From: Kristina Martsenko <kristina.martsenko@arm.com> To: linux-arm-kernel@lists.infradead.org Cc: Adam Wallis <awallis@codeaurora.org>, Amit Kachhap <Amit.Kachhap@arm.com>, Andrew Jones <drjones@redhat.com>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, Arnd Bergmann <arnd@arndb.de>, Catalin Marinas <catalin.marinas@arm.com>, Christoffer Dall <christoffer.dall@arm.com>, Dave P Martin <Dave.Martin@arm.com>, Jacob Bramley <jacob.bramley@arm.com>, Kees Cook <keescook@chromium.org>, Marc Zyngier <marc.zyngier@arm.com>, Mark Rutland <mark.rutland@arm.com>, Ramana Radhakrishnan <ramana.radhakrishnan@arm.com>, "Suzuki K . Poulose" <suzuki.poulose@arm.com>, Will Deacon <will.deacon@arm.com>, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v5 03/17] arm64/kvm: hide ptrauth from guests Date: Fri, 5 Oct 2018 09:47:40 +0100 [thread overview] Message-ID: <20181005084754.20950-4-kristina.martsenko@arm.com> (raw) In-Reply-To: <20181005084754.20950-1-kristina.martsenko@arm.com> From: Mark Rutland <mark.rutland@arm.com> In subsequent patches we're going to expose ptrauth to the host kernel and userspace, but things are a bit trickier for guest kernels. For the time being, let's hide ptrauth from KVM guests. Regardless of how well-behaved the guest kernel is, guest userspace could attempt to use ptrauth instructions, triggering a trap to EL2, resulting in noise from kvm_handle_unknown_ec(). So let's write up a handler for the PAC trap, which silently injects an UNDEF into the guest, as if the feature were really missing. Signed-off-by: Mark Rutland <mark.rutland@arm.com> [kristina: fix comment] Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Christoffer Dall <christoffer.dall@arm.com> Cc: Marc Zyngier <marc.zyngier@arm.com> Cc: kvmarm@lists.cs.columbia.edu --- arch/arm64/kvm/handle_exit.c | 18 ++++++++++++++++++ arch/arm64/kvm/sys_regs.c | 8 ++++++++ 2 files changed, 26 insertions(+) diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c index e5e741bfffe1..53759b3c165d 100644 --- a/arch/arm64/kvm/handle_exit.c +++ b/arch/arm64/kvm/handle_exit.c @@ -173,6 +173,23 @@ static int handle_sve(struct kvm_vcpu *vcpu, struct kvm_run *run) return 1; } +/* + * Guest usage of a ptrauth instruction (which the guest EL1 did not turn into + * a NOP). + */ +static int kvm_handle_ptrauth(struct kvm_vcpu *vcpu, struct kvm_run *run) +{ + /* + * We don't currently support ptrauth in a guest, and we mask the ID + * registers to prevent well-behaved guests from trying to make use of + * it. + * + * Inject an UNDEF, as if the feature really isn't present. + */ + kvm_inject_undefined(vcpu); + return 1; +} + static exit_handle_fn arm_exit_handlers[] = { [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec, [ESR_ELx_EC_WFx] = kvm_handle_wfx, @@ -195,6 +212,7 @@ static exit_handle_fn arm_exit_handlers[] = { [ESR_ELx_EC_BKPT32] = kvm_handle_guest_debug, [ESR_ELx_EC_BRK64] = kvm_handle_guest_debug, [ESR_ELx_EC_FP_ASIMD] = handle_no_fpsimd, + [ESR_ELx_EC_PAC] = kvm_handle_ptrauth, }; static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 22fbbdbece3c..1ca592d38c3c 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -1040,6 +1040,14 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz) kvm_debug("SVE unsupported for guests, suppressing\n"); val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT); + } else if (id == SYS_ID_AA64ISAR1_EL1) { + const u64 ptrauth_mask = (0xfUL << ID_AA64ISAR1_APA_SHIFT) | + (0xfUL << ID_AA64ISAR1_API_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPA_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPI_SHIFT); + if (val & ptrauth_mask) + kvm_debug("ptrauth unsupported for guests, suppressing\n"); + val &= ~ptrauth_mask; } else if (id == SYS_ID_AA64MMFR1_EL1) { if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT)) kvm_debug("LORegions unsupported for guests, suppressing\n"); -- 2.11.0
