[PATCH 0/4] arm64: align KPTI interface with x86

[PATCH 0/4] arm64: align KPTI interface with x86

[Mark Langsdorf]

ARM64 supports KPTI, but is missing some user interface features such as
a debugfs entry compared to the x86 implementation.

Add the nopti argument, update the documentation so that ARM64 as well
as x86 supports nopti and kpti, and add a debugfs entry to check the
status of the kpti on a running machine.

--Mark Langsdorf

[PATCH 1/4] arm64: capabilities: add nopti command line argument

[Mark Langsdorf]

The x86 kernel and the documentation use 'nopti' as the kernel command
line argument to disable kernel page table isolation, so add nopti to
the arm64 kernel for compatibility.

Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
---
 Documentation/admin-guide/kernel-parameters.txt |  6 +++---
 arch/arm64/kernel/cpufeature.c                  | 11 ++++++++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index f2040d4..a987725 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3342,8 +3342,8 @@
 	pt.		[PARIDE]
 			See Documentation/blockdev/paride.txt.
 
-	pti=		[X86_64] Control Page Table Isolation of user and
-			kernel address spaces.  Disabling this feature
+	pti=		[X86_64, ARM64] Control Page Table Isolation of user
+			and kernel address spaces.  Disabling this feature
 			removes hardening, but improves performance of
 			system calls and interrupts.
 
@@ -3354,7 +3354,7 @@
 
 			Not specifying this option is equivalent to pti=auto.
 
-	nopti		[X86_64]
+	nopti		[X86_64, ARM64]
 			Equivalent to pti=off
 
 	pty.legacy_count=
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 9d1b06d..7c5d8712 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -934,10 +934,19 @@ static int __init parse_kpti(char *str)
 	if (ret)
 		return ret;
 
-	__kpti_forced = enabled ? 1 : -1;
+	if (!__kpti_forced)
+		__kpti_forced = enabled ? 1 : -1;
 	return 0;
 }
 __setup("kpti=", parse_kpti);
+
+/* for compatibility with documentation and x86 nopti command line arg */
+static int __init force_nokpti(char *arg)
+{
+	__kpti_forced = -1;
+	return 0;
+}
+early_param("nopti", force_nokpti);
 #endif	/* CONFIG_UNMAP_KERNEL_AT_EL0 */
 
 #ifdef CONFIG_ARM64_HW_AFDBM
-- 
2.9.5

[PATCH 2/4] arm64: kdebugfs: create arm64 debugfs directory

[Mark Langsdorf]

Create debugfs directory for arm64, like the existing one for x86.

Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
---
 arch/arm64/kernel/Makefile   |  3 ++-
 arch/arm64/kernel/kdebugfs.c | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 arch/arm64/kernel/kdebugfs.c

diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index bf825f3..a48b298 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -18,7 +18,8 @@ arm64-obj-y		:= debug-monitors.o entry.o irq.o fpsimd.o		\
 			   hyp-stub.o psci.o cpu_ops.o insn.o	\
 			   return_address.o cpuinfo.o cpu_errata.o		\
 			   cpufeature.o alternative.o cacheinfo.o		\
-			   smp.o smp_spin_table.o topology.o smccc-call.o
+			   smp.o smp_spin_table.o topology.o smccc-call.o	\
+			   kdebugfs.o
 
 extra-$(CONFIG_EFI)			:= efi-entry.o
 
diff --git a/arch/arm64/kernel/kdebugfs.c b/arch/arm64/kernel/kdebugfs.c
new file mode 100644
index 0000000..e1e3332
--- /dev/null
+++ b/arch/arm64/kernel/kdebugfs.c
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Architecture specific debugfs files
+ *
+ * Copyright (C) 2018 Red Hat, Inc.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/export.h>
+#include <linux/init.h>
+
+struct dentry *arch_debugfs_dir;
+EXPORT_SYMBOL(arch_debugfs_dir);
+
+static int __init arch_kdebugfs_init(void)
+{
+	int error = 0;
+
+	arch_debugfs_dir = debugfs_create_dir("arm64", NULL);
+	if (IS_ERR(arch_debugfs_dir)) {
+		arch_debugfs_dir = NULL;
+		return -ENOMEM;
+	}
+
+	return error;
+}
+postcore_initcall(arch_kdebugfs_init);
-- 
2.9.5

[PATCH 3/4] arm64: cpufeature: add debugfs interface for KPTI

[Mark Langsdorf]

Add a debugfs interface to check if KPTI is enabled or disabled:
  cat /sys/kernel/debug/arm64/pti_enabled

Slightly rework unmap_kernel_at_el0 logic to simplify calculating if
KPTI is enabled.

Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
---
 arch/arm64/kernel/cpufeature.c | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 7c5d8712..697a6ef 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -24,6 +24,7 @@
 #include <linux/stop_machine.h>
 #include <linux/types.h>
 #include <linux/mm.h>
+#include <linux/debugfs.h>
 #include <asm/cpu.h>
 #include <asm/cpufeature.h>
 #include <asm/cpu_ops.h>
@@ -860,6 +861,7 @@ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
 
 #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
 static int __kpti_forced; /* 0: not forced, >0: forced on, <0: forced off */
+static bool __pti_enabled;
 
 static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
 				int scope)
@@ -884,21 +886,21 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
 
 	/* Forced? */
 	if (__kpti_forced) {
+		__pti_enabled = __kpti_forced > 0;
 		pr_info_once("kernel page table isolation forced %s by %s\n",
-			     __kpti_forced > 0 ? "ON" : "OFF", str);
-		return __kpti_forced > 0;
+			     __pti_enabled ? "ON" : "OFF", str);
 	}
-
 	/* Useful for KASLR robustness */
-	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
-		return true;
-
+	else if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
+		__pti_enabled = true;
 	/* Don't force KPTI for CPUs that are not vulnerable */
-	if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
-		return false;
-
+	else if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
+		__pti_enabled = false;
 	/* Defer to CPU feature registers */
-	return !has_cpuid_feature(entry, scope);
+	else
+		__pti_enabled = !has_cpuid_feature(entry, scope);
+
+	return __pti_enabled;
 }
 
 static void
@@ -947,6 +949,14 @@ static int __init force_nokpti(char *arg)
 	return 0;
 }
 early_param("nopti", force_nokpti);
+
+static int __init create_kpti_enabled(void)
+{
+	debugfs_create_bool("pti_enabled", S_IRUSR,
+			   arch_debugfs_dir, &__pti_enabled);
+	return 0;
+}
+late_initcall(create_kpti_enabled);
 #endif	/* CONFIG_UNMAP_KERNEL_AT_EL0 */
 
 #ifdef CONFIG_ARM64_HW_AFDBM
-- 
2.9.5

[PATCH 4/4] arm64: cpufeature: always log KPTI setting on boot

[Mark Langsdorf]

Always log KPTI setting at boot time, whether or not KPTI was forced
by a kernel parameter.

Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
---
 arch/arm64/kernel/cpufeature.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 697a6ef..e50bf3c 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -889,16 +889,20 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
 		__pti_enabled = __kpti_forced > 0;
 		pr_info_once("kernel page table isolation forced %s by %s\n",
 			     __pti_enabled ? "ON" : "OFF", str);
+	} else {
+		/* Useful for KASLR robustness */
+		if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
+			__pti_enabled = true;
+		/* Don't force KPTI for CPUs that are not vulnerable */
+		else if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
+			__pti_enabled = false;
+		/* Defer to CPU feature registers */
+		else
+			__pti_enabled = !has_cpuid_feature(entry, scope);
+
+		pr_info_once("kernel page table isolation %s by %s\n",
+			    __pti_enabled ? "ON" : "OFF", str);
 	}
-	/* Useful for KASLR robustness */
-	else if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
-		__pti_enabled = true;
-	/* Don't force KPTI for CPUs that are not vulnerable */
-	else if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
-		__pti_enabled = false;
-	/* Defer to CPU feature registers */
-	else
-		__pti_enabled = !has_cpuid_feature(entry, scope);
 
 	return __pti_enabled;
 }
-- 
2.9.5

[PATCH 4/4] arm64: cpufeature: always log KPTI setting on boot

[Laura Abbott]

