All of lore.kernel.org
 help / color / mirror / Atom feed
From: Amit Daniel Kachhap <amit.kachhap@arm.com>
To: linux-arm-kernel@lists.infradead.org
Cc: Mark Rutland <mark.rutland@arm.com>,
	Kees Cook <keescook@chromium.org>,
	Suzuki K Poulose <suzuki.poulose@arm.com>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Kristina Martsenko <kristina.martsenko@arm.com>,
	Dave Martin <Dave.Martin@arm.com>,
	Mark Brown <broonie@kernel.org>,
	James Morse <james.morse@arm.com>,
	Ramana Radhakrishnan <ramana.radhakrishnan@arm.com>,
	Amit Daniel Kachhap <amit.kachhap@arm.com>,
	Vincenzo Frascino <Vincenzo.Frascino@arm.com>,
	Will Deacon <will@kernel.org>, Ard Biesheuvel <ardb@kernel.org>
Subject: [PATCH v7 10/17] arm64: initialize ptrauth keys for kernel booting task
Date: Fri, 13 Mar 2020 14:34:57 +0530	[thread overview]
Message-ID: <1584090304-18043-11-git-send-email-amit.kachhap@arm.com> (raw)
In-Reply-To: <1584090304-18043-1-git-send-email-amit.kachhap@arm.com>

This patch uses the existing boot_init_stack_canary arch function
to initialize the ptrauth keys for the booting task in the primary
core. The requirement here is that it should be always inline and
the caller must never return.

As pointer authentication too detects a subset of stack corruption
so it makes sense to place this code here.

Both pointer authentication and stack canary codes are protected
by their respective config option.

Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Vincenzo Frascino <Vincenzo.Frascino@arm.com>
Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
---
 arch/arm64/include/asm/pointer_auth.h   | 11 ++++++++++-
 arch/arm64/include/asm/stackprotector.h |  5 +++++
 include/linux/stackprotector.h          |  2 +-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h
index aa956ca..833d3f9 100644
--- a/arch/arm64/include/asm/pointer_auth.h
+++ b/arch/arm64/include/asm/pointer_auth.h
@@ -54,12 +54,18 @@ do {								\
 	write_sysreg_s(__pki_v.hi, SYS_ ## k ## KEYHI_EL1);	\
 } while (0)
 
-static inline void ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)
+static __always_inline void ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)
 {
 	if (system_supports_address_auth())
 		get_random_bytes(&keys->apia, sizeof(keys->apia));
 }
 
+static __always_inline void ptrauth_keys_switch_kernel(struct ptrauth_keys_kernel *keys)
+{
+	if (system_supports_address_auth())
+		__ptrauth_key_install(APIA, keys->apia);
+}
+
 extern int ptrauth_prctl_reset_keys(struct task_struct *tsk, unsigned long arg);
 
 /*
@@ -78,12 +84,15 @@ static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr)
 	ptrauth_keys_init_user(&(tsk)->thread.keys_user)
 #define ptrauth_thread_init_kernel(tsk)					\
 	ptrauth_keys_init_kernel(&(tsk)->thread.keys_kernel)
+#define ptrauth_thread_switch_kernel(tsk)				\
+	ptrauth_keys_switch_kernel(&(tsk)->thread.keys_kernel)
 
 #else /* CONFIG_ARM64_PTR_AUTH */
 #define ptrauth_prctl_reset_keys(tsk, arg)	(-EINVAL)
 #define ptrauth_strip_insn_pac(lr)	(lr)
 #define ptrauth_thread_init_user(tsk)
 #define ptrauth_thread_init_kernel(tsk)
+#define ptrauth_thread_switch_kernel(tsk)
 #endif /* CONFIG_ARM64_PTR_AUTH */
 
 #endif /* __ASM_POINTER_AUTH_H */
diff --git a/arch/arm64/include/asm/stackprotector.h b/arch/arm64/include/asm/stackprotector.h
index 5884a2b..7263e0b 100644
--- a/arch/arm64/include/asm/stackprotector.h
+++ b/arch/arm64/include/asm/stackprotector.h
@@ -15,6 +15,7 @@
 
 #include <linux/random.h>
 #include <linux/version.h>
+#include <asm/pointer_auth.h>
 
 extern unsigned long __stack_chk_guard;
 