WARNING: multiple messages have this Message-ID (diff)
From: kristina.martsenko@arm.com (Kristina Martsenko) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v5 03/17] arm64/kvm: hide ptrauth from guests Date: Fri, 5 Oct 2018 09:47:40 +0100 [thread overview] Message-ID: <20181005084754.20950-4-kristina.martsenko@arm.com> (raw) In-Reply-To: <20181005084754.20950-1-kristina.martsenko@arm.com> From: Mark Rutland <mark.rutland@arm.com> In subsequent patches we're going to expose ptrauth to the host kernel and userspace, but things are a bit trickier for guest kernels. For the time being, let's hide ptrauth from KVM guests. Regardless of how well-behaved the guest kernel is, guest userspace could attempt to use ptrauth instructions, triggering a trap to EL2, resulting in noise from kvm_handle_unknown_ec(). So let's write up a handler for the PAC trap, which silently injects an UNDEF into the guest, as if the feature were really missing. Signed-off-by: Mark Rutland <mark.rutland@arm.com> [kristina: fix comment] Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Christoffer Dall <christoffer.dall@arm.com> Cc: Marc Zyngier <marc.zyngier@arm.com> Cc: kvmarm at lists.cs.columbia.edu --- arch/arm64/kvm/handle_exit.c | 18 ++++++++++++++++++ arch/arm64/kvm/sys_regs.c | 8 ++++++++ 2 files changed, 26 insertions(+) diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c index e5e741bfffe1..53759b3c165d 100644 --- a/arch/arm64/kvm/handle_exit.c +++ b/arch/arm64/kvm/handle_exit.c @@ -173,6 +173,23 @@ static int handle_sve(struct kvm_vcpu *vcpu, struct kvm_run *run) return 1; } +/* + * Guest usage of a ptrauth instruction (which the guest EL1 did not turn into + * a NOP). + */ +static int kvm_handle_ptrauth(struct kvm_vcpu *vcpu, struct kvm_run *run) +{ + /* + * We don't currently support ptrauth in a guest, and we mask the ID + * registers to prevent well-behaved guests from trying to make use of + * it. + * + * Inject an UNDEF, as if the feature really isn't present. + */ + kvm_inject_undefined(vcpu); + return 1; +} + static exit_handle_fn arm_exit_handlers[] = { [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec, [ESR_ELx_EC_WFx] = kvm_handle_wfx, @@ -195,6 +212,7 @@ static exit_handle_fn arm_exit_handlers[] = { [ESR_ELx_EC_BKPT32] = kvm_handle_guest_debug, [ESR_ELx_EC_BRK64] = kvm_handle_guest_debug, [ESR_ELx_EC_FP_ASIMD] = handle_no_fpsimd, + [ESR_ELx_EC_PAC] = kvm_handle_ptrauth, }; static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 22fbbdbece3c..1ca592d38c3c 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -1040,6 +1040,14 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz) kvm_debug("SVE unsupported for guests, suppressing\n"); val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT); + } else if (id == SYS_ID_AA64ISAR1_EL1) { + const u64 ptrauth_mask = (0xfUL << ID_AA64ISAR1_APA_SHIFT) | + (0xfUL << ID_AA64ISAR1_API_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPA_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPI_SHIFT); + if (val & ptrauth_mask) + kvm_debug("ptrauth unsupported for guests, suppressing\n"); + val &= ~ptrauth_mask; } else if (id == SYS_ID_AA64MMFR1_EL1) { if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT)) kvm_debug("LORegions unsupported for guests, suppressing\n"); -- 2.11.0
