define __ptrauth_key_install(k, v) \ +do { \ + write_sysreg_s(v.lo, SYS_ ## k ## KEYLO_EL1); \ + write_sysreg_s(v.hi, SYS_ ## k ## KEYHI_EL1); \ +} while (0) + +static inline void ptrauth_keys_switch(struct ptrauth_keys *keys) +{ + if (!cpus_have_const_cap(ARM64_HAS_ADDRESS_AUTH)) + return; + + __ptrauth_key_install(APIA, keys->apia); +} + +static inline void ptrauth_keys_dup(struct ptrauth_keys *old, + struct ptrauth_keys *new) +{ + if (!cpus_have_const_cap(ARM64_HAS_ADDRESS_AUTH)) + return; + + *new = *old; +} + +#define mm_ctx_ptrauth_init(ctx) \ + ptrauth_keys_init(&(ctx)->ptrauth_keys) + +#define mm_ctx_ptrauth_switch(ctx) \ + ptrauth_keys_switch(&(ctx)->ptrauth_keys) + +#define mm_ctx_ptrauth_dup(oldctx, newctx) \ + ptrauth_keys_dup(&(oldctx)->ptrauth_keys, &(newctx)->ptrauth_keys) + +#else +#define mm_ctx_ptrauth_init(ctx) +#define mm_ctx_ptrauth_switch(ctx) +#define mm_ctx_ptrauth_dup(oldctx, newctx) +#endif + +#endif /* __ASM_POINTER_AUTH_H */ diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h index 17c65c8f33cb..01f02ac500ae 100644 --- a/arch/arm64/include/uapi/asm/hwcap.h +++ b/arch/arm64/include/uapi/asm/hwcap.h @@ -48,5 +48,6 @@ #define HWCAP_USCAT (1 << 25) #define HWCAP_ILRCPC (1 << 26) #define HWCAP_FLAGM (1 << 27) +#define HWCAP_APIA (1 << 28) #endif /* _UAPI__ASM_HWCAP_H */ diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 01b1a7e7d70f..f418d4cb6691 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1030,6 +1030,11 @@ static void cpu_copy_el2regs(const struct arm64_cpu_capabilities *__unused) #endif #ifdef CONFIG_ARM64_PTR_AUTH +static void cpu_enable_address_auth(struct arm64_cpu_capabilities const *cap) +{ + config_sctlr_el1(0, SCTLR_ELx_ENIA); +} + static bool has_address_auth(const struct arm64_cpu_capabilities *entry, int __unused) { @@ -1246,6 +1251,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = { .capability = ARM64_HAS_ADDRESS_AUTH, .type = ARM64_CPUCAP_SYSTEM_FEATURE, .matches = has_address_auth, + .cpu_enable = cpu_enable_address_auth, }, #endif /* CONFIG_ARM64_PTR_AUTH */ {}, @@ -1293,6 +1299,9 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { #ifdef CONFIG_ARM64_SVE HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_SVE_SHIFT, FTR_UNSIGNED, ID_AA64PFR0_SVE, CAP_HWCAP, HWCAP_SVE), #endif +#ifdef CONFIG_ARM64_PNTR_AUTH + HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_APA_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, HWCAP_APIA), +#endif {}, }; diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c index e9ab7b3ed317..608411e3aaff 100644 --- a/arch/arm64/kernel/cpuinfo.c +++ b/arch/arm64/kernel/cpuinfo.c @@ -81,6 +81,7 @@ static const char *const hwcap_str[] = { "uscat", "ilrcpc", "flagm", + "apia", NULL }; From patchwork Tue Apr 17 18:37:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133576 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5036047ljb; Tue, 17 Apr 2018 11:38:20 -0700 (PDT) X-Google-Smtp-Source: AIpwx48tqxVvVR+u7aGebQk6+il+RwsvI9g/4Q0mUvAEEGTNbTdUb+H+0iV/4NczRlMj/OGvmPbS X-Received: by 10.99.125.75 with SMTP id m11mr2635592pgn.391.1523990300403; Tue, 17 Apr 2018 11:38:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990300; cv=none; d=google.com; s=arc-20160816; b=KpPUvP8VH3VvixH2hyQTNHL4LWEi3MLQmBikxvt4OFQmGwUqM1zMfMV/ZFCQunbZRT wP8r+CgeGkODiyiSuqAfyMeS54KV0TXxjf2X+0qN6p0lFfUxIRA5yOAkKaXRxmBYQg9s m+t0l/PdyY1s7oO3JLfyv1dCWZkAxXFah0JmLj3N1yQaSwKhCGqnCuADCJAHcr1f2Ood s3CKY3CJKv2lkP2BgTIkUYqWpQRHz8RS/MQm3EAJCuUsfV/pYW+84mx9BReDeZNNsOC5 TnN9l1jgXZGfXxON7hEXhmhUfd/2cLcxthrH1dCvAlphUx3xmt3DSupHKEYpaLADUqqj 