From: Dave Martin <Dave.Martin@arm.com>
To: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>,
Kees Cook <keescook@chromium.org>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Mark Brown <broonie@kernel.org>,
James Morse <james.morse@arm.com>,
Vincenzo Frascino <Vincenzo.Frascino@arm.com>,
Will Deacon <will@kernel.org>,
linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH v5 3/6] arm64: ptrauth: Introduce Armv8.3 pointer authentication enhancements
Date: Wed, 2 Sep 2020 16:39:26 +0100 [thread overview]
Message-ID: <20200902153926.GG6642@arm.com> (raw)
In-Reply-To: <1597734671-23407-4-git-send-email-amit.kachhap@arm.com>
On Tue, Aug 18, 2020 at 12:41:08PM +0530, Amit Daniel Kachhap wrote:
> Some Armv8.3 Pointer Authentication enhancements have been introduced
> which are mandatory for Armv8.6 and optional for Armv8.3. These features
> are,
>
> * ARMv8.3-PAuth2 - An enhanced PAC generation logic is added which hardens
> finding the correct PAC value of the authenticated pointer.
>
> * ARMv8.3-FPAC - Fault is generated now when the ptrauth authentication
> instruction fails in authenticating the PAC present in the address.
> This is different from earlier case when such failures just adds an
> error code in the top byte and waits for subsequent load/store to abort.
> The ptrauth instructions which may cause this fault are autiasp, retaa
> etc.
>
> The above features are now represented by additional configurations
> for the Address Authentication cpufeature and a new ESR exception class.
>
> The userspace fault received in the kernel due to ARMv8.3-FPAC is treated
> as Illegal instruction and hence signal SIGILL is injected with ILL_ILLOPN
> as the signal code. Note that this is different from earlier ARMv8.3
> ptrauth where signal SIGSEGV is issued due to Pointer authentication
> failures. The in-kernel PAC fault causes kernel to crash.
>
> Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
> ---
> Changes since v4:
> * Used force_signal_inject() to create ptrauth signal. This is in
> sync with existing Illegal instruction fault handlers.
>
> arch/arm64/include/asm/esr.h | 4 +++-
> arch/arm64/include/asm/exception.h | 1 +
> arch/arm64/include/asm/sysreg.h | 24 ++++++++++++++++--------
> arch/arm64/kernel/entry-common.c | 21 +++++++++++++++++++++
> arch/arm64/kernel/traps.c | 9 +++++++++
> 5 files changed, 50 insertions(+), 9 deletions(-)
>
> diff --git a/arch/arm64/include/asm/esr.h b/arch/arm64/include/asm/esr.h
> index 035003acfa87..22c81f1edda2 100644
> --- a/arch/arm64/include/asm/esr.h
> +++ b/arch/arm64/include/asm/esr.h
> @@ -35,7 +35,9 @@
> #define ESR_ELx_EC_SYS64 (0x18)
> #define ESR_ELx_EC_SVE (0x19)
> #define ESR_ELx_EC_ERET (0x1a) /* EL2 only */
> -/* Unallocated EC: 0x1b - 0x1E */
> +/* Unallocated EC: 0x1B */
> +#define ESR_ELx_EC_FPAC (0x1C) /* EL1 and above */
> +/* Unallocated EC: 0x1D - 0x1E */
> #define ESR_ELx_EC_IMP_DEF (0x1f) /* EL3 only */
> #define ESR_ELx_EC_IABT_LOW (0x20)
> #define ESR_ELx_EC_IABT_CUR (0x21)
> diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
