From: mark.rutland@arm.com (Mark Rutland)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH v3 1/7] arm64: Factor out PAN enabling/disabling into separate uaccess_* macros
Date: Thu, 15 Sep 2016 16:10:45 +0100 [thread overview]
Message-ID: <20160915151045.GD9316@leverpostej> (raw)
In-Reply-To: <1473788797-10879-2-git-send-email-catalin.marinas@arm.com>
Hi Catalin,
On Tue, Sep 13, 2016 at 06:46:31PM +0100, Catalin Marinas wrote:
> This patch moves the directly coded alternatives for turning PAN on/off
> into separate uaccess_{enable,disable} macros or functions. The asm
> macros take a few arguments which will be used in subsequent patches.
>
> Note that any (unlikely) access that the compiler might generate between
> uaccess_enable() and uaccess_disable(), other than those explicitly
> specified by the user access code, will not be protected by PAN.
There's one missing include that I've noted below, along with a number
we can now drop. Otherwise, the important parts all look good to me.
With the includes fixed up:
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
[...]
> Cc: Will Deacon <will.deacon@arm.com>
> Cc: James Morse <james.morse@arm.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> ---
> arch/arm64/include/asm/futex.h | 14 +++----
> arch/arm64/include/asm/uaccess.h | 79 ++++++++++++++++++++++++++++++++----
> arch/arm64/kernel/armv8_deprecated.c | 10 ++---
> arch/arm64/lib/clear_user.S | 8 ++--
> arch/arm64/lib/copy_from_user.S | 8 ++--
> arch/arm64/lib/copy_in_user.S | 8 ++--
> arch/arm64/lib/copy_to_user.S | 8 ++--
> 7 files changed, 95 insertions(+), 40 deletions(-)
>
> diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
> index f2585cdd32c2..71dfa3b42313 100644
> --- a/arch/arm64/include/asm/futex.h
> +++ b/arch/arm64/include/asm/futex.h
> @@ -27,9 +27,9 @@
> #include <asm/sysreg.h>
>
> #define __futex_atomic_op(insn, ret, oldval, uaddr, tmp, oparg) \
> +do { \
> + uaccess_enable(); \
> asm volatile( \
> - ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \
> - CONFIG_ARM64_PAN) \
> " prfm pstl1strm, %2\n" \
> "1: ldxr %w1, %2\n" \
> insn "\n" \
> @@ -44,11 +44,11 @@
> " .popsection\n" \
> _ASM_EXTABLE(1b, 4b) \
> _ASM_EXTABLE(2b, 4b) \
> - ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \
> - CONFIG_ARM64_PAN) \
> : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp) \
> : "r" (oparg), "Ir" (-EFAULT) \
> - : "memory")
> + : "memory"); \
> + uaccess_disable(); \
> +} while (0)
With the uaccess_{enable,disable}* macros, we can drop the includes for
<asm/alternative.h>, <asm/cpufeature.h>, and <asm/sysreg.h> from
futex.h, as we no longer (directly) use anything from those.
[...]
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index c47257c91b77..cc6c32d4dcc4 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -321,4 +357,31 @@ extern long strncpy_from_user(char *dest, const char __user *src, long count);
> extern __must_check long strlen_user(const char __user *str);
> extern __must_check long strnlen_user(const char __user *str, long n);
>
> +#else /* __ASSEMBLY__ */
> +
> +#include <asm/alternative.h>
> +#include <asm/assembler.h>
We also need <asm/sysreg.h> for SET_PSTATE_PAN()
Given we use that and <asm/alternative.h> either way, should we pull
those above the #ifdef __ASSEMBLY__? I have no feeling either way.
[...]
> diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
> index 42ffdb54e162..7156e7bfcd89 100644
> --- a/arch/arm64/kernel/armv8_deprecated.c
> +++ b/arch/arm64/kernel/armv8_deprecated.c
> @@ -281,9 +281,9 @@ static void __init register_insn_emulation_sysctl(struct ctl_table *table)
> * Error-checking SWP macros implemented using ldxr{b}/stxr{b}
> */
> #define __user_swpX_asm(data, addr, res, temp, B) \
> +do { \
> + uaccess_enable(); \
> __asm__ __volatile__( \
> - ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \
> - CONFIG_ARM64_PAN) \
> "0: ldxr"B" %w2, [%3]\n" \
> "1: stxr"B" %w0, %w1, [%3]\n" \
> " cbz %w0, 2f\n" \
> @@ -299,11 +299,11 @@ static void __init register_insn_emulation_sysctl(struct ctl_table *table)
> " .popsection" \
> _ASM_EXTABLE(0b, 4b) \
> _ASM_EXTABLE(1b, 4b) \
> - ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \
> - CONFIG_ARM64_PAN) \
> : "=&r" (res), "+r" (data), "=&r" (temp) \
> : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \
> - : "memory")
> + : "memory"); \
> + uaccess_disable(); \
> +} while (0)
With this, we can drop the include of <asm/alternative.h>, though unlike
futex.h we need to keep <asm/cpufeature.h> and <asm/sysreg.h>.
[...]
> diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
> index 5d1cad3ce6d6..08b5f18ba604 100644
> --- a/arch/arm64/lib/clear_user.S
> +++ b/arch/arm64/lib/clear_user.S
> @@ -17,10 +17,10 @@
> */
> #include <linux/linkage.h>
>
> -#include <asm/alternative.h>
> #include <asm/assembler.h>
> #include <asm/cpufeature.h>
> #include <asm/sysreg.h>
> +#include <asm/uaccess.h>
As with futex.h, we can drop <asm/assembler.h>, <asm/cpufeature.h>, and
<asm/sysreg.h>, as the uaccess_{enable,disable}* macros mean we no
longer use anything from those directly.
[...]
> diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
> index 0b90497d4424..6505ec81f1da 100644
> --- a/arch/arm64/lib/copy_from_user.S
> +++ b/arch/arm64/lib/copy_from_user.S
> @@ -16,11 +16,11 @@
>
> #include <linux/linkage.h>
>
> -#include <asm/alternative.h>
> #include <asm/assembler.h>
> #include <asm/cache.h>
> #include <asm/cpufeature.h>
> #include <asm/sysreg.h>
> +#include <asm/uaccess.h>
Likewise, we can also drop <asm/assembler.h>, <asm/cpufeature.h>, and
<asm/sysreg.h> here.
[...]
> diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
> index f7292dd08c84..9b04ff3ab610 100644
> --- a/arch/arm64/lib/copy_in_user.S
> +++ b/arch/arm64/lib/copy_in_user.S
> @@ -18,11 +18,11 @@
>
> #include <linux/linkage.h>
>
> -#include <asm/alternative.h>
> #include <asm/assembler.h>
> #include <asm/cache.h>
> #include <asm/cpufeature.h>
> #include <asm/sysreg.h>
> +#include <asm/uaccess.h>
Likewise, we can also drop <asm/assembler.h>, <asm/cpufeature.h>, and
<asm/sysreg.h> here.
[...]
> diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
> index 7a7efe255034..8077e4f34d56 100644
> --- a/arch/arm64/lib/copy_to_user.S
> +++ b/arch/arm64/lib/copy_to_user.S
> @@ -16,11 +16,11 @@
>
> #include <linux/linkage.h>
>
> -#include <asm/alternative.h>
> #include <asm/assembler.h>
> #include <asm/cache.h>
> #include <asm/cpufeature.h>
> #include <asm/sysreg.h>
> +#include <asm/uaccess.h>
Likewise, we can also drop <asm/assembler.h>, <asm/cpufeature.h>, and
<asm/sysreg.h> here.
Thanks,
Mark.
next prev parent reply other threads:[~2016-09-15 15:10 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-13 17:46 [PATCH v3 0/7] arm64: Privileged Access Never using TTBR0_EL1 switching Catalin Marinas
2016-09-13 17:46 ` [PATCH v3 1/7] arm64: Factor out PAN enabling/disabling into separate uaccess_* macros Catalin Marinas
2016-09-15 15:10 ` Mark Rutland [this message]
2016-09-13 17:46 ` [PATCH v3 2/7] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro Catalin Marinas
2016-09-15 15:19 ` Mark Rutland
2016-09-13 17:46 ` [PATCH v3 3/7] arm64: Introduce uaccess_{disable, enable} functionality based on TTBR0_EL1 Catalin Marinas
2016-09-13 20:45 ` [PATCH v3 3/7] arm64: Introduce uaccess_{disable,enable} " Kees Cook
2016-09-14 8:52 ` Mark Rutland
2016-09-14 16:27 ` [kernel-hardening] " Kees Cook
2016-09-13 17:46 ` [PATCH v3 4/7] arm64: Disable TTBR0_EL1 during normal kernel execution Catalin Marinas
2016-09-14 16:45 ` Will Deacon
2016-09-13 17:46 ` [PATCH v3 5/7] arm64: Handle faults caused by inadvertent user access with PAN enabled Catalin Marinas
2016-09-16 11:33 ` Mark Rutland
2016-09-16 15:55 ` Catalin Marinas
2016-09-13 17:46 ` [PATCH v3 6/7] arm64: xen: Enable user access before a privcmd hvc call Catalin Marinas
2016-09-13 17:46 ` [PATCH v3 7/7] arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN Catalin Marinas
2016-09-14 10:13 ` [PATCH v3 0/7] arm64: Privileged Access Never using TTBR0_EL1 switching Ard Biesheuvel
2016-09-14 10:27 ` Mark Rutland
2016-09-14 10:30 ` Ard Biesheuvel
2016-09-14 10:36 ` Mark Rutland
2016-09-14 10:48 ` Mark Rutland
2016-09-14 20:54 ` [kernel-hardening] " David Brown
2016-09-15 9:52 ` Catalin Marinas
2016-09-15 16:20 ` Mark Rutland
2016-09-15 16:41 ` Mark Rutland
2016-09-29 22:44 ` [kernel-hardening] " Sami Tolvanen
2016-09-30 18:42 ` Kees Cook
2016-10-27 14:54 ` Catalin Marinas
2016-10-27 21:23 ` Kees Cook
2016-10-14 21:44 ` Kees Cook
2016-10-15 14:35 ` Catalin Marinas
2016-10-16 2:04 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160915151045.GD9316@leverpostej \
--to=mark.rutland@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).