@@ -26,6 +27,7 @@ extern unsigned long __stack_chk_guard;
  */
 static __always_inline void boot_init_stack_canary(void)
 {
+#if defined(CONFIG_STACKPROTECTOR)
 	unsigned long canary;
 
 	/* Try to get a semi random initial value. */
@@ -36,6 +38,9 @@ static __always_inline void boot_init_stack_canary(void)
 	current->stack_canary = canary;
 	if (!IS_ENABLED(CONFIG_STACKPROTECTOR_PER_TASK))
 		__stack_chk_guard = current->stack_canary;
+#endif
+	ptrauth_thread_init_kernel(current);
+	ptrauth_thread_switch_kernel(current);
 }
 
 #endif	/* _ASM_STACKPROTECTOR_H */
diff --git a/include/linux/stackprotector.h b/include/linux/stackprotector.h
index 6b792d0..4c678c4 100644
--- a/include/linux/stackprotector.h
+++ b/include/linux/stackprotector.h
@@ -6,7 +6,7 @@
 #include <linux/sched.h>
 #include <linux/random.h>
 
-#ifdef CONFIG_STACKPROTECTOR
+#if defined(CONFIG_STACKPROTECTOR) || defined(CONFIG_ARM64_PTR_AUTH)
 # include <asm/stackprotector.h>
 #else
 static inline void boot_init_stack_canary(void)
-- 
2.7.4


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply	other threads:[~2020-03-13  9:08 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-13  9:04 [PATCH v7 00/17] arm64: return address signing Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 01/17] arm64: cpufeature: Fix meta-capability cpufeature check Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 02/17] arm64: cpufeature: add pointer auth meta-capabilities Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 03/17] arm64: rename ptrauth key structures to be user-specific Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 04/17] arm64: install user ptrauth keys at kernel exit time Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 05/17] arm64: ptrauth: Add bootup/runtime flags for __cpu_setup Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 06/17] arm64: cpufeature: Move cpu capability helpers inside C file Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 07/17] arm64: cpufeature: handle conflicts based on capability Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 08/17] arm64: enable ptrauth earlier Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 09/17] arm64: initialize and switch ptrauth kernel keys Amit Daniel Kachhap
2020-03-13  9:04 ` Amit Daniel Kachhap [this message]
2020-03-13  9:04 ` [PATCH v7 11/17] arm64: mask PAC bits of __builtin_return_address Amit Daniel Kachhap
2020-03-13  9:04 ` [PATCH v7 12/17] arm64: unwind: strip PAC from kernel addresses Amit Daniel Kachhap
2020-03-13  9:05 ` [PATCH v7 13/17] arm64: __show_regs: strip PAC from lr in printk Amit Daniel Kachhap
2020-03-13  9:05 ` [PATCH v7 14/17] arm64: suspend: restore the kernel ptrauth keys Amit Daniel Kachhap
2020-03-13  9:05 ` [PATCH v7 15/17] kconfig: Add support for 'as-option' Amit Daniel Kachhap
2020-03-13  9:05   ` Amit Daniel Kachhap
2020-03-13  9:10   ` Masahiro Yamada
2020-03-13  9:10     ` Masahiro Yamada
2020-03-13  9:14     ` Amit Kachhap
2020-03-13  9:14       ` Amit Kachhap
2020-03-13  9:05 ` [PATCH v7 16/17] arm64: compile the kernel with ptrauth return address signing Amit Daniel Kachhap
2020-03-19 18:19   ` [PATCH] arm64: Kconfig: verify binutils support for ARM64_PTR_AUTH Nick Desaulniers
2020-03-19 18:35     ` Nathan Chancellor
2020-03-20 15:09     ` Catalin Marinas
2020-03-13  9:05 ` [PATCH v7 17/17] lkdtm: arm64: test kernel pointer authentication Amit Daniel Kachhap
2020-03-18 14:32 ` [PATCH v7 00/17] arm64: return address signing Catalin Marinas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1584090304-18043-11-git-send-email-amit.kachhap@arm.com \
    --to=amit.kachhap@arm.com \
    --cc=Dave.Martin@arm.com \
    --cc=Vincenzo.Frascino@arm.com \
    --cc=ardb@kernel.org \
    --cc=broonie@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=james.morse@arm.com \
    --cc=keescook@chromium.org \
    --cc=kristina.martsenko@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=mark.rutland@arm.com \
    --cc=ramana.radhakrishnan@arm.com \
    --cc=suzuki.poulose@arm.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.