Commit ec6e822d authored by Mark Rutland's avatar Mark Rutland Committed by Will Deacon
Browse files

arm64: expose user PAC bit positions via ptrace 



When pointer authentication is in use, data/instruction pointers have a
number of PAC bits inserted into them. The number and position of these
bits depends on the configured TCR_ELx.TxSZ and whether tagging is
enabled. ARMv8.3 allows tagging to differ for instruction and data
pointers.

For userspace debuggers to unwind the stack and/or to follow pointer
chains, they need to be able to remove the PAC bits before attempting to
use a pointer.

This patch adds a new structure with masks describing the location of
the PAC bits in userspace instruction and data pointers (i.e. those
addressable via TTBR0), which userspace can query via PTRACE_GETREGSET.
By clearing these bits from pointers (and replacing them with the value
of bit 55), userspace can acquire the PAC-less versions.

This new regset is exposed when the kernel is built with (user) pointer
authentication support, and the address authentication feature is
enabled. Otherwise, the regset is hidden.

Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarKristina Martsenko <kristina.martsenko@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Ramana Radhakrishnan <ramana.radhakrishnan@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
[will: Fix to use vabits_user instead of VA_BITS and rename macro]
Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
parent 75031975

arch/arm64/include/asm/memory.h

+3 −0
Original line number Diff line number Diff line
@@ -207,6 +207,9 @@ static inline unsigned long kaslr_offset(void) 
	return kimage_vaddr - KIMAGE_VADDR;

}



/* the actual size of a user virtual address */

extern u64			vabits_user;



/*

 * Allow all memory at the discovery stage. We will clip it later.

 */

arch/arm64/include/asm/pointer_auth.h

+8 −0
Original line number Diff line number Diff line
@@ -2,9 +2,11 @@ 
#ifndef __ASM_POINTER_AUTH_H

#define __ASM_POINTER_AUTH_H



#include <linux/bitops.h>

#include <linux/random.h>



#include <asm/cpufeature.h>

#include <asm/memory.h>

#include <asm/sysreg.h>



#ifdef CONFIG_ARM64_PTR_AUTH
@@ -61,6 +63,12 @@ static inline void ptrauth_keys_switch(struct ptrauth_keys *keys) 
		__ptrauth_key_install(APGA, keys->apga);

}



/*

 * The EL0 pointer bits used by a pointer authentication code.

 * This is dependent on TBI0 being enabled, or bits 63:56 would also apply.

 */

#define ptrauth_user_pac_mask()	GENMASK(54, vabits_user)



#define ptrauth_thread_init_user(tsk)					\

do {									\

	struct task_struct *__ptiu_tsk = (tsk);				\

arch/arm64/include/asm/processor.h

+0 −2
Original line number Diff line number Diff line
@@ -53,8 +53,6 @@ 
 */



#define DEFAULT_MAP_WINDOW_64	(UL(1) << VA_BITS)



extern u64 vabits_user;

#define TASK_SIZE_64		(UL(1) << vabits_user)



#ifdef CONFIG_COMPAT

arch/arm64/include/uapi/asm/ptrace.h

+7 −0
Original line number Diff line number Diff line
@@ -229,6 +229,13 @@ struct user_sve_header { 
		  SVE_PT_SVE_OFFSET + SVE_PT_SVE_SIZE(vq, flags)	\

		: SVE_PT_FPSIMD_OFFSET + SVE_PT_FPSIMD_SIZE(vq, flags))



/* pointer authentication masks (NT_ARM_PAC_MASK) */



struct user_pac_mask {

	__u64		data_mask;

	__u64		insn_mask;

};



#endif /* __ASSEMBLY__ */



#endif /* _UAPI__ASM_PTRACE_H */

arch/arm64/kernel/ptrace.c

+38 −0
Original line number Diff line number Diff line
@@ -46,6 +46,7 @@ 
#include <asm/debug-monitors.h>

#include <asm/fpsimd.h>

#include <asm/pgtable.h>

#include <asm/pointer_auth.h>

#include <asm/stacktrace.h>

#include <asm/syscall.h>

#include <asm/traps.h>
@@ -956,6 +957,30 @@ out: 


#endif /* CONFIG_ARM64_SVE */



#ifdef CONFIG_ARM64_PTR_AUTH

static int pac_mask_get(struct task_struct *target,

			const struct user_regset *regset,

			unsigned int pos, unsigned int count,

			void *kbuf, void __user *ubuf)

{

	/*

	 * The PAC bits can differ across data and instruction pointers

	 * depending on TCR_EL1.TBID*, which we may make use of in future, so

	 * we expose separate masks.

	 */

	unsigned long mask = ptrauth_user_pac_mask();

	struct user_pac_mask uregs = {

		.data_mask = mask,

		.insn_mask = mask,

	};



	if (!system_supports_address_auth())

		return -EINVAL;



	return user_regset_copyout(&pos, &count, &kbuf, &ubuf, &uregs, 0, -1);

}

#endif /* CONFIG_ARM64_PTR_AUTH */



enum aarch64_regset {

	REGSET_GPR,

	REGSET_FPR,
@@ -968,6 +993,9 @@ enum aarch64_regset { 
#ifdef CONFIG_ARM64_SVE

	REGSET_SVE,

#endif

#ifdef CONFIG_ARM64_PTR_AUTH

	REGSET_PAC_MASK,

#endif

};



static const struct user_regset aarch64_regsets[] = {
@@ -1037,6 +1065,16 @@ static const struct user_regset aarch64_regsets[] = { 
		.get_size = sve_get_size,

	},

#endif

#ifdef CONFIG_ARM64_PTR_AUTH

	[REGSET_PAC_MASK] = {

		.core_note_type = NT_ARM_PAC_MASK,

		.n = sizeof(struct user_pac_mask) / sizeof(u64),

		.size = sizeof(u64),

		.align = sizeof(u64),

		.get = pac_mask_get,

		/* this cannot be set dynamically */

	},

#endif

};



static const struct user_regset_view user_aarch64_view = {

CRA Git | Maintained and supported by SUSTech CRA and CCSE