next prev parent reply other threads:[~2018-10-05 8:49 UTC|newest] Thread overview: 161+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-10-05 8:47 [PATCH 00/17] ARMv8.3 pointer authentication support Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 01/17] arm64: add pointer authentication register bits Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-11 16:28 ` Will Deacon 2018-10-11 16:28 ` Will Deacon 2018-10-12 8:53 ` Mark Rutland 2018-10-12 8:53 ` Mark Rutland 2018-10-12 8:56 ` Will Deacon 2018-10-12 8:56 ` Will Deacon 2018-10-12 9:50 ` Mark Rutland 2018-10-12 9:50 ` Mark Rutland 2018-10-05 8:47 ` [PATCH v5 02/17] arm64/kvm: consistently handle host HCR_EL2 flags Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko [this message] 2018-10-05 8:47 ` [PATCH v5 03/17] arm64/kvm: hide ptrauth from guests Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 04/17] arm64: Don't trap host pointer auth use to EL2 Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 05/17] arm64/cpufeature: detect pointer authentication Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 06/17] asm-generic: mm_hooks: allow hooks to be overridden individually Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 07/17] arm64: add basic pointer authentication support Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-11 16:00 ` Suzuki K Poulose 2018-10-11 16:00 ` Suzuki K Poulose 2018-10-19 11:15 ` Catalin Marinas 2018-10-19 11:15 ` Catalin Marinas 2018-10-19 11:15 ` Catalin Marinas 2018-10-19 11:24 ` Will Deacon 2018-10-19 11:24 ` Will Deacon 2018-10-19 15:36 ` Kees Cook 2018-10-19 15:36 ` Kees Cook 2018-10-19 15:36 ` Kees Cook 2018-10-19 15:49 ` Will Deacon 2018-10-19 15:49 ` Will Deacon 2018-10-19 15:49 ` Will Deacon 2018-10-19 16:05 ` Kees Cook 2018-10-19 16:05 ` Kees Cook 2018-10-19 16:05 ` Kees Cook 2018-10-19 16:16 ` Will Deacon 2018-10-19 16:16 ` Will Deacon 2018-10-19 16:16 ` Will Deacon 2018-10-19 15:54 ` Mark Rutland 2018-10-19 15:54 ` Mark Rutland 2018-10-19 15:54 ` Mark Rutland 2018-10-19 16:49 ` Cyrill Gorcunov 2018-10-19 16:49 ` Cyrill Gorcunov 2018-10-19 16:49 ` Cyrill Gorcunov 2018-11-14 18:11 ` Will Deacon 2018-11-14 18:11 ` Will Deacon 2018-11-15 10:25 ` Dave Martin 2018-11-15 10:25 ` Dave Martin 2018-10-23 8:36 ` Ramana Radhakrishnan 2018-10-23 8:36 ` Ramana Radhakrishnan 2018-10-23 8:36 ` Ramana Radhakrishnan 2018-10-23 8:36 ` Ramana Radhakrishnan 2018-10-23 10:20 ` Will Deacon 2018-10-23 10:20 ` Will Deacon 2018-10-23 10:20 ` Will Deacon 2018-10-23 10:20 ` Will Deacon 2018-10-05 8:47 ` [PATCH v5 08/17] arm64: expose user PAC bit positions via ptrace Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 09/17] arm64: perf: strip PAC when unwinding userspace Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 10/17] arm64: enable pointer authentication Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [PATCH v5 11/17] arm64: docs: document " Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 9:04 ` Ramana Radhakrishnan 2018-10-05 9:04 ` Ramana Radhakrishnan 2018-10-05 9:04 ` Ramana Radhakrishnan 2018-10-16 16:14 ` Kristina Martsenko 2018-10-16 16:14 ` Kristina Martsenko 2018-10-16 16:14 ` Kristina Martsenko 2018-10-19 11:35 ` Catalin Marinas 2018-10-19 11:35 ` Catalin Marinas 2018-10-19 11:35 ` Catalin Marinas 2018-10-19 11:35 ` Catalin Marinas 2018-10-19 11:47 ` Marc Zyngier 2018-10-19 11:47 ` Marc Zyngier 2018-10-19 11:47 ` Marc Zyngier 2018-10-19 11:47 ` Marc Zyngier 2018-10-19 12:22 ` Will Deacon 2018-10-19 12:22 ` Will Deacon 2018-10-19 12:22 ` Will Deacon 2018-10-19 12:22 ` Will Deacon 2018-10-19 14:42 ` Kristina Martsenko 2018-10-19 14:42 ` Kristina Martsenko 2018-10-19 14:42 ` Kristina Martsenko 2018-10-19 14:42 ` Kristina Martsenko 2018-10-19 15:10 ` Catalin Marinas 2018-10-19 15:10 ` Catalin Marinas 2018-10-19 15:10 ` Catalin Marinas 2018-10-19 15:10 ` Catalin Marinas 2018-10-19 17:45 ` Will Deacon 2018-10-19 17:45 ` Will Deacon 2018-10-19 17:45 ` Will Deacon 2018-10-19 17:45 ` Will Deacon 2018-11-02 6:02 ` Jon Masters 2018-11-02 6:02 ` Jon Masters 2018-11-02 6:02 ` Jon Masters 2018-11-02 6:02 ` Jon Masters 2018-10-24 10:56 ` Ramana Radhakrishnan 2018-10-24 10:56 ` Ramana Radhakrishnan 2018-10-24 10:56 ` Ramana Radhakrishnan 2018-10-15 22:35 ` Kees Cook 2018-10-15 22:35 ` Kees Cook 2018-11-02 9:46 ` Ramana Radhakrishnan 2018-11-02 9:46 ` Ramana Radhakrishnan 2018-11-02 9:46 ` Ramana Radhakrishnan 2018-10-05 8:47 ` [RFC 12/17] arm64: move ptrauth keys to thread_info Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-19 11:38 ` Catalin Marinas 2018-10-19 11:38 ` Catalin Marinas 2018-10-05 8:47 ` [RFC 13/17] arm64: install user ptrauth keys at kernel exit time Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [RFC 14/17] arm64: unwind: strip PAC from kernel addresses Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 8:47 ` [RFC 15/17] arm64: enable ptrauth earlier Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-06 12:51 ` Amit Kachhap 2018-10-06 12:51 ` Amit Kachhap 2018-10-05 8:47 ` [RFC 16/17] arm64: initialize and switch ptrauth kernel keys Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-06 12:56 ` Amit Kachhap 2018-10-06 12:56 ` Amit Kachhap 2018-10-05 8:47 ` [RFC 17/17] arm64: compile the kernel with ptrauth -msign-return-address Kristina Martsenko 2018-10-05 8:47 ` Kristina Martsenko 2018-10-05 9:01 ` Ramana Radhakrishnan 2018-10-05 9:01 ` Ramana Radhakrishnan 2018-10-05 9:01 ` Ramana Radhakrishnan 2018-10-11 14:00 ` Kristina Martsenko 2018-10-11 14:00 ` Kristina Martsenko 2018-10-11 14:00 ` Kristina Martsenko 2018-10-11 14:23 ` Vladimir Murzin 2018-10-11 14:23 ` Vladimir Murzin 2018-10-15 22:38 ` Kees Cook 2018-10-15 22:38 ` Kees Cook 2018-10-15 22:38 ` Kees Cook 2018-10-15 22:42 ` [PATCH 00/17] ARMv8.3 pointer authentication support Kees Cook 2018-10-15 22:42 ` Kees Cook 2018-11-13 16:17 ` Kristina Martsenko 2018-11-13 16:17 ` Kristina Martsenko 2018-11-13 23:09 ` Kees Cook 2018-11-13 23:09 ` Kees Cook 2018-11-14 15:54 ` Kristina Martsenko 2018-11-14 15:54 ` Kristina Martsenko 2018-11-14 21:47 ` Mark Rutland 2018-11-14 21:47 ` Mark Rutland 2018-11-14 22:48 ` Kees Cook 2018-11-14 22:48 ` Kees Cook 2018-11-14 22:48 ` Kees Cook 2018-10-19 12:36 ` Will Deacon 2018-10-19 12:36 ` Will Deacon 2018-10-23 8:39 ` Ramana Radhakrishnan 2018-10-23 8:39 ` Ramana Radhakrishnan 2018-10-23 8:39 ` Ramana Radhakrishnan 2018-10-23 8:39 ` Ramana Radhakrishnan
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181005084754.20950-4-kristina.martsenko@arm.com \ --to=kristina.martsenko@arm.com \ --cc=Amit.Kachhap@arm.com \ --cc=Dave.Martin@arm.com \ --cc=ard.biesheuvel@linaro.org \ --cc=arnd@arndb.de \ --cc=awallis@codeaurora.org \ --cc=catalin.marinas@arm.com \ --cc=christoffer.dall@arm.com \ --cc=drjones@redhat.com \ --cc=jacob.bramley@arm.com \ --cc=keescook@chromium.org \ --cc=kvmarm@lists.cs.columbia.edu \ --cc=linux-arch@vger.kernel.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=marc.zyngier@arm.com \ --cc=mark.rutland@arm.com \ --cc=ramana.radhakrishnan@arm.com \ --cc=suzuki.poulose@arm.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.