linux-man.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Will Deacon <will@kernel.org>
To: Dave Martin <Dave.Martin@arm.com>
Cc: mtk.manpages@gmail.com, linux-man@vger.kernel.org,
	linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
	Catalin Marinas <catalin.marinas@arm.com>,
	Amit Daniel Kachhap <amit.kachhap@arm.com>,
	Mark Rutland <mark.rutland@arm.com>
Subject: Re: [PATCH 14/14] prctl.2: Add PR_PAC_RESET_KEYS (arm64)
Date: Wed, 13 May 2020 08:25:31 +0100	[thread overview]
Message-ID: <20200513072530.GA18196@willie-the-truck> (raw)
In-Reply-To: <1589301419-24459-15-git-send-email-Dave.Martin@arm.com>

Hi Dave,

On Tue, May 12, 2020 at 05:36:59PM +0100, Dave Martin wrote:
> diff --git a/man2/prctl.2 b/man2/prctl.2
> index dd16227..7ea60e2 100644
> --- a/man2/prctl.2
> +++ b/man2/prctl.2
> @@ -950,6 +950,46 @@ behavior.
>  A value of 1 indicates
>  .BR execve (2)
>  will operate in the privilege-restricting mode described above.
> +.\" prctl PR_PAC_RESET_KEYS
> +.\" commit ba830885656414101b2f8ca88786524d4bb5e8c1
> +.TP
> +.BR PR_PAC_RESET_KEYS " (since Linux 5.0, only on arm64)"
> +Securely reset the thread's pointer authentication keys
> +to fresh random values generated by the kernel.
> +.IP
> +The set of keys to be reset is specified by
> +.IR arg2 ,
> +which must be a logical OR of zero or more of the following:
> +.RS
> +.TP
> +.B PR_PAC_APIAKEY
> +instruction authentication key A
> +.TP
> +.B PR_PAC_APIBKEY
> +instruction authentication key B
> +.TP
> +.B PR_PAC_APDAKEY
> +data authentication key A
> +.TP
> +.B PR_PAC_APDBKEY
> +data authentication key B
> +.TP
> +.B PR_PAC_APGAKEY
> +generic authentication \(lqA\(rq key.
> +.IP
> +(Yes folks, there really is no generic B key.)
> +.RE
> +.IP
> +As a special case, if
> +.I arg2
> +is zero then all the keys are reset.
> +Since new keys could be added in future,
> +this is the recommended way to completely wipe the existing keys
> +when creating a new execution context.

I see what you're saying, but the keys are also reset on exec() iirc, so we
don't want to encourage people to issue the prctl() unnecessarily
immediately following an exec().

> +.IP
> +The remaining arguments
> +.IR arg3 ", " arg4 " and " arg5
> +must all be zero.
>  .\" prctl PR_SET_PDEATHSIG
>  .TP
>  .BR PR_SET_PDEATHSIG " (since Linux 2.1.57)"
> @@ -1920,6 +1960,27 @@ are not 0.
>  .B EINVAL
>  .I option
>  was
> +.B PR_PAC_RESET_KEYS
> +and
> +.I arg2
> +contains non-zero bits other than
> +.BR
> +.BR PR_PAC_APIAKEY ,
> +.BR PR_PAC_APIBKEY ,
> +.BR PR_PAC_APDAKEY ,
> +.B PR_PAC_APDBKEY
> +and
> +.BR PR_PAC_APGAKEY ;
> +or
> +.IR arg3 ,
> +.I arg4
> +and
> +.I arg5
> +were not all zero.

Do we care about other reasons for -EINVAL, such as the system not
supporting pointer authentication?

