From patchwork Fri Sep 4 10:42:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Daniel Kachhap X-Patchwork-Id: 11756593 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4BEBA92C for ; Fri, 4 Sep 2020 10:42:46 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 237982087C for ; Fri, 4 Sep 2020 10:42:46 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="KYRo9XbQ" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 237982087C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:References:In-Reply-To:Message-Id:Date:Subject:To: From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=N9xZvud+y3BZYbAmqp2KodaS1Kd/9VOJNjJkAu7B3/4=; b=KYRo9XbQhp2iVpLckXp62HNaJ2 9Dn0bQFZWrRqThmAna6fAh0GT5BtA2AhQdtPGqWnXgoKcVB+Wmpg58Ajn8dDv65KHlKukXWNjWMhc /YrJ9J/fz0Dy6WqGdpWaUponCGaWZcaDAb/y7YogXP1r95GomgW278rNjiiniRBXBoYn+dbtwLlux oMY0hEwmeP48hqp9pen8RaJrhGEaNNQqYNNNporLVsxUkC86YOZAknRplrnl+6hPcd7StcxuoFKrI 6HBcaaM9em7JsrGAHoM+xL/0OSLJcuIKrbnF7JvfSJtyfchVRsOjlxNpRWb78+v8W1EdFgEzpFLzP l6APblog==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kE9Aw-0002w1-N2; Fri, 04 Sep 2020 10:42:34 +0000 Received: from foss.arm.com ([217.140.110.172]) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kE9Ap-0002u1-Iw for linux-arm-kernel@lists.infradead.org; Fri, 04 Sep 2020 10:42:28 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 24E31101E; Fri, 4 Sep 2020 03:42:26 -0700 (PDT) Received: from a077416.arm.com (unknown [10.57.5.177]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id F218E3F66F; Fri, 4 Sep 2020 03:42:22 -0700 (PDT) From: Amit Daniel Kachhap To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v6 1/6] arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions Date: Fri, 4 Sep 2020 16:12:04 +0530 Message-Id: <20200904104209.32385-2-amit.kachhap@arm.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200904104209.32385-1-amit.kachhap@arm.com> References: <20200904104209.32385-1-amit.kachhap@arm.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200904_064227_732577_A3623296 X-CRM114-Status: GOOD ( 12.84 ) X-Spam-Score: -2.3 (--) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-2.3 points) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [217.140.110.172 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Suzuki K Poulose , Catalin Marinas , Mark Brown , James Morse , Amit Daniel Kachhap , Vincenzo Frascino , Will Deacon , Dave Martin MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org Currently the ARMv8.3-PAuth combined branch instructions (braa, retaa etc.) are not simulated for out-of-line execution with a handler. Hence the uprobe of such instructions leads to kernel warnings in a loop as they are not explicitly checked and fall into INSN_GOOD categories. Other combined instructions like LDRAA and LDRBB can be probed. The issue of the combined branch instructions is fixed by adding definitions of all such instructions and rejecting their probes. Warning log: WARNING: CPU: 5 PID: 249 at arch/arm64/kernel/probes/uprobes.c:182 uprobe_single_step_handler+0x34/0x50 Modules linked in: CPU: 5 PID: 249 Comm: func Tainted: G W 5.8.0-rc4-00005-ge658591d66d1-dirty #160 Hardware name: Foundation-v8A (DT) pstate: 204003c9 (nzCv DAIF +PAN -UAO BTYPE=--) pc : uprobe_single_step_handler+0x34/0x50 lr : single_step_handler+0x70/0xf8 sp : ffff800012afbe30 x29: ffff800012afbe30 x28: ffff000879f00ec0 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000060001000 x22: 00000000cb000022 x21: ffff800011fc5a68 x20: ffff800012afbec0 x19: ffff800011fc86c0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffff800010085d50 x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff800011fba9c0 x5 : ffff800011fba000 