On 05/24/2018 12:09 PM, Mark Langsdorf wrote:
> Always log KPTI setting at boot time, whether or not KPTI was forced
> by a kernel parameter.
> 
> Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
> ---
>   arch/arm64/kernel/cpufeature.c | 22 +++++++++++++---------
>   1 file changed, 13 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
> index 697a6ef..e50bf3c 100644
> --- a/arch/arm64/kernel/cpufeature.c
> +++ b/arch/arm64/kernel/cpufeature.c
> @@ -889,16 +889,20 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
>   		__pti_enabled = __kpti_forced > 0;
>   		pr_info_once("kernel page table isolation forced %s by %s\n",
>   			     __pti_enabled ? "ON" : "OFF", str);
> +	} else {
> +		/* Useful for KASLR robustness */
> +		if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
> +			__pti_enabled = true;
> +		/* Don't force KPTI for CPUs that are not vulnerable */
> +		else if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
> +			__pti_enabled = false;
> +		/* Defer to CPU feature registers */
> +		else
> +			__pti_enabled = !has_cpuid_feature(entry, scope);
> +
> +		pr_info_once("kernel page table isolation %s by %s\n",
> +			    __pti_enabled ? "ON" : "OFF", str);

I think this needs an update for the default logged, otherwise it
incorrectly states it was set by command line:

# dmesg | grep isolation
[    0.000000] CPU features: kernel page table isolation ON by command line option
[    0.000000] CPU features: detected: Kernel page table isolation (KPTI)
# cat /proc/cmdline
nokaslr slub_debug=- console=ttyAMA0 debug_pagealloc=on earlycon=pl011,0x9000000

>   	}
> -	/* Useful for KASLR robustness */
> -	else if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
> -		__pti_enabled = true;
> -	/* Don't force KPTI for CPUs that are not vulnerable */
> -	else if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
> -		__pti_enabled = false;
> -	/* Defer to CPU feature registers */
> -	else
> -		__pti_enabled = !has_cpuid_feature(entry, scope);
>   
>   	return __pti_enabled;
>   }
> 

[PATCH 0/4] arm64: align KPTI interface with x86

[Laura Abbott]

On 05/24/2018 12:09 PM, Mark Langsdorf wrote:
> ARM64 supports KPTI, but is missing some user interface features such as
> a debugfs entry compared to the x86 implementation.

I don't see an x86 debugfs entry for PTI, only the sysfs files. Was
this something that was discussed bug never merged?

Thanks,
Laura

[PATCH 1/4] arm64: capabilities: add nopti command line argument

[Suzuki K Poulose]

Hi Mark,

On 24/05/18 20:09, Mark Langsdorf wrote:
> The x86 kernel and the documentation use 'nopti' as the kernel command
> line argument to disable kernel page table isolation, so add nopti to
> the arm64 kernel for compatibility.
> 
> Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
> ---
>   Documentation/admin-guide/kernel-parameters.txt |  6 +++---
>   arch/arm64/kernel/cpufeature.c                  | 11 ++++++++++-
>   2 files changed, 13 insertions(+), 4 deletions(-)
> 
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index f2040d4..a987725 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -3342,8 +3342,8 @@
>   	pt.		[PARIDE]
>   			See Documentation/blockdev/paride.txt.
>   
> -	pti=		[X86_64] Control Page Table Isolation of user and
> -			kernel address spaces.  Disabling this feature
> +	pti=		[X86_64, ARM64] Control Page Table Isolation of user
> +			and kernel address spaces.  Disabling this feature
>   			removes hardening, but improves performance of
>   			system calls and interrupts.

...

