From patchwork Tue Apr 17 18:37:33 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133579 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5036564ljb; Tue, 17 Apr 2018 11:38:54 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+HYahkVHEV6ycYGqGCPPvFXqDi8qo9Jj1KbwzWUGgIxmP83SYQ4z5Obpym1Z7qsSeTtNvm X-Received: by 10.99.181.5 with SMTP id y5mr2607453pge.279.1523990334369; Tue, 17 Apr 2018 11:38:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990334; cv=none; d=google.com; s=arc-20160816; b=CXe8EdybhW4/kvFKaMOfoJ4ADyUYbnBlWTVofQfGqpkF+dnDUzaQy3guJoopgcGFqV iB9uxDCLwhjjXsxYDlfdRdrA/ilTz2EuFPp69pzF1OCn3qfV/Xuo9NtQNMkrrZNsZkOd HcKVICfr7ov7VryVKdv0cpRvnsO2qvpOLQqynbKZe178tw7rxjmfNpHQh3JndqDVLflJ 1b+XoMyY7S4NGVbisH11roR106Zz/Jhir/dFa/IQFkliyZ9s62JQ21/U5F3bINMwmAZM 4fA+7xdh+U8wMI+OkQ4CvJrPauJqnlo0CnmC9YAysxl85q73Jmu+i1N7z5L0gqDDgw8w Sj2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=I4QW1qdEk8tC8nDWOrEQmpFv3zVp92/g2kt8GUOONBg=; b=PqqBiEUYHcYNIj1ZBM4361qIpG5p1XSikDE1aiuBV5ryQWLbssmyTRTQAX+XhZfy59 7KBWAOwdWOmsYurGAatD6cwRpk7szoXzqbUyOcvqrB0/zkOwk1Los8SrS6jcZ8e7Typt nvLdXaES3KaYHKKvsbBm2VRsb8PZDTRTXYXTpwGIJZOmBPZnchnsy0IIHMc6uI2+hEmv /ZORyK0oFNtjS40pcO/sPfIKs+fZjBEzX2zLM0qT9o6gNdTTRB1XPuBx4biDKkA/43C1 m8uWSTqzwlR+DQ7Esz0CBkNQ3MqkSr5kydZXxFVJrSEggcbIknDAn71mqymsK5CTcjDJ MWjQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s1-v6si10240928plr.458.2018.04.17.11.38.54; Tue, 17 Apr 2018 11:38:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753170AbeDQSiv (ORCPT + 29 others); Tue, 17 Apr 2018 14:38:51 -0400 Received: from foss.arm.com ([217.140.101.70]:47076 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752915AbeDQSiP (ORCPT ); Tue, 17 Apr 2018 14:38:15 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2BB8E1435; Tue, 17 Apr 2018 11:38:15 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id A579C3F587; Tue, 17 Apr 2018 11:38:12 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 09/11] arm64: perf: strip PAC when unwinding userspace Date: Tue, 17 Apr 2018 19:37:33 +0100 Message-Id: <20180417183735.56985-10-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When the kernel is unwinding userspace callchains, we can't expect that the userspace consumer of these callchains has the data necessary to strip the PAC from the stored LR. This patch has the kernel strip the PAC from user stackframes when the in-kernel unwinder is used. This only affects the LR value, and not the FP. This only affects the in-kernel unwinder. When userspace performs unwinding, it is up to userspace to strip PACs as necessary (which can be determined from DWARF information). Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Ramana Radhakrishnan Cc: Will Deacon --- arch/arm64/include/asm/pointer_auth.h | 7 +++++++ arch/arm64/kernel/perf_callchain.c | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) -- 2.11.0 diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h index 5ff141245633..a9ad81791c7f 100644 --- a/arch/arm64/include/asm/pointer_auth.h +++ b/arch/arm64/include/asm/pointer_auth.h @@ -79,6 +79,12 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, */ #define ptrauth_pac_mask() GENMASK(54, VA_BITS) +/* Only valid for EL0 TTBR0 instruction pointers */ +static inline unsigned long ptrauth_strip_insn_pac(unsigned long ptr) +{ + return ptr & ~ptrauth_pac_mask(); +} + #define mm_ctx_ptrauth_init(ctx) \ ptrauth_keys_init(&(ctx)->ptrauth_keys) @@ -89,6 +95,7 @@ static inline void ptrauth_keys_dup(struct ptrauth_keys *old, ptrauth_keys_dup(&(oldctx)->ptrauth_keys, &(newctx)->ptrauth_keys) #else +#define ptrauth_strip_insn_pac(lr) (lr) #define mm_ctx_ptrauth_init(ctx) #define mm_ctx_ptrauth_switch(ctx) #define mm_ctx_ptrauth_dup(oldctx, newctx) diff --git a/arch/arm64/kernel/perf_callchain.c b/arch/arm64/kernel/perf_callchain.c index bcafd7dcfe8b..928204f6ab08 100644 --- a/arch/arm64/kernel/perf_callchain.c +++ b/arch/arm64/kernel/perf_callchain.c @@ -35,6 +35,7 @@ user_backtrace(struct frame_tail __user *tail, { struct frame_tail buftail; unsigned long err; + unsigned long lr; /* Also check accessibility of one struct frame_tail beyond */ if (!access_ok(VERIFY_READ, tail, sizeof(buftail))) @@ -47,7 +48,9 @@ user_backtrace(struct frame_tail __user *tail, if (err) return NULL; - perf_callchain_store(entry, buftail.lr); + lr = ptrauth_strip_insn_pac(buftail.lr); + + perf_callchain_store(entry, lr); /* * Frame pointers should strictly progress back up the stack