Skip to content

Commit d053e71

Browse files
DanielKristofKisswilldeacon
DanielKristofKiss
authored and
willdeacon
committed
arm64: Conditionally configure PTR_AUTH key of the kernel.
If the kernel is not compiled with CONFIG_ARM64_PTR_AUTH_KERNEL=y, then no PACI/AUTI instructions are expected while the kernel is running so the kernel's key will not be used. Write of a system registers is expensive therefore avoid if not required. Signed-off-by: Daniel Kiss <daniel.kiss@arm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Link: https://lore.kernel.org/r/20210613092632.93591-3-daniel.kiss@arm.com Signed-off-by: Will Deacon <will@kernel.org>
1 parent b27a9f4 commit d053e71

5 files changed

Lines changed: 67 additions & 47 deletions

File tree

‎arch/arm64/Kconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1503,7 +1503,7 @@ config ARM64_PTR_AUTH
15031503
not be selected.
15041504

15051505
config ARM64_PTR_AUTH_KERNEL
1506-
bool
1506+
bool "Use pointer authentication for kernel"
15071507
default y
15081508
depends on ARM64_PTR_AUTH
15091509
depends on (CC_HAS_SIGN_RETURN_ADDRESS || CC_HAS_BRANCH_PROT_PAC_RET) && AS_HAS_PAC

‎arch/arm64/include/asm/asm_pointer_auth.h‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,7 @@
77
#include <asm/cpufeature.h>
88
#include <asm/sysreg.h>
99

10-
#ifdef CONFIG_ARM64_PTR_AUTH
11-
/*
12-
* thread.keys_user.ap* as offset exceeds the #imm offset range
13-
* so use the base value of ldp as thread.keys_user and offset as
14-
* thread.keys_user.ap*.
15-
*/
16-
.macro __ptrauth_keys_install_user tsk, tmp1, tmp2, tmp3
17-
mov \tmp1, #THREAD_KEYS_USER
18-
add \tmp1, \tsk, \tmp1
19-
ldp \tmp2, \tmp3, [\tmp1, #PTRAUTH_USER_KEY_APIA]
20-
msr_s SYS_APIAKEYLO_EL1, \tmp2
21-
msr_s SYS_APIAKEYHI_EL1, \tmp3
22-
.endm
10+
#ifdef CONFIG_ARM64_PTR_AUTH_KERNEL
2311

2412
.macro __ptrauth_keys_install_kernel_nosync tsk, tmp1, tmp2, tmp3
2513
mov \tmp1, #THREAD_KEYS_KERNEL
@@ -42,6 +30,33 @@ alternative_if ARM64_HAS_ADDRESS_AUTH
4230
alternative_else_nop_endif
4331
.endm
4432

33+
#else /* CONFIG_ARM64_PTR_AUTH_KERNEL */
34+
35+
.macro __ptrauth_keys_install_kernel_nosync tsk, tmp1, tmp2, tmp3
36+
.endm
37+
38+
.macro ptrauth_keys_install_kernel_nosync tsk, tmp1, tmp2, tmp3
39+
.endm
40+
41+
.macro ptrauth_keys_install_kernel tsk, tmp1, tmp2, tmp3
42+
.endm
43+
44+
#endif /* CONFIG_ARM64_PTR_AUTH_KERNEL */
45+
46+
#ifdef CONFIG_ARM64_PTR_AUTH
47+
/*
48+
* thread.keys_user.ap* as offset exceeds the #imm offset range
49+
* so use the base value of ldp as thread.keys_user and offset as
50+
* thread.keys_user.ap*.
51+
*/
52+
.macro __ptrauth_keys_install_user tsk, tmp1, tmp2, tmp3
53+
mov \tmp1, #THREAD_KEYS_USER
54+
add \tmp1, \tsk, \tmp1
55+
ldp \tmp2, \tmp3, [\tmp1, #PTRAUTH_USER_KEY_APIA]
56+
msr_s SYS_APIAKEYLO_EL1, \tmp2
57+
msr_s SYS_APIAKEYHI_EL1, \tmp3
58+
.endm
59+
4560
.macro __ptrauth_keys_init_cpu tsk, tmp1, tmp2, tmp3
4661
mrs \tmp1, id_aa64isar1_el1
4762
ubfx \tmp1, \tmp1, #ID_AA64ISAR1_APA_SHIFT, #8
@@ -64,17 +79,11 @@ alternative_else_nop_endif
6479
.Lno_addr_auth\@:
6580
.endm
6681

67-
#else /* CONFIG_ARM64_PTR_AUTH */
82+
#else /* !CONFIG_ARM64_PTR_AUTH */
6883

6984
.macro ptrauth_keys_install_user tsk, tmp1, tmp2, tmp3
7085
.endm
7186

72-
.macro ptrauth_keys_install_kernel_nosync tsk, tmp1, tmp2, tmp3
73-
.endm
74-
75-
.macro ptrauth_keys_install_kernel tsk, tmp1, tmp2, tmp3
76-
.endm
77-
7887
#endif /* CONFIG_ARM64_PTR_AUTH */
7988

8089
#endif /* __ASM_ASM_POINTER_AUTH_H */

‎arch/arm64/include/asm/pointer_auth.h‎

Lines changed: 33 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,36 @@ struct ptrauth_keys_user {
3131
struct ptrauth_key apga;
3232
};
3333