1iig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=TvwDR9OtThvWmHFb7GOitVvR0DTVFGRzvYeJ7lkpaSk=; b=bxapxk/8Zpy2wqV/wghwJE0jQ57CO2lk80vHv78nEYbfYnlzSBQBGO46M+0Dq1DEB0 wRYuk55sNho9kYMV+7u4ftMbbcogfWWkOiXla1Hp9EltHj20MCTCVc81Jql6g75Ukwrs J+GS5P0ziBaHHmMAHfBU9tTv3jl50c+6YJ0lEa5tKgerQz0DlSc3bF9D+N+1n7MrTgSH wTM19aOp/3wuhr4J6sUssknOzcZwCmeN7N+cr+G0xLSzltfDf8KRCkUw7n/xDwQ640w0 sqADI9Z5AnU/ODKJ3qtXwj0lowMnSpGlOWCnvrMLxkej/+nKtEVd+/rAqIA1xdbCs47R iggQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u21si7743865pfg.225.2018.04.17.11.38.20; Tue, 17 Apr 2018 11:38:20 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752972AbeDQSiR (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:17 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:47058 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQSiM (ORCPT ); Tue, 17 Apr 2018 14:38:12 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id F27A615BE; Tue, 17 Apr 2018 11:38:11 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 788FA3F587; Tue, 17 Apr 2018 11:38:09 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 08/11] arm64: expose user PAC bit positions via ptrace Date: Tue, 17 Apr 2018 19:37:32 +0100 Message-Id: <20180417183735.56985-9-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When pointer authentication is in use, data/instruction pointers have a number of PAC bits inserted into them. The number and position of these bits depends on the configured TCR_ELx.TxSZ and whether tagging is enabled. ARMv8.3 allows tagging to differ for instruction and data pointers. For userspace debuggers to unwind the stack and/or to follow pointer chains, they need to be able to remove the PAC bits before attempting to use a pointer. This patch adds a new structure with masks describing the location of the PAC bits in userspace instruction and data pointers (i.e. those addressable via TTBR0), which userspace can query via PTRACE_GETREGSET. By clearing these bits from pointers, userspace can acquire the PAC-less versions. This new regset is exposed when the kernel is built with (user) pointer authentication support, and the feature is enabled. Otherwise, it is hidden. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Ramana Radhakrishnan Cc: Will Deacon --- arch/arm64/include/asm/pointer_auth.h | 8 ++++++++ arch/arm64/include/uapi/asm/ptrace.h | 7 +++++++ arch/arm64/kernel/ptrace.c | 38 +++++++++++++++++++++++++++++++++++ include/uapi/linux/elf.h | 1 + 4 files changed, 54 insertions(+) -- 2.11.0 diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h index a2e8fb91fdee..5ff141245633 100644 --- a/arch/arm64/include/asm/pointer_auth.h +++ b/arch/arm64/include/asm/pointer_auth.h @@ -16,9 +16,11 @@ #ifndef __ASM_POINTER_AUTH_H #define __ASM_POINTER_AUTH_H +#include #include #include +#include #include #ifdef CONFIG_ARM64_PTR_AUTH @@ -71,6 +73,12 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, *new = *old; } +/* + * The EL0 pointer bits used by a pointer authentication code. + * This is dependent on TBI0 being enabled, or bits 63:56 would also apply. + */ +#define ptrauth_pac_mask() GENMASK(54, VA_BITS) + #define mm_ctx_ptrauth_init(ctx) \ ptrauth_keys_init(&(ctx)->ptrauth_keys) diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h index 98c4ce55d9c3..4994d718771a 100644 --- a/arch/arm64/include/uapi/asm/ptrace.h +++ b/arch/arm64/include/uapi/asm/ptrace.h @@ -228,6 +228,13 @@ struct user_sve_header { SVE_PT_SVE_OFFSET + SVE_PT_SVE_SIZE(vq, flags) \ : SVE_PT_FPSIMD_OFFSET + SVE_PT_FPSIMD_SIZE(vq, flags)) +/* pointer authentication masks (NT_ARM_PAC_MASK) */ + +struct user_pac_mask { + __u64 data_mask; + __u64 insn_mask; +}; + #endif /* __ASSEMBLY__ */ #endif /* _UAPI__ASM_PTRACE_H */ diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 71d99af24ef2..f395649f755e 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -44,6 +44,7 @@ #include #include #include +#include #include #include #include @@ -951,6 +952,30 @@ static int sve_set(struct task_struct *target, #endif /* CONFIG_ARM64_SVE */ +#ifdef CONFIG_ARM64_PTR_AUTH +static int pac_mask_get(struct task_struct *target, + const struct user_regset *regset, + unsigned int pos, unsigned int count, + void *kbuf, void __user *ubuf) +{ + /* + * The PAC bits can differ across data and instruction pointers + * depending on TCR_EL1.TBID*, which we may make use of in future, so + * we expose separate masks. + */ + unsigned long mask = ptrauth_pac_mask(); + struct user_pac_mask uregs = { + .data_mask = mask, + .insn_mask = mask, + }; + + if (!cpus_have_cap(ARM64_HAS_ADDRESS_AUTH)) + return -EINVAL; + + return user_regset_copyout(&pos, &count, &kbuf, &ubuf, &uregs, 0, -1); +} +#endif /* CONFIG_ARM64_PTR_AUTH */ + enum aarch64_regset { REGSET_GPR, REGSET_FPR, @@ -963,6 +988,9 @@ enum aarch64_regset { #ifdef CONFIG_ARM64_SVE REGSET_SVE, #endif +#ifdef CONFIG_ARM64_PTR_AUTH + REGSET_PAC_MASK, +#endif }; static const struct user_regset aarch64_regsets[] = { @@ -1032,6 +1060,16 @@ static const struct user_regset aarch64_regsets[] = { .get_size = sve_get_size, }, #endif +#ifdef CONFIG_ARM64_PTR_AUTH + [REGSET_PAC_MASK] = { + .core_note_type = NT_ARM_PAC_MASK, + .n = sizeof(struct user_pac_mask) / sizeof(u64), + .size = sizeof(u64), + .align = sizeof(u64), + .get = pac_mask_get, + /* this cannot be set dynamically */ + }, +#endif }; static const struct user_regset_view user_aarch64_view = { diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h index e2535d6dcec7..070c28121979 100644 --- a/include/uapi/linux/elf.h +++ b/include/uapi/linux/elf.h @@ -420,6 +420,7 @@ typedef struct elf64_shdr { #define NT_ARM_HW_WATCH 0x403 /* ARM hardware watchpoint registers */ #define NT_ARM_SYSTEM_CALL 0x404 /* ARM system call number */ #define NT_ARM_SVE 0x405 /* ARM Scalable Vector Extension registers */ +#define NT_ARM_PAC_MASK 0x406 /* ARM pointer authentication code masks */ #define NT_ARC_V2 0x600 /* ARCv2 accumulator/extra registers */ /* Note header in a PT_NOTE section */ From patchwork Tue Apr 17 18:37:33 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133579 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5036564ljb; Tue, 17 Apr 2018 11:38:54 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+HYahkVHEV6ycYGqGCPPvFXqDi8qo9Jj1KbwzWUGgIxmP83SYQ4z5Obpym1Z7qsSeTtNvm X-Received: by 10.99.181.5 with SMTP id y5mr2607453pge.279.1523990334369; Tue, 17 Apr 2018 11:38:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990334; cv=none; d=google.com; s=arc-20160816; b=CXe8EdybhW4/kvFKaMOfoJ4ADyUYbnBlWTVofQfGqpkF+dnDUzaQy3guJoopgcGFqV iB9uxDCLwhjjXsxYDlfdRdrA/ilTz2EuFPp69pzF1OCn3qfV/Xuo9NtQNMkrrZNsZkOd HcKVICfr7ov7VryVKdv0cpRvnsO2qvpOLQqynbKZe178tw7rxjmfNpHQh3JndqDVLflJ 1b+XoMyY7S4NGVbisH11roR106Zz/Jhir/dFa/IQFkliyZ9s62JQ21/U5F3bINMwmAZM 4fA+7xdh+U8wMI+OkQ4CvJrPauJqnlo0CnmC9YAysxl85q73Jmu+i1N7z5L0gqDDgw8w Sj2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=I4QW1qdEk8tC8nDWOrEQmpFv3zVp92/g2kt8GUOONBg=; b=PqqBiEUYHcYNIj1ZBM4361qIpG5p1XSikDE1aiuBV5ryQWLbssmyTRTQAX+XhZfy59 7KBWAOwdWOmsYurGAatD6cwRpk7szoXzqbUyOcvqrB0/zkOwk1Los8SrS6jcZ8e7Typt nvLdXaES3KaYHKKvsbBm2VRsb8PZDTRTXYXTpwGIJZOmBPZnchnsy0IIHMc6uI2+hEmv /ZORyK0oFNtjS40pcO/sPfIKs+fZjBEzX2zLM0qT9o6gNdTTRB1XPuBx4biDKkA/43C1 m8uWSTqzwlR+DQ7Esz0CBkNQ3MqkSr5kydZXxFVJrSEggcbIknDAn71mqymsK5CTcjDJ MWjQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s1-v6si10240928plr.458.2018.04.17.11.38.54; Tue, 17 Apr 2018 11:38:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753170AbeDQSiv (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:51 -0400 Received: from foss.arm.com ([217.140.101.70]:47076 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752915AbeDQSiP (ORCPT ); Tue, 17 Apr 2018 14:38:15 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2BB8E1435; Tue, 17 Apr 2018 11:38:15 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id A579C3F587; Tue, 17 Apr 2018 11:38:12 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 09/11] arm64: perf: strip PAC when unwinding userspace Date: Tue, 17 Apr 2018 19:37:33 +0100 Message-Id: <20180417183735.56985-10-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When the kernel is unwinding userspace callchains, we can't expect that the userspace consumer of these callchains has the data necessary to strip the PAC from the stored LR. This patch has the kernel strip the PAC from user stackframes when the in-kernel unwinder is used. This only affects the LR value, and not the FP. This only affects the in-kernel unwinder. When userspace performs unwinding, it is up to userspace to strip PACs as necessary (which can be determined from DWARF information). Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Ramana Radhakrishnan Cc: Will Deacon --- arch/arm64/include/asm/pointer_auth.h | 7 +++++++ arch/arm64/kernel/perf_callchain.c | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h index 5ff141245633..a9ad81791c7f 100644 --- a/arch/arm64/include/asm/pointer_auth.h +++ b/arch/arm64/include/asm/pointer_auth.h @@ -79,6 +79,12 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, */ #define ptrauth_pac_mask() GENMASK(54, VA_BITS) +/* Only valid for EL0 TTBR0 instruction pointers */ +static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr) +{ + return ptr & ~ptrauth_pac_mask(); +} + #define mm_ctx_ptrauth_init(ctx) \ ptrauth_keys_init(&(ctx)->ptrauth_keys) @@ -89,6 +95,7 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, ptrauth_keys_dup(&(oldctx)->ptrauth_keys, &(newctx)->ptrauth_keys) #else +#define ptrauth_strip_insn_pac(lr) (lr) #define mm_ctx_ptrauth_init(ctx) #define mm_ctx_ptrauth_switch(ctx) #define mm_ctx_ptrauth_dup(oldctx, newctx) diff --git a/arch/arm64/kernel/perf_callchain.c b/arch/arm64/kernel/perf_callchain.c index bcafd7dcfe8b..928204f6ab08 100644 --- a/arch/arm64/kernel/perf_callchain.c +++ b/arch/arm64/kernel/perf_callchain.c @@ -35,6 +35,7 @@ user_backtrace(struct frame_tail __user *tail, { struct frame_tail buftail; unsigned long err; + unsigned long lr; /* Also check accessibility of one struct frame_tail beyond */ if (!access_ok(VERIFY_READ, tail, sizeof(buftail))) @@ -47,7 +48,9 @@ user_backtrace(struct frame_tail __user *tail, if (err) return NULL; - perf_callchain_store(entry, buftail.lr); + lr = ptrauth_strip_insn_pac(buftail.lr); + + perf_callchain_store(entry, lr); /* * Frame pointers should strictly progress back up the stack From patchwork Tue Apr 17 18:37:34 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133577 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5036116ljb; Tue, 17 Apr 2018 11:38:25 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+RBCP6b4dA3fDhTIfDmp0aHQfv92ppdC6rIKHR0MX9HKeUZMFqlzgzDMyvm3lz0DQd1Da0 X-Received: by 2002:a17:902:9a49:: with SMTP id x9-v6mr3014597plv.94.1523990305327; Tue, 