Will

  reply	other threads:[~2020-05-13  7:25 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-12 16:36 [PATCH 00/14] prctl.2 man page updates for Linux 5.6 Dave Martin
2020-05-12 16:36 ` [PATCH 01/14] prctl.2: tfix clarify that prctl can apply to threads Dave Martin
2020-05-13  8:30   ` Michael Kerrisk (man-pages)
2020-05-12 16:36 ` [PATCH 02/14] prctl.2: Add health warning Dave Martin
2020-05-13 10:10   ` Michael Kerrisk (man-pages)
2020-05-13 11:13     ` Dave Martin
2020-05-13 11:40       ` Michael Kerrisk (man-pages)
2020-05-13 11:41         ` Dave Martin
2020-05-12 16:36 ` [PATCH 03/14] prctl.2: tfix mis-description of thread ID values in procfs Dave Martin
2020-05-13  8:36   ` Michael Kerrisk (man-pages)
2020-05-12 16:36 ` [PATCH 04/14] prctl.2: srcfix add comments for navigation Dave Martin
2020-05-13 10:09   ` Michael Kerrisk (man-pages)
2020-05-13 10:56     ` Dave Martin
2020-05-13 11:03       ` Michael Kerrisk (man-pages)
2020-05-13 11:15         ` Dave Martin
2020-05-13 11:48           ` Michael Kerrisk (man-pages)
2020-05-13 11:51             ` Dave Martin
2020-05-12 16:36 ` [PATCH 05/14] prctl.2: tfix listing order of prctls Dave Martin
2020-05-13 10:10   ` Michael Kerrisk (man-pages)
2020-05-13 11:21     ` Dave Martin
2020-05-13 11:31       ` Michael Kerrisk (man-pages)
2020-05-13 11:45         ` Dave Martin
2020-05-12 16:36 ` [PATCH 06/14] prctl.2: ffix quotation mark tweaks Dave Martin
2020-05-13 10:11   ` Michael Kerrisk (man-pages)
2020-05-13 11:39     ` Dave Martin
2020-05-13 11:46       ` Michael Kerrisk (man-pages)
2020-05-13 11:51         ` Dave Martin
2020-05-12 16:36 ` [PATCH 07/14] prctl.2: Document removal of Intel MPX prctls Dave Martin
2020-05-12 16:41   ` Dave Hansen
2020-05-13 10:11   ` Michael Kerrisk (man-pages)
2020-05-12 16:36 ` [PATCH 08/14] prctl.2: Work around bogus constant "maxsig" in PR_SET_PDEATHSIG Dave Martin
2020-05-13 10:30   ` Michael Kerrisk (man-pages)
2020-05-12 16:36 ` [PATCH 09/14] prctl.2: tfix minor punctuation in SPECULATION_CTRL prctls Dave Martin
2020-05-13 10:31   ` Michael Kerrisk (man-pages)
2020-05-12 16:36 ` [PATCH 10/14] prctl.2: Add PR_SPEC_INDIRECT_BRANCH for " Dave Martin
2020-05-13 11:21   ` Michael Kerrisk (man-pages)
2020-05-13 11:49     ` Dave Martin
2020-05-13 12:06       ` Michael Kerrisk (man-pages)
2020-05-13 13:53         ` Dave Martin
2020-05-12 16:36 ` [PATCH 11/14] prctl.2: Add PR_SPEC_DISABLE_NOEXEC " Dave Martin
2020-05-12 16:36 ` [PATCH 12/14] prctl.2: Clarify the unsupported hardware case of EINVAL Dave Martin
2020-05-13 10:48   ` Michael Kerrisk (man-pages)
2020-05-12 16:36 ` [PATCH 13/14] prctl.2: Add SVE prctls (arm64) Dave Martin
2020-05-13  8:43   ` Will Deacon
2020-05-13 10:46     ` Dave Martin
2020-05-13 11:01       ` Michael Kerrisk (man-pages)
2020-05-13 14:02         ` Dave Martin
2020-05-13 21:11           ` Will Deacon
2020-05-18 16:37             ` Dave Martin
2020-05-26 14:45             ` Dave Martin
2020-05-12 16:36 ` [PATCH 14/14] prctl.2: Add PR_PAC_RESET_KEYS (arm64) Dave Martin
2020-05-13  7:25   ` Will Deacon [this message]
2020-05-13 14:36     ` Dave Martin
2020-05-13 21:00       ` Will Deacon
2020-05-18 16:11         ` Dave Martin
2020-05-18 16:29           ` Will Deacon
2020-05-13 11:28 ` [PATCH 00/14] prctl.2 man page updates for Linux 5.6 Michael Kerrisk (man-pages)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200513072530.GA18196@willie-the-truck \
    --to=will@kernel.org \
    --cc=Dave.Martin@arm.com \
    --cc=amit.kachhap@arm.com \
    --cc=catalin.marinas@arm.com \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-man@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=mtk.manpages@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).