34-
struct ptrauth_keys_kernel {
35-
struct ptrauth_key apia;
36-
};
37-
3834
#define __ptrauth_key_install_nosync(k, v) \
3935
do { \
4036
struct ptrauth_key __pki_v = (v); \
4137
write_sysreg_s(__pki_v.lo, SYS_ ## k ## KEYLO_EL1); \
4238
write_sysreg_s(__pki_v.hi, SYS_ ## k ## KEYHI_EL1); \
4339
} while (0)
4440

41+
#ifdef CONFIG_ARM64_PTR_AUTH_KERNEL
42+
43+
struct ptrauth_keys_kernel {
44+
struct ptrauth_key apia;
45+
};
46+
47+
static __always_inline void ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)
48+
{
49+
if (system_supports_address_auth())
50+
get_random_bytes(&keys->apia, sizeof(keys->apia));
51+
}
52+
53+
static __always_inline void ptrauth_keys_switch_kernel(struct ptrauth_keys_kernel *keys)
54+
{
55+
if (!system_supports_address_auth())
56+
return;
57+
58+
__ptrauth_key_install_nosync(APIA, keys->apia);
59+
isb();
60+
}
61+
62+
#endif /* CONFIG_ARM64_PTR_AUTH_KERNEL */
63+
4564
static inline void ptrauth_keys_install_user(struct ptrauth_keys_user *keys)
4665
{
4766
if (system_supports_address_auth()) {
@@ -69,21 +88,6 @@ static inline void ptrauth_keys_init_user(struct ptrauth_keys_user *keys)
6988
ptrauth_keys_install_user(keys);
7089
}
7190

72-
static __always_inline void ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)
73-
{
74-
if (system_supports_address_auth())
75-
get_random_bytes(&keys->apia, sizeof(keys->apia));
76-
}
77-
78-
static __always_inline void ptrauth_keys_switch_kernel(struct ptrauth_keys_kernel *keys)
79-
{
80-
if (!system_supports_address_auth())
81-
return;
82-
83-
__ptrauth_key_install_nosync(APIA, keys->apia);
84-
isb();
85-
}
86-
8791
extern int ptrauth_prctl_reset_keys(struct task_struct *tsk, unsigned long arg);
8892

8993
extern int ptrauth_set_enabled_keys(struct task_struct *tsk, unsigned long keys,
@@ -121,11 +125,6 @@ static __always_inline void ptrauth_enable(void)
121125
#define ptrauth_thread_switch_user(tsk) \
122126
ptrauth_keys_install_user(&(tsk)->thread.keys_user)
123127

124-
#define ptrauth_thread_init_kernel(tsk) \
125-
ptrauth_keys_init_kernel(&(tsk)->thread.keys_kernel)
126-
#define ptrauth_thread_switch_kernel(tsk) \
127-
ptrauth_keys_switch_kernel(&(tsk)->thread.keys_kernel)
128-
129128
#else /* CONFIG_ARM64_PTR_AUTH */
130129
#define ptrauth_enable()
131130
#define ptrauth_prctl_reset_keys(tsk, arg) (-EINVAL)
@@ -134,11 +133,19 @@ static __always_inline void ptrauth_enable(void)
134133
#define ptrauth_strip_insn_pac(lr) (lr)
135134
#define ptrauth_suspend_exit()
136135
#define ptrauth_thread_init_user()
137-
#define ptrauth_thread_init_kernel(tsk)
138136
#define ptrauth_thread_switch_user(tsk)
139-
#define ptrauth_thread_switch_kernel(tsk)
140137
#endif /* CONFIG_ARM64_PTR_AUTH */
141138

139+
#ifdef CONFIG_ARM64_PTR_AUTH_KERNEL
140+
#define ptrauth_thread_init_kernel(tsk) \
141+
ptrauth_keys_init_kernel(&(tsk)->thread.keys_kernel)
142+
#define ptrauth_thread_switch_kernel(tsk) \
143+
ptrauth_keys_switch_kernel(&(tsk)->thread.keys_kernel)
144+
#else
145+
#define ptrauth_thread_init_kernel(tsk)
146+
#define ptrauth_thread_switch_kernel(tsk)
147+
#endif /* CONFIG_ARM64_PTR_AUTH_KERNEL */
148+
142149
#define PR_PAC_ENABLED_KEYS_MASK \
143150
(PR_PAC_APIAKEY | PR_PAC_APIBKEY | PR_PAC_APDAKEY | PR_PAC_APDBKEY)
144151

‎arch/arm64/include/asm/processor.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,10 @@ struct thread_struct {
148148
struct debug_info debug; /* debugging */
149149
#ifdef CONFIG_ARM64_PTR_AUTH
150150
struct ptrauth_keys_user keys_user;
151+
#ifdef CONFIG_ARM64_PTR_AUTH_KERNEL
151152
struct ptrauth_keys_kernel keys_kernel;
152153
#endif
154+
#endif
153155
#ifdef CONFIG_ARM64_MTE
154156
u64 gcr_user_excl;
155157
#endif

‎arch/arm64/kernel/asm-offsets.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,9 @@ int main(void)
155155
#endif
156156
#ifdef CONFIG_ARM64_PTR_AUTH
157157
DEFINE(PTRAUTH_USER_KEY_APIA, offsetof(struct ptrauth_keys_user, apia));
158+
#ifdef CONFIG_ARM64_PTR_AUTH_KERNEL
158159
DEFINE(PTRAUTH_KERNEL_KEY_APIA, offsetof(struct ptrauth_keys_kernel, apia));
160+
#endif
159161
BLANK();
160162
#endif
161163
return 0;

0 commit comments

Comments
 (0)