> index 7577a754d443..99b9383cd036 100644
> --- a/arch/arm64/include/asm/exception.h
> +++ b/arch/arm64/include/asm/exception.h
> @@ -47,4 +47,5 @@ void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr);
> void do_cp15instr(unsigned int esr, struct pt_regs *regs);
> void do_el0_svc(struct pt_regs *regs);
> void do_el0_svc_compat(struct pt_regs *regs);
> +void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr);
> #endif /* __ASM_EXCEPTION_H */
> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
> index 463175f80341..c71bcd0c002a 100644
> --- a/arch/arm64/include/asm/sysreg.h
> +++ b/arch/arm64/include/asm/sysreg.h
> @@ -633,14 +633,22 @@
> #define ID_AA64ISAR1_APA_SHIFT 4
> #define ID_AA64ISAR1_DPB_SHIFT 0
>
> -#define ID_AA64ISAR1_APA_NI 0x0
> -#define ID_AA64ISAR1_APA_ARCHITECTED 0x1
> -#define ID_AA64ISAR1_API_NI 0x0
> -#define ID_AA64ISAR1_API_IMP_DEF 0x1
> -#define ID_AA64ISAR1_GPA_NI 0x0
> -#define ID_AA64ISAR1_GPA_ARCHITECTED 0x1
> -#define ID_AA64ISAR1_GPI_NI 0x0
> -#define ID_AA64ISAR1_GPI_IMP_DEF 0x1
> +#define ID_AA64ISAR1_APA_NI 0x0
> +#define ID_AA64ISAR1_APA_ARCHITECTED 0x1
> +#define ID_AA64ISAR1_APA_ARCH_EPAC 0x2
> +#define ID_AA64ISAR1_APA_ARCH_EPAC2 0x3
> +#define ID_AA64ISAR1_APA_ARCH_EPAC2_FPAC 0x4
> +#define ID_AA64ISAR1_APA_ARCH_EPAC2_FPAC_CMB 0x5
> +#define ID_AA64ISAR1_API_NI 0x0
> +#define ID_AA64ISAR1_API_IMP_DEF 0x1
> +#define ID_AA64ISAR1_API_IMP_DEF_EPAC 0x2
> +#define ID_AA64ISAR1_API_IMP_DEF_EPAC2 0x3
> +#define ID_AA64ISAR1_API_IMP_DEF_EPAC2_FPAC 0x4
> +#define ID_AA64ISAR1_API_IMP_DEF_EPAC2_FPAC_CMB 0x5
> +#define ID_AA64ISAR1_GPA_NI 0x0
> +#define ID_AA64ISAR1_GPA_ARCHITECTED 0x1
> +#define ID_AA64ISAR1_GPI_NI 0x0
> +#define ID_AA64ISAR1_GPI_IMP_DEF 0x1
>
> /* id_aa64pfr0 */
> #define ID_AA64PFR0_CSV3_SHIFT 60
> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
> index 3dbdf9752b11..8380ffb8160a 100644
> --- a/arch/arm64/kernel/entry-common.c
> +++ b/arch/arm64/kernel/entry-common.c
> @@ -66,6 +66,13 @@ static void notrace el1_dbg(struct pt_regs *regs, unsigned long esr)
> }
> NOKPROBE_SYMBOL(el1_dbg);
>
> +static void notrace el1_fpac(struct pt_regs *regs, unsigned long esr)
> +{
> + local_daif_inherit(regs);
> + do_ptrauth_fault(regs, esr);
> +}
> +NOKPROBE_SYMBOL(el1_fpac);
> +
> asmlinkage void notrace el1_sync_handler(struct pt_regs *regs)
> {
> unsigned long esr = read_sysreg(esr_el1);
> @@ -92,6 +99,9 @@ asmlinkage void notrace el1_sync_handler(struct pt_regs *regs)
> case ESR_ELx_EC_BRK64:
> el1_dbg(regs, esr);
> break;
> + case ESR_ELx_EC_FPAC:
> + el1_fpac(regs, esr);
> + break;
> default:
> el1_inv(regs, esr);
> }
> @@ -227,6 +237,14 @@ static void notrace el0_svc(struct pt_regs *regs)
> }
> NOKPROBE_SYMBOL(el0_svc);
>
> +static void notrace el0_fpac(struct pt_regs *regs, unsigned long esr)
> +{
> + user_exit_irqoff();
> + local_daif_restore(DAIF_PROCCTX);
> + do_ptrauth_fault(regs, esr);
> +}
> +NOKPROBE_SYMBOL(el0_fpac);
> +
> asmlinkage void notrace el0_sync_handler(struct pt_regs *regs)
> {