17 Apr 2018 11:38:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990305; cv=none; d=google.com; s=arc-20160816; b=XL+Eq/sebTsBvtQkn8QZHVi/KWTi2hEpU4qqJ15CA9FIropPz6U2bQjg2dTkgqCorx FHkVVyTaSYl0t5mwqKqUR1MNSwX4AHrvMx5aLRBB/lGx7WLeDPMSdv+ml9uPgtf2YbBE AHncTKK+iN+xbHR0JeR9zLraycFQn6kyC1UXF8JkQTwajtgJMfAUV5Epix8VG2ZCVA// pKebm7TZ/razaPW+PU4s2NkC+9AMU/p32z+W2LYKKb+4DxkjtFaT9yTUA9aBDeUX9MtX L1OsUNVHqtyVlp6eNeilrzRyIKlptUjYEptpftNerIrO42XDyyeTcQSntFCfbSYSfL4m NhEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=4LVUTzyQ2OJXCHpF83tP6m/H15e7vVAfSJud/Ls2QQI=; b=AmbrorxdCmdxNHbMStb8d/2LuUJ2rsuIUnsDRGzYFXWUsbhn35PsvejNbX+ccFk4t+ uP7cBD9TAAw1MPDHH1p8DYayAgWPtBg+Iwd2u2g8kCZACOpTu1kw+ezSjtXf7x8NV91x mnvNm7Zs9IzFT4iP2ytvMw1uaAs7Vaii8Vdf5e/B6tALbjGDzRnnv54ztkBFa3cj8bbx cs1HeAR24BkaSUYdSquH/cTj3pp6dIgz981Du20XhhQyeDgS4Z/7xjHp/2YIw5uKia2z YBSUuZCYj0/ZmgpjjNYkt+blOc5J2Z8NrGYqsViSmce2MtUO4UsJRvIO7+ZOMYhgTIgd VUeA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u21si7743865pfg.225.2018.04.17.11.38.25; Tue, 17 Apr 2018 11:38:25 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753032AbeDQSiW (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:22 -0400 Received: from foss.arm.com ([217.140.101.70]:47092 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752974AbeDQSiS (ORCPT ); Tue, 17 Apr 2018 14:38:18 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 77A7615AD; Tue, 17 Apr 2018 11:38:18 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id F1A453F587; Tue, 17 Apr 2018 11:38:15 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 10/11] arm64: enable pointer authentication Date: Tue, 17 Apr 2018 19:37:34 +0100 Message-Id: <20180417183735.56985-11-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Now that all the necessary bits are in place for userspace, add the necessary Kconfig logic to allow this to be enabled. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Will Deacon --- arch/arm64/Kconfig | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) -- 2.11.0 diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index eb2cf4938f6d..d6ce16b1ee47 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1127,6 +1127,29 @@ config ARM64_RAS_EXTN endmenu +menu "ARMv8.3 architectural features" + +config ARM64_PTR_AUTH + bool "Enable support for pointer authentication" + default y + help + Pointer authentication (part of the ARMv8.3 Extensions) provides + instructions for signing and authenticating pointers against secret + keys, which can be used to mitigate Return Oriented Programming (ROP) + and other attacks. + + This option enables these instructions at EL0 (i.e. for userspace). + + Choosing this option will cause the kernel to initialise secret keys + for each process at exec() time, with these keys being + context-switched along with the process. + + The feature is detected at runtime. If the feature is not present in + hardware it will not be advertised to userspace nor will it be + enabled. + +endmenu + config ARM64_SVE bool "ARM Scalable Vector Extension support" default y From patchwork Tue Apr 17 18:37:35 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133578 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5036135ljb; Tue, 17 Apr 2018 11:38:27 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+tnxgXlf3H4rbXkwpxZpy5AkPCMLoPhVR1rCX7F9X2nnd6b7iTMGjS7CR5k2kBF9uQSkXl X-Received: by 2002:a17:902:688c:: with SMTP id i12-v6mr3041572plk.166.1523990307236; Tue, 17 Apr 2018 11:38:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990307; cv=none; d=google.com; s=arc-20160816; b=mopLGqB72TFk7amkvYkBdbfeHcYoN7vbcMbvIh2kBeWrkR+gcAHSoVmyCKoQqd94jd