x4 : ffff800012283070 x3 : ffff8000100a78e0 x2 : 00000000004005f0 x1 : 0000fffffffff008 x0 : ffff800012afbec0 Call trace: uprobe_single_step_handler+0x34/0x50 single_step_handler+0x70/0xf8 do_debug_exception+0xb8/0x130 el0_sync_handler+0x7c/0x188 el0_sync+0x158/0x180 Fixes: 74afda4016a7 ("arm64: compile the kernel with ptrauth return address signing") Fixes: 04ca3204fa09 ("arm64: enable pointer authentication") Signed-off-by: Amit Daniel Kachhap Reviewed-by: Dave Martin --- Changes since v5: * Slight change in commit log. * Added Reviewed-by. arch/arm64/include/asm/insn.h | 12 ++++++++++++ arch/arm64/kernel/insn.c | 14 ++++++++++++-- arch/arm64/kernel/probes/decode-insn.c | 4 +++- 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h index 0bc46149e491..324234068fee 100644 --- a/arch/arm64/include/asm/insn.h +++ b/arch/arm64/include/asm/insn.h @@ -359,9 +359,21 @@ __AARCH64_INSN_FUNCS(brk, 0xFFE0001F, 0xD4200000) __AARCH64_INSN_FUNCS(exception, 0xFF000000, 0xD4000000) __AARCH64_INSN_FUNCS(hint, 0xFFFFF01F, 0xD503201F) __AARCH64_INSN_FUNCS(br, 0xFFFFFC1F, 0xD61F0000) +__AARCH64_INSN_FUNCS(braaz, 0xFFFFFC1F, 0xD61F081F) +__AARCH64_INSN_FUNCS(brabz, 0xFFFFFC1F, 0xD61F0C1F) +__AARCH64_INSN_FUNCS(braa, 0xFFFFFC00, 0xD71F0800) +__AARCH64_INSN_FUNCS(brab, 0xFFFFFC00, 0xD71F0C00) __AARCH64_INSN_FUNCS(blr, 0xFFFFFC1F, 0xD63F0000) +__AARCH64_INSN_FUNCS(blraaz, 0xFFFFFC1F, 0xD63F081F) +__AARCH64_INSN_FUNCS(blrabz, 0xFFFFFC1F, 0xD63F0C1F) +__AARCH64_INSN_FUNCS(blraa, 0xFFFFFC00, 0xD73F0800) +__AARCH64_INSN_FUNCS(blrab, 0xFFFFFC00, 0xD73F0C00) __AARCH64_INSN_FUNCS(ret, 0xFFFFFC1F, 0xD65F0000) +__AARCH64_INSN_FUNCS(retaa, 0xFFFFFFFF, 0xD65F0BFF) +__AARCH64_INSN_FUNCS(retab, 0xFFFFFFFF, 0xD65F0FFF) __AARCH64_INSN_FUNCS(eret, 0xFFFFFFFF, 0xD69F03E0) +__AARCH64_INSN_FUNCS(eretaa, 0xFFFFFFFF, 0xD69F0BFF) +__AARCH64_INSN_FUNCS(eretab, 0xFFFFFFFF, 0xD69F0FFF) __AARCH64_INSN_FUNCS(mrs, 0xFFF00000, 0xD5300000) __AARCH64_INSN_FUNCS(msr_imm, 0xFFF8F01F, 0xD500401F) __AARCH64_INSN_FUNCS(msr_reg, 0xFFF00000, 0xD5100000) diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c index a107375005bc..27d5a52d5058 100644 --- a/arch/arm64/kernel/insn.c +++ b/arch/arm64/kernel/insn.c @@ -176,7 +176,7 @@ bool __kprobes aarch64_insn_uses_literal(u32 insn) bool __kprobes aarch64_insn_is_branch(u32 insn) { - /* b, bl, cb*, tb*, b.cond, br, blr */ + /* b, bl, cb*, tb*, ret*, b.cond, br*, blr* */ return aarch64_insn_is_b(insn) || aarch64_insn_is_bl(insn) || @@ -185,9 +185,19 @@ bool __kprobes aarch64_insn_is_branch(u32 insn) aarch64_insn_is_tbz(insn) || aarch64_insn_is_tbnz(insn) || aarch64_insn_is_ret(insn) || + aarch64_insn_is_retaa(insn) || + aarch64_insn_is_retab(insn) || aarch64_insn_is_br(insn) || aarch64_insn_is_blr(insn) || - aarch64_insn_is_bcond(insn); + aarch64_insn_is_bcond(insn) || + aarch64_insn_is_braaz(insn) || + aarch64_insn_is_brabz(insn) || + aarch64_insn_is_braa(insn) || + aarch64_insn_is_brab(insn) || + aarch64_insn_is_blraaz(insn) || + aarch64_insn_is_blrabz(insn) || + aarch64_insn_is_blraa(insn) || + aarch64_insn_is_blrab(insn); } int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn) diff --git a/arch/arm64/kernel/probes/decode-insn.c b/arch/arm64/kernel/probes/decode-insn.c index 263d5fba4c8a..f9eb8210d6d3 100644 --- a/arch/arm64/kernel/probes/decode-insn.c +++ b/arch/arm64/kernel/probes/decode-insn.c @@ -29,7 +29,9 @@ static bool __kprobes aarch64_insn_is_steppable(u32 insn) aarch64_insn_is_msr_imm(insn) || aarch64_insn_is_msr_reg(insn) || aarch64_insn_is_exception(insn) || - aarch64_insn_is_eret(insn)) + aarch64_insn_is_eret(insn) || + aarch64_insn_is_eretaa(insn) || + aarch64_insn_is_eretab(insn)) return false; /*