Commit 33e45234 authored by Kristina Martsenko's avatar Kristina Martsenko Committed by Catalin Marinas
Browse files

arm64: initialize and switch ptrauth kernel keys 



Set up keys to use pointer authentication within the kernel. The kernel
will be compiled with APIAKey instructions, the other keys are currently
unused. Each task is given its own APIAKey, which is initialized during
fork. The key is changed during context switch and on kernel entry from
EL0.

The keys for idle threads need to be set before calling any C functions,
because it is not possible to enter and exit a function with different
keys.

Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Reviewed-by: default avatarVincenzo Frascino <Vincenzo.Frascino@arm.com>
Signed-off-by: default avatarKristina Martsenko <kristina.martsenko@arm.com>
[Amit: Modified secondary cores key structure, comments]
Signed-off-by: default avatarAmit Daniel Kachhap <amit.kachhap@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 6982934e

arch/arm64/include/asm/asm_pointer_auth.h

+14 −0
Original line number Diff line number Diff line
@@ -39,11 +39,25 @@ alternative_if ARM64_HAS_GENERIC_AUTH 
alternative_else_nop_endif

	.endm



	.macro ptrauth_keys_install_kernel tsk, tmp1, tmp2, tmp3

alternative_if ARM64_HAS_ADDRESS_AUTH

	mov	\tmp1, #THREAD_KEYS_KERNEL

	add	\tmp1, \tsk, \tmp1

	ldp	\tmp2, \tmp3, [\tmp1, #PTRAUTH_KERNEL_KEY_APIA]

	msr_s	SYS_APIAKEYLO_EL1, \tmp2

	msr_s	SYS_APIAKEYHI_EL1, \tmp3

	isb

alternative_else_nop_endif

	.endm



#else /* CONFIG_ARM64_PTR_AUTH */



	.macro ptrauth_keys_install_user tsk, tmp1, tmp2, tmp3

	.endm



	.macro ptrauth_keys_install_kernel tsk, tmp1, tmp2, tmp3

	.endm



#endif /* CONFIG_ARM64_PTR_AUTH */



#endif /* __ASM_ASM_POINTER_AUTH_H */

arch/arm64/include/asm/pointer_auth.h

+13 −0
Original line number Diff line number Diff line
@@ -30,6 +30,10 @@ struct ptrauth_keys_user { 
	struct ptrauth_key apga;

};



struct ptrauth_keys_kernel {

	struct ptrauth_key apia;

};



static inline void ptrauth_keys_init_user(struct ptrauth_keys_user *keys)

{

	if (system_supports_address_auth()) {
@@ -50,6 +54,12 @@ do { \ 
	write_sysreg_s(__pki_v.hi, SYS_ ## k ## KEYHI_EL1);	\

} while (0)



static inline void ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)

{

	if (system_supports_address_auth())

		get_random_bytes(&keys->apia, sizeof(keys->apia));

}



extern int ptrauth_prctl_reset_keys(struct task_struct *tsk, unsigned long arg);



/*
@@ -66,11 +76,14 @@ static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr) 


#define ptrauth_thread_init_user(tsk)					\

	ptrauth_keys_init_user(&(tsk)->thread.keys_user)

#define ptrauth_thread_init_kernel(tsk)					\

	ptrauth_keys_init_kernel(&(tsk)->thread.keys_kernel)



#else /* CONFIG_ARM64_PTR_AUTH */

#define ptrauth_prctl_reset_keys(tsk, arg)	(-EINVAL)

#define ptrauth_strip_insn_pac(lr)	(lr)

#define ptrauth_thread_init_user(tsk)

#define ptrauth_thread_init_kernel(tsk)

#endif /* CONFIG_ARM64_PTR_AUTH */



#endif /* __ASM_POINTER_AUTH_H */

arch/arm64/include/asm/processor.h

+1 −0
Original line number Diff line number Diff line
@@ -147,6 +147,7 @@ struct thread_struct { 
	struct debug_info	debug;		/* debugging */

#ifdef CONFIG_ARM64_PTR_AUTH

	struct ptrauth_keys_user	keys_user;

	struct ptrauth_keys_kernel	keys_kernel;

#endif

};

arch/arm64/include/asm/smp.h

+4 −0
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
#include <linux/threads.h>

#include <linux/cpumask.h>

#include <linux/thread_info.h>

#include <asm/pointer_auth.h>



DECLARE_PER_CPU_READ_MOSTLY(int, cpu_number);
@@ -95,6 +96,9 @@ asmlinkage void secondary_start_kernel(void); 
struct secondary_data {

	void *stack;

	struct task_struct *task;

#ifdef CONFIG_ARM64_PTR_AUTH

	struct ptrauth_keys_kernel ptrauth_key;

#endif

	long status;

};

arch/arm64/kernel/asm-offsets.c

+5 −0
Original line number Diff line number Diff line
@@ -42,6 +42,7 @@ int main(void) 
  DEFINE(THREAD_CPU_CONTEXT,	offsetof(struct task_struct, thread.cpu_context));

#ifdef CONFIG_ARM64_PTR_AUTH

  DEFINE(THREAD_KEYS_USER,	offsetof(struct task_struct, thread.keys_user));

  DEFINE(THREAD_KEYS_KERNEL,	offsetof(struct task_struct, thread.keys_kernel));

#endif

  BLANK();

  DEFINE(S_X0,			offsetof(struct pt_regs, regs[0]));
@@ -91,6 +92,9 @@ int main(void) 
  BLANK();

  DEFINE(CPU_BOOT_STACK,	offsetof(struct secondary_data, stack));

  DEFINE(CPU_BOOT_TASK,		offsetof(struct secondary_data, task));

#ifdef CONFIG_ARM64_PTR_AUTH

  DEFINE(CPU_BOOT_PTRAUTH_KEY,	offsetof(struct secondary_data, ptrauth_key));

#endif

  BLANK();

#ifdef CONFIG_KVM_ARM_HOST

  DEFINE(VCPU_CONTEXT,		offsetof(struct kvm_vcpu, arch.ctxt));
@@ -137,6 +141,7 @@ int main(void) 
  DEFINE(PTRAUTH_USER_KEY_APDA,		offsetof(struct ptrauth_keys_user, apda));

  DEFINE(PTRAUTH_USER_KEY_APDB,		offsetof(struct ptrauth_keys_user, apdb));

  DEFINE(PTRAUTH_USER_KEY_APGA,		offsetof(struct ptrauth_keys_user, apga));

  DEFINE(PTRAUTH_KERNEL_KEY_APIA,	offsetof(struct ptrauth_keys_kernel, apia));

  BLANK();

#endif

  return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE