Commit 97228ca3 authored by Benjamin Gray's avatar Benjamin Gray Committed by Michael Ellerman
Browse files

powerpc/ptrace: Expose HASHKEYR register to ptrace 



The HASHKEYR register contains a secret per-process key to enable unique
hashes per process. In general it should not be exposed to userspace
at all and a regular process has no need to know its key.

However, checkpoint restore in userspace (CRIU) functionality requires
that a process be able to set the HASHKEYR of another process, otherwise
existing hashes on the stack would be invalidated by a new random key.

Exposing HASHKEYR in this way also makes it appear in core dumps, which
is a security concern. Multiple threads may share a key, for example
just after a fork() call, where the kernel cannot know if the child is
going to return back along the parent's stack. If such a thread is
coerced into making a core dump, then the HASHKEYR value will be
readable and able to be used against all other threads sharing that key,
effectively undoing any protection offered by hashst/hashchk.

Therefore we expose HASHKEYR to ptrace when CONFIG_CHECKPOINT_RESTORE is
enabled, providing a choice of increased security or migratable ROP
protected processes. This is similar to how ARM exposes its PAC keys.

Signed-off-by: default avatarBenjamin Gray <bgray@linux.ibm.com>
Reviewed-by: default avatarRussell Currey <ruscur@russell.cc>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230616034846.311705-8-bgray@linux.ibm.com
parent 884ad5c5

arch/powerpc/include/uapi/asm/elf.h

+1 −0
Original line number Diff line number Diff line
@@ -99,6 +99,7 @@ 
#define ELF_NPMU	5	/* includes siar, sdar, sier, mmcr2, mmcr0 */

#define ELF_NPKEY	3	/* includes amr, iamr, uamor */

#define ELF_NDEXCR	2	/* includes dexcr, hdexcr */

#define ELF_NHASHKEYR	1	/* includes hashkeyr */



typedef unsigned long elf_greg_t64;

typedef elf_greg_t64 elf_gregset_t64[ELF_NGREG];

arch/powerpc/kernel/ptrace/ptrace-decl.h

+3 −0
Original line number Diff line number Diff line
@@ -58,6 +58,9 @@ enum powerpc_regset { 
	REGSET_EBB,		/* EBB registers */

	REGSET_PMR,		/* Performance Monitor Registers */

	REGSET_DEXCR,		/* DEXCR registers */

#ifdef CONFIG_CHECKPOINT_RESTORE

	REGSET_HASHKEYR,	/* HASHKEYR register */

#endif

#endif

#ifdef CONFIG_PPC_MEM_KEYS

	REGSET_PKEY,		/* AMR register */

arch/powerpc/kernel/ptrace/ptrace-view.c

+36 −0
Original line number Diff line number Diff line
@@ -483,6 +483,35 @@ static int dexcr_get(struct task_struct *target, const struct user_regset *regse 
	return membuf_store(&to, (u64)lower_32_bits(mfspr(SPRN_HDEXCR_RO)));

}



#ifdef CONFIG_CHECKPOINT_RESTORE

static int hashkeyr_active(struct task_struct *target, const struct user_regset *regset)

{

	if (!cpu_has_feature(CPU_FTR_ARCH_31))

		return -ENODEV;



	return regset->n;

}



static int hashkeyr_get(struct task_struct *target, const struct user_regset *regset,

			struct membuf to)

{

	if (!cpu_has_feature(CPU_FTR_ARCH_31))

		return -ENODEV;



	return membuf_store(&to, target->thread.hashkeyr);

}



static int hashkeyr_set(struct task_struct *target, const struct user_regset *regset,

			unsigned int pos, unsigned int count, const void *kbuf,

			const void __user *ubuf)

{

	if (!cpu_has_feature(CPU_FTR_ARCH_31))

		return -ENODEV;



	return user_regset_copyin(&pos, &count, &kbuf, &ubuf, &target->thread.hashkeyr,

				  0, sizeof(unsigned long));

}

#endif /* CONFIG_CHECKPOINT_RESTORE */

#endif /* CONFIG_PPC_BOOK3S_64 */



#ifdef CONFIG_PPC_MEM_KEYS
@@ -649,6 +678,13 @@ static const struct user_regset native_regsets[] = { 
		.size = sizeof(u64), .align = sizeof(u64),

		.active = dexcr_active, .regset_get = dexcr_get

	},

#ifdef CONFIG_CHECKPOINT_RESTORE

	[REGSET_HASHKEYR] = {

		.core_note_type = NT_PPC_HASHKEYR, .n = ELF_NHASHKEYR,

		.size = sizeof(u64), .align = sizeof(u64),

		.active = hashkeyr_active, .regset_get = hashkeyr_get, .set = hashkeyr_set

	},

#endif

#endif

#ifdef CONFIG_PPC_MEM_KEYS

	[REGSET_PKEY] = {

include/uapi/linux/elf.h

+1 −0
Original line number Diff line number Diff line
@@ -404,6 +404,7 @@ typedef struct elf64_shdr { 
#define NT_PPC_TM_CDSCR	0x10f		/* TM checkpointed Data Stream Control Register */

#define NT_PPC_PKEY	0x110		/* Memory Protection Keys registers */

#define NT_PPC_DEXCR	0x111		/* PowerPC DEXCR registers */

#define NT_PPC_HASHKEYR	0x112		/* PowerPC HASHKEYR register */

#define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */

#define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */

#define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */