From patchwork Tue Apr 17 18:37:27 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133572 Delivered-To: patch@linaro.org Received: by 10.46.84.18 with SMTP id i18csp5035756ljb; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+0KPIjNg86vV4JY2q35yW6hVFP01AJ5YiOoipPcBIrbMG9lCumIX5ZGjv+9jNco4VX+cmN X-Received: by 2002:a17:902:5497:: with SMTP id e23-v6mr2998781pli.308.1523990281719; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523990281; cv=none; d=google.com; s=arc-20160816; b=jaRNvuB2Dg9t2wx8weTRVyk1Vr04DgQYan6He2h6sGbnZJLf8W67l2GRwpsGaIU6lj 8tx7I/avjoQxmtMaG0hueWQLtLXnFaZOK+DrWgnJIS0vtwo7ElSY2TMxexuejwMulN0R /aOVBdrPUAFlzrsAVzr0nGQsQb6R4v03xagN4f+rjHAXU5j8uYluDaB3YXvcV2gJUzeF X9/IX3q3VZed8cjAdvN7zlcJMjNrw31Pu8AgR3tPHqW5v6IypYjPCdhnRBcgWdPcvbGK mJ5ZxdUHV7fAQbSiGix64Dt5GS/VsHivGi474LqfJjlfwvQeZRWNfQys9G9pPv6macsy 81Sg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=11Y/EXDvdfE23Qa+nugO8bDiHjjD5M9j94ICNBI+C/Y=; b=aNd8AgJGHr3a2pR6c29uYET2GZyhvzViTwNm24LoxIv5THtf84JlXpkMBCKAbQa+al RP3wg05HHAwfYRn5OSFzSO/Srk7tee3Hw15onaJ+vNIfwNft5Xt5ZeagHoyJfPySBoTZ Py3LS5ZqGKdb1suyyKttJMsLf4Ob++6ov48tbOeqw5ZlPYltoDCCnjEt0PPMfjtiogZj PXncLdxq4B62SkIgG10WYc6tkU4Ee6gPQs0Q79rr8Jooj0GQhBcVoAOUeRde7IOdCc/a YBpzCoRK8oyiM8wQLDLhK3dYD9sg8tUwA+WRAT7b3+VobwePzVsxaaN1jd56UXQgBYVg iQEQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a5-v6si15012195pls.571.2018.04.17.11.38.01; Tue, 17 Apr 2018 11:38:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752710AbeDQSh6 (ORCPT + 29 others); Tue, 17 Apr 2018 14:37:58 -0400 Received: from foss.arm.com ([217.140.101.70]:46974 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752604AbeDQShz (ORCPT ); Tue, 17 Apr 2018 14:37:55 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 721E515BE; Tue, 17 Apr 2018 11:37:55 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id EBDD73F587; Tue, 17 Apr 2018 11:37:52 -0700 (PDT) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: arnd@arndb.de, catalin.marinas@arm.com, cdall@kernel.org, drjones@redhat.com, kvmarm@lists.cs.columbia.edu, linux-arch@vger.kernel.org, marc.zyngier@arm.com, mark.rutland@arm.com, ramana.radhakrishnan@arm.com, suzuki.poulose@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, awallis@codeaurora.org, kernel-hardening@lists.openwall.com Subject: [PATCHv3 03/11] arm64/kvm: hide ptrauth from guests Date: Tue, 17 Apr 2018 19:37:27 +0100 Message-Id: <20180417183735.56985-4-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180417183735.56985-1-mark.rutland@arm.com> References: <20180417183735.56985-1-mark.rutland@arm.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In subsequent patches we're going to expose ptrauth to the host kernel and userspace, but things are a bit trickier for guest kernels. For the time being, let's hide ptrauth from KVM guests. Regardless of how well-behaved the guest kernel is, guest userspace could attempt to use ptrauth instructions, triggering a trap to EL2, resulting in noise from kvm_handle_unknown_ec(). So let's write up a handler for the PAC trap, which silently injects an UNDEF into the guest, as if the feature were really missing. Signed-off-by: Mark Rutland Cc: Christoffer Dall Cc: Marc Zyngier Cc: kvmarm@lists.cs.columbia.edu --- arch/arm64/kvm/handle_exit.c | 18 ++++++++++++++++++ arch/arm64/kvm/sys_regs.c | 9 +++++++++ 2 files changed, 27 insertions(+) -- 2.11.0 Reviewed-by: Andrew Jones Reviewed-by: Christoffer Dall diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c index e5e741bfffe1..5114ad691eae 100644 --- a/arch/arm64/kvm/handle_exit.c +++ b/arch/arm64/kvm/handle_exit.c @@ -173,6 +173,23 @@ static int handle_sve(struct kvm_vcpu *vcpu, struct kvm_run *run) return 1; } +/* + * Guest usage of a ptrauth instruction (which the guest EL1 did not turn into + * a NOP), or guest EL1 access to a ptrauth register. + */ +static int kvm_handle_ptrauth(struct kvm_vcpu *vcpu, struct kvm_run *run) +{ + /* + * We don't currently suport ptrauth in a guest, and we mask the ID + * registers to prevent well-behaved guests from trying to make use of + * it. + * + * Inject an UNDEF, as if the feature really isn't present. + */ + kvm_inject_undefined(vcpu); + return 1; +} + static exit_handle_fn arm_exit_handlers[] = { [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec, [ESR_ELx_EC_WFx] = kvm_handle_wfx, @@ -195,6 +212,7 @@ static exit_handle_fn arm_exit_handlers[] = { [ESR_ELx_EC_BKPT32] = kvm_handle_guest_debug, [ESR_ELx_EC_BRK64] = kvm_handle_guest_debug, [ESR_ELx_EC_FP_ASIMD] = handle_no_fpsimd, + [ESR_ELx_EC_PAC] = kvm_handle_ptrauth, }; static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 806b0b126a64..eee399c35e84 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -1000,6 +1000,15 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz) task_pid_nr(current)); val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT); + } else if (id == SYS_ID_AA64ISAR1_EL1) { + const u64 ptrauth_mask = (0xfUL << ID_AA64ISAR1_APA_SHIFT) | + (0xfUL << ID_AA64ISAR1_API_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPA_SHIFT) | + (0xfUL << ID_AA64ISAR1_GPI_SHIFT); + if (val & ptrauth_mask) + pr_err_once("kvm [%i]: ptrauth unsupported for guests, suppressing\n", + task_pid_nr(current)); + val &= ~ptrauth_mask; } else if (id == SYS_ID_AA64MMFR1_EL1) { if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT)) pr_err_once("kvm [%i]: LORegions unsupported for guests, suppressing\n",