Commit 766d95b1 authored by Boyan Karatotev's avatar Boyan Karatotev Committed by Will Deacon
Browse files

kselftests/arm64: add nop checks for PAuth tests 



PAuth adds sign/verify controls to enable and disable groups of
instructions in hardware for compatibility with libraries that do not
implement PAuth. The kernel always enables them if it detects PAuth.

Add a test that checks that each group of instructions is enabled, if the
kernel reports PAuth as detected.

Note: For groups, for the purpose of this patch, we intend instructions
that use a certain key.

Signed-off-by: default avatarBoyan Karatotev <boyan.karatotev@arm.com>
Reviewed-by: default avatarVincenzo Frascino <Vincenzo.Frascino@arm.com>
Reviewed-by: default avatarAmit Daniel Kachhap <amit.kachhap@arm.com>
Acked-by: default avatarShuah Khan <skhan@linuxfoundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20200918104715.182310-3-boian4o1@gmail.com


Signed-off-by: default avatarWill Deacon <will@kernel.org>
parent e74e1d55

tools/testing/selftests/arm64/pauth/.gitignore

+1 −0
Original line number Diff line number Diff line 
exec_target

pac

tools/testing/selftests/arm64/pauth/Makefile

+5 −2
Original line number Diff line number Diff line
@@ -12,7 +12,7 @@ pauth_cc_support := $(shell if ($(CC) $(CFLAGS) -march=armv8.3-a -E -x c /dev/nu 


ifeq ($(pauth_cc_support),1)

TEST_GEN_PROGS := pac

TEST_GEN_FILES := pac_corruptor.o

TEST_GEN_FILES := pac_corruptor.o helper.o

endif



include ../../lib.mk
@@ -23,10 +23,13 @@ ifeq ($(pauth_cc_support),1) 
$(OUTPUT)/pac_corruptor.o: pac_corruptor.S

	$(CC) -c $^ -o $@ $(CFLAGS) -march=armv8.3-a



$(OUTPUT)/helper.o: helper.c

	$(CC) -c $^ -o $@ $(CFLAGS) -march=armv8.3-a



# when -mbranch-protection is enabled and the target architecture is ARMv8.3 or

# greater, gcc emits pac* instructions which are not in HINT NOP space,

# preventing the tests from occurring at all. Compile for ARMv8.2 so tests can

# run on earlier targets and print a meaningful error messages

$(OUTPUT)/pac: pac.c $(OUTPUT)/pac_corruptor.o

$(OUTPUT)/pac: pac.c $(OUTPUT)/pac_corruptor.o $(OUTPUT)/helper.o

	$(CC) $^ -o $@ $(CFLAGS) -march=armv8.2-a

endif

tools/testing/selftests/arm64/pauth/helper.c

0 → 100644
+39 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

// Copyright (C) 2020 ARM Limited



#include "helper.h"



size_t keyia_sign(size_t ptr)

{

	asm volatile("paciza %0" : "+r" (ptr));

	return ptr;

}



size_t keyib_sign(size_t ptr)

{

	asm volatile("pacizb %0" : "+r" (ptr));

	return ptr;

}



size_t keyda_sign(size_t ptr)

{

	asm volatile("pacdza %0" : "+r" (ptr));

	return ptr;

}



size_t keydb_sign(size_t ptr)

{

	asm volatile("pacdzb %0" : "+r" (ptr));

	return ptr;

}



size_t keyg_sign(size_t ptr)

{

	/* output is encoded in the upper 32 bits */

	size_t dest = 0;

	size_t modifier = 0;



	asm volatile("pacga %0, %1, %2" : "=r" (dest) : "r" (ptr), "r" (modifier));



	return dest;

}

tools/testing/selftests/arm64/pauth/helper.h

+9 −0
Original line number Diff line number Diff line
@@ -4,6 +4,15 @@ 
#ifndef _HELPER_H_

#define _HELPER_H_



#include <stdlib.h>



void pac_corruptor(void);



/* PAuth sign a value with key ia and modifier value 0 */

size_t keyia_sign(size_t val);

size_t keyib_sign(size_t val);

size_t keyda_sign(size_t val);

size_t keydb_sign(size_t val);

size_t keyg_sign(size_t val);



#endif

tools/testing/selftests/arm64/pauth/pac.c

+51 −0
Original line number Diff line number Diff line
@@ -8,12 +8,25 @@ 
#include "../../kselftest_harness.h"

#include "helper.h"



#define PAC_COLLISION_ATTEMPTS 10

/*

 * The kernel sets TBID by default. So bits 55 and above should remain

 * untouched no matter what.

 * The VA space size is 48 bits. Bigger is opt-in.

 */

#define PAC_MASK (~0xff80ffffffffffff)

#define ASSERT_PAUTH_ENABLED() \

do { \

	unsigned long hwcaps = getauxval(AT_HWCAP); \

	/* data key instructions are not in NOP space. This prevents a SIGILL */ \

	ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled"); \

} while (0)

#define ASSERT_GENERIC_PAUTH_ENABLED() \

do { \

	unsigned long hwcaps = getauxval(AT_HWCAP); \

	/* generic key instructions are not in NOP space. This prevents a SIGILL */ \

	ASSERT_NE(0, hwcaps & HWCAP_PACG) TH_LOG("Generic PAUTH not enabled"); \

} while (0)



sigjmp_buf jmpbuf;

void pac_signal_handler(int signum, siginfo_t *si, void *uc)
@@ -41,4 +54,42 @@ TEST(corrupt_pac) 
	}

}



/*

 * There are no separate pac* and aut* controls so checking only the pac*

 * instructions is sufficient

 */

TEST(pac_instructions_not_nop)

{

	size_t keyia = 0;

	size_t keyib = 0;

	size_t keyda = 0;

	size_t keydb = 0;



	ASSERT_PAUTH_ENABLED();



	for (int i = 0; i < PAC_COLLISION_ATTEMPTS; i++) {

		keyia |= keyia_sign(i) & PAC_MASK;

		keyib |= keyib_sign(i) & PAC_MASK;

		keyda |= keyda_sign(i) & PAC_MASK;

		keydb |= keydb_sign(i) & PAC_MASK;

	}



	ASSERT_NE(0, keyia) TH_LOG("keyia instructions did nothing");

	ASSERT_NE(0, keyib) TH_LOG("keyib instructions did nothing");

	ASSERT_NE(0, keyda) TH_LOG("keyda instructions did nothing");

	ASSERT_NE(0, keydb) TH_LOG("keydb instructions did nothing");

}



TEST(pac_instructions_not_nop_generic)

{

	size_t keyg = 0;



	ASSERT_GENERIC_PAUTH_ENABLED();



	for (int i = 0; i < PAC_COLLISION_ATTEMPTS; i++)

		keyg |= keyg_sign(i) & PAC_MASK;



	ASSERT_NE(0, keyg)  TH_LOG("keyg instructions did nothing");

}



TEST_HARNESS_MAIN

CRA Git | Maintained and supported by SUSTech CRA and CCSE