R9FKIjBPcXN9kW7YZVGf7Tnt2HMq/Dy8s4EKAx1/8s9jxwwTG2fZ7gBh+uZqebR5EHre RgrEIRl3hSJ6DXAOYWzYa6jY6wjyb9r6U+kwwhmO1rCFqlpWVgasM3PvAfuZsnObWcfw tMb0P3D89NGBu0swaqollLqNmnhWzoMBMsYKp4Uco0vveyxnrJAD+69y72oNWMbTe1tD c0QFaFSwfOV+UenCqyXqErHT2nTCPrhn0mYlUZWmIlXmpq9Tml9aXhlfOVqnHvWIRNrm nipQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=Su4TgIpDOWBPtee8Tc5v3AkKwJ6Ffacp4Hb8MCJZMo8=; b=gKp5h3/HfQBlWanzKL6ECOOYkMBB/rQxP6nOgV8eEp43e6Nz9Oz7dExkxGzgqz7qu4 WN6kgug+3ijFrliHYEK7uUZF56HJIU4dW42dLzbVZXbSUKRcvAzcOjaEBYeM9TEtMusc 65i7G+5/u1td0H5BxrbW5hK+rlYPN9nqYHNe6Yz+RLuYxvLC+vcNSMmbhSrvfwNK6qji PGImgJkY5cdfF3+j+kiiaDhKG17k2Z0XS1h0xs0z81BJG4vkUhWz4+DxHUvTA7+zGypi xTxOcXsdY/rMzA6H67sQHv7xtzSmOfXhc99EqyqPGDgt6BjtiGVt0i1u4QkaKGOAp9x+ G1Aw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a100-v6si15333310pli.20.2018.04.17.11.38.26; Tue, 17 Apr 2018 11:38:27 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753073AbeDQSiY (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:24 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:47112 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753012AbeDQSiW (ORCPT ); Tue, 17 Apr 2018 14:38:22 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id B844515BF; Tue, 17 Apr 2018 11:38:21 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 3DFD93F587; Tue, 17 Apr 2018 11:38:19 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 11/11] arm64: docs: document pointer authentication Date: Tue, 17 Apr 2018 19:37:35 +0100 Message-Id: <20180417183735.56985-12-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Now that we've added code to support pointer authentication, add some documentation so that people can figure out if/how to use it. Signed-off-by: Mark Rutland Cc: Andrew Jones Cc: Catalin Marinas Cc: Ramana Radhakrishnan Cc: Will Deacon --- Documentation/arm64/booting.txt | 8 +++ Documentation/arm64/elf_hwcaps.txt | 6 ++ Documentation/arm64/pointer-authentication.txt | 84 ++++++++++++++++++++++++++ 3 files changed, 98 insertions(+) create mode 100644 Documentation/arm64/pointer-authentication.txt -- 2.11.0 diff --git a/Documentation/arm64/booting.txt b/Documentation/arm64/booting.txt index 8d0df62c3fe0..8df9f4658d6f 100644 --- a/Documentation/arm64/booting.txt +++ b/Documentation/arm64/booting.txt @@ -205,6 +205,14 @@ Before jumping into the kernel, the following conditions must be met: ICC_SRE_EL2.SRE (bit 0) must be initialised to 0b0. - The DT or ACPI tables must describe a GICv2 interrupt controller. + For CPUs with pointer authentication functionality: + - If EL3 is present: + SCR_EL3.APK (bit 16) must be initialised to 0b1 + SCR_EL3.API (bit 17) must be initialised to 0b1 + - If the kernel is entered at EL1: + HCR_EL2.APK (bit 40) must be initialised to 0b1 + HCR_EL2.API (bit 41) must be initialised to 0b1 + The requirements described above for CPU mode, caches, MMUs, architected timers, coherency and system registers apply to all CPUs. All CPUs must enter the kernel in the same exception level. diff --git a/Documentation/arm64/elf_hwcaps.txt b/Documentation/arm64/elf_hwcaps.txt index d6aff2c5e9e2..ebc8b15b45fc 100644 --- a/Documentation/arm64/elf_hwcaps.txt +++ b/Documentation/arm64/elf_hwcaps.txt @@ -178,3 +178,9 @@ HWCAP_ILRCPC HWCAP_FLAGM Functionality implied by ID_AA64ISAR0_EL1.TS == 0b0001. + +HWCAP_APIA + + EL0 AddPac and Auth functionality using APIAKey_EL1 is enabled, as + described by Documentation/arm64/pointer-authentication.txt. + diff --git a/Documentation/arm64/pointer-authentication.txt