> unsigned long esr = read_sysreg(esr_el1);
> @@ -272,6 +290,9 @@ asmlinkage void notrace el0_sync_handler(struct pt_regs *regs)
> case ESR_ELx_EC_BRK64:
> el0_dbg(regs, esr);
> break;
> + case ESR_ELx_EC_FPAC:
> + el0_fpac(regs, esr);
> + break;
> default:
> el0_inv(regs, esr);
> }
> diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
> index eb19f985f0bc..af2479f2c642 100644
> --- a/arch/arm64/kernel/traps.c
> +++ b/arch/arm64/kernel/traps.c
> @@ -479,6 +479,14 @@ void do_bti(struct pt_regs *regs)
> }
> NOKPROBE_SYMBOL(do_bti);
>
> +void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr)
> +{
> + /* In-kernel Pointer authentication fault causes kernel crash */
> + BUG_ON(!user_mode(regs));
Ack, I think keeping this BUG_ON() makes sense here, since
force_signal_inject() just warns and returns if !user_mode(regs).
Maybe the comment could be clarified though to explain what is meant by
"crash": maybe something like:
Unexpected FPAC exception or pointer authentication failure in
the kernel: kill the task before it does any more harm.
> + force_signal_inject(SIGILL, ILL_ILLOPN, regs->pc, esr);
> +}
> +NOKPROBE_SYMBOL(do_ptrauth_fault);
> +
> #define __user_cache_maint(insn, address, res) \
> if (address >= user_addr_max()) { \
> res = -EFAULT; \
> @@ -775,6 +783,7 @@ static const char *esr_class_str[] = {
> [ESR_ELx_EC_SYS64] = "MSR/MRS (AArch64)",
> [ESR_ELx_EC_SVE] = "SVE",
> [ESR_ELx_EC_ERET] = "ERET/ERETAA/ERETAB",
> + [ESR_ELx_EC_FPAC] = "FPAC",
[...]
With the above,
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Cheers
---Dave
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-09-02 15:40 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-18 7:11 [PATCH v5 0/6] arm64: add Armv8.3 pointer authentication enhancements Amit Daniel Kachhap
2020-08-18 7:11 ` [PATCH v5 1/6] arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions Amit Daniel Kachhap
2020-09-02 15:39 ` Dave Martin
2020-09-04 6:15 ` Amit Kachhap
2020-08-18 7:11 ` [PATCH v5 2/6] arm64: traps: Allow force_signal_inject to pass esr error code Amit Daniel Kachhap
2020-09-02 15:39 ` Dave Martin
2020-08-18 7:11 ` [PATCH v5 3/6] arm64: ptrauth: Introduce Armv8.3 pointer authentication enhancements Amit Daniel Kachhap
2020-09-02 15:39 ` Dave Martin [this message]
2020-08-18 7:11 ` [PATCH v5 4/6] arm64: cpufeature: Modify address authentication cpufeature to exact Amit Daniel Kachhap
2020-09-02 14:05 ` Suzuki K Poulose
2020-08-18 7:11 ` [PATCH v5 5/6] arm64: kprobe: disable probe of fault prone ptrauth instruction Amit Daniel Kachhap
2020-08-18 7:11 ` [PATCH v5 6/6] arm64: kprobe: clarify the comment of steppable hint instructions Amit Daniel Kachhap
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200902153926.GG6642@arm.com \
--to=dave.martin@arm.com \
--cc=Vincenzo.Frascino@arm.com \
--cc=amit.kachhap@arm.com \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=james.morse@arm.com \
--cc=keescook@chromium.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=suzuki.poulose@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).