>   
> @@ -3354,7 +3354,7 @@
>   
>   			Not specifying this option is equivalent to pti=auto.
>   
> -	nopti		[X86_64]
> +	nopti		[X86_64, ARM64]
>   			Equivalent to pti=off
>   
>   	pty.legacy_count=
> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
> index 9d1b06d..7c5d8712 100644
> --- a/arch/arm64/kernel/cpufeature.c
> +++ b/arch/arm64/kernel/cpufeature.c
> @@ -934,10 +934,19 @@ static int __init parse_kpti(char *str)
>   	if (ret)
>   		return ret;
>   
> -	__kpti_forced = enabled ? 1 : -1;
> +	if (!__kpti_forced)
> +		__kpti_forced = enabled ? 1 : -1;
>   	return 0;
>   }
>   __setup("kpti=", parse_kpti);

The arm64 kernel parameter is named "kpti", while the Documentation update above
says "pti". We may want to keep both in sync here.

> +
> +/* for compatibility with documentation and x86 nopti command line arg */
> +static int __init force_nokpti(char *arg)
> +{
> +	__kpti_forced = -1;
> +	return 0;
> +}
> +early_param("nopti", force_nokpti);
>   #endif	/* CONFIG_UNMAP_KERNEL_AT_EL0 */
>   
>   #ifdef CONFIG_ARM64_HW_AFDBM
> 


Suzuki

[PATCH 1/4] arm64: capabilities: add nopti command line argument

[Mark Langsdorf]

On 05/30/2018 03:59 AM, Suzuki K Poulose wrote:
> 
> 
> Hi Mark,
> 
> On 24/05/18 20:09, Mark Langsdorf wrote:
>> The x86 kernel and the documentation use 'nopti' as the kernel command
>> line argument to disable kernel page table isolation, so add nopti to
>> the arm64 kernel for compatibility.
>>
>> Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
>> ---
>> ? Documentation/admin-guide/kernel-parameters.txt |? 6 +++---
>> ? arch/arm64/kernel/cpufeature.c????????????????? | 11 ++++++++++-
>> ? 2 files changed, 13 insertions(+), 4 deletions(-)
>>
>> diff --git a/Documentation/admin-guide/kernel-parameters.txt 
>> b/Documentation/admin-guide/kernel-parameters.txt
>> index f2040d4..a987725 100644
>> --- a/Documentation/admin-guide/kernel-parameters.txt
>> +++ b/Documentation/admin-guide/kernel-parameters.txt
>> @@ -3342,8 +3342,8 @@
>> ????? pt.??????? [PARIDE]
>> ????????????? See Documentation/blockdev/paride.txt.
>> -??? pti=??????? [X86_64] Control Page Table Isolation of user and
>> -??????????? kernel address spaces.? Disabling this feature
>> +??? pti=??????? [X86_64, ARM64] Control Page Table Isolation of user
>> +??????????? and kernel address spaces.? Disabling this feature
>> ????????????? removes hardening, but improves performance of
>> ????????????? system calls and interrupts.
> 
> ...
> 
>> @@ -3354,7 +3354,7 @@
>> ????????????? Not specifying this option is equivalent to pti=auto.
>> -??? nopti??????? [X86_64]
>> +??? nopti??????? [X86_64, ARM64]
>> ????????????? Equivalent to pti=off
>> ????? pty.legacy_count=
>> diff --git a/arch/arm64/kernel/cpufeature.c 
>> b/arch/arm64/kernel/cpufeature.c
>> index 9d1b06d..7c5d8712 100644
>> --- a/arch/arm64/kernel/cpufeature.c
>> +++ b/arch/arm64/kernel/cpufeature.c
>> @@ -934,10 +934,19 @@ static int __init parse_kpti(char *str)
>> ????? if (ret)
>> ????????? return ret;
>> -??? __kpti_forced = enabled ? 1 : -1;
>> +??? if (!__kpti_forced)
>> +??????? __kpti_forced = enabled ? 1 : -1;
>> ????? return 0;
>> ? }
>> ? __setup("kpti=", parse_kpti);
> 
> The arm64 kernel parameter is named "kpti", while the Documentation 
> update above says "pti". We may want to keep both in sync here.

Good point. I think I will add a new kpti entry for ARM64 in 
kernel-parameters. Then the docs match the code, instead of trying to 
match the code to the docs.

--Mark Langsdorf