b/Documentation/arm64/pointer-authentication.txt new file mode 100644 index 000000000000..8a9cb5713770 --- /dev/null +++ b/Documentation/arm64/pointer-authentication.txt @@ -0,0 +1,84 @@ +Pointer authentication in AArch64 Linux +======================================= + +Author: Mark Rutland +Date: 2017-07-19 + +This document briefly describes the provision of pointer authentication +functionality in AArch64 Linux. + + +Architecture overview +--------------------- + +The ARMv8.3 Pointer Authentication extension adds primitives that can be +used to mitigate certain classes of attack where an attacker can corrupt +the contents of some memory (e.g. the stack). + +The extension uses a Pointer Authentication Code (PAC) to determine +whether pointers have been modified unexpectedly. A PAC is derived from +a pointer, another value (such as the stack pointer), and a secret key +held in system registers. + +The extension adds instructions to insert a valid PAC into a pointer, +and to verify/remove the PAC from a pointer. The PAC occupies a number +of high-order bits of the pointer, which varies dependent on the +configured virtual address size and whether pointer tagging is in use. + +A subset of these instructions have been allocated from the HINT +encoding space. In the absence of the extension (or when disabled), +these instructions behave as NOPs. Applications and libraries using +these instructions operate correctly regardless of the presence of the +extension. + + +Basic support +------------- + +When CONFIG_ARM64_PTR_AUTH is selected, and relevant HW support is +present, the kernel will assign a random APIAKey value to each process +at exec*() time. This key is shared by all threads within the process, +and the key is preserved across fork(). Presence of functionality using +APIAKey is advertised via HWCAP_APIA. + +Recent versions of GCC can compile code with APIAKey-based return +address protection when passed the -msign-return-address option. This +uses instructions in the HINT space, and such code can run on systems +without the pointer authentication extension. + +The remaining instruction and data keys (APIBKey, APDAKey, APDBKey) are +reserved for future use, and instructions using these keys must not be +used by software until a purpose and scope for their use has been +decided. To enable future software using these keys to function on +contemporary kernels, where possible, instructions using these keys are +made to behave as NOPs. + +The generic key (APGAKey) is currently unsupported. Instructions using +the generic key must not be used by software. + + +Debugging +--------- + +When CONFIG_ARM64_PTR_AUTH is selected, and relevant HW support is +present, the kernel will expose the position of TTBR0 PAC bits in the +NT_ARM_PAC_MASK regset (struct user_pac_mask), which userspace can +acqure via PTRACE_GETREGSET. + +Separate masks are exposed for data pointers and instruction pointers, +as the set of PAC bits can vary between the two. Debuggers should not +expect that HWCAP_APIA implies the presence (or non-presence) of this +regset -- in future the kernel may support the use of APIBKey, APDAKey, +and/or APBAKey, even in the absence of APIAKey. + +Note that the masks apply to TTBR0 addresses, and are not valid to apply +to TTBR1 addresses (e.g. kernel pointers). + + +Virtualization +-------------- + +Pointer authentication is not currently supported in KVM guests. KVM +will mask the feature bits from ID_AA64ISAR1_EL1, and attempted use of +the feature will result in an UNDEFINED exception being injected into +the guest.