powerpc/ptrace: Expose HASHKEYR register to ptrace

The HASHKEYR register contains a secret per-process key to enable unique
hashes per process. In general it should not be exposed to userspace
at all and a regular process has no need to know its key.

However, checkpoint restore in userspace (CRIU) functionality requires
that a process be able to set the HASHKEYR of another process, otherwise
existing hashes on the stack would be invalidated by a new random key.

Exposing HASHKEYR in this way also makes it appear in core dumps, which
is a security concern. Multiple threads may share a key, for example
just after a fork() call, where the kernel cannot know if the child is
going to return back along the parent's stack. If such a thread is
coerced into making a core dump, then the HASHKEYR value will be
readable and able to be used against all other threads sharing that key,
effectively undoing any protection offered by hashst/hashchk.

Therefore we expose HASHKEYR to ptrace when CONFIG_CHECKPOINT_RESTORE is
enabled, providing a choice of increased security or migratable ROP
protected processes. This is similar to how ARM exposes its PAC keys.

Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
Reviewed-by: Russell Currey <ruscur@russell.cc>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230616034846.311705-8-bgray@linux.ibm.com

diff --git a/arch/powerpc/include/uapi/asm/elf.h b/arch/powerpc/include/uapi/asm/elf.h
index e0d323c808dddf40605a8a431ee56b6ccbd03a70..a5377f494fa316f62821a27ce1c32fede4c0507d 100644 (file)
--- a/arch/powerpc/include/uapi/asm/elf.h
+++ b/arch/powerpc/include/uapi/asm/elf.h
@@ -99,6 +99,7 @@
 #define ELF_NPMU       5       /* includes siar, sdar, sier, mmcr2, mmcr0 */
 #define ELF_NPKEY      3       /* includes amr, iamr, uamor */
 #define ELF_NDEXCR     2       /* includes dexcr, hdexcr */
+#define ELF_NHASHKEYR  1       /* includes hashkeyr */
 
 typedef unsigned long elf_greg_t64;
 typedef elf_greg_t64 elf_gregset_t64[ELF_NGREG];

diff --git a/arch/powerpc/kernel/ptrace/ptrace-decl.h b/arch/powerpc/kernel/ptrace/ptrace-decl.h
index 998a84f64804490264bec59243947ed572093452..4171a5727197ba62619f837783761382fcd0b168 100644 (file)
--- a/arch/powerpc/kernel/ptrace/ptrace-decl.h
+++ b/arch/powerpc/kernel/ptrace/ptrace-decl.h
@@ -58,6 +58,9 @@ enum powerpc_regset {
        REGSET_EBB,             /* EBB registers */
        REGSET_PMR,             /* Performance Monitor Registers */
        REGSET_DEXCR,           /* DEXCR registers */
+#ifdef CONFIG_CHECKPOINT_RESTORE
+       REGSET_HASHKEYR,        /* HASHKEYR register */
+#endif
 #endif
 #ifdef CONFIG_PPC_MEM_KEYS
        REGSET_PKEY,            /* AMR register */

diff --git a/arch/powerpc/kernel/ptrace/ptrace-view.c b/arch/powerpc/kernel/ptrace/ptrace-view.c
index f1032fe626f46d2055df83c4c81a2334db3d364f..3910cd7bb2d9b1a7997a730b9a20ddfacadad561 100644 (file)
--- a/arch/powerpc/kernel/ptrace/ptrace-view.c
+++ b/arch/powerpc/kernel/ptrace/ptrace-view.c
@@ -483,6 +483,35 @@ static int dexcr_get(struct task_struct *target, const struct user_regset *regse
        return membuf_store(&to, (u64)lower_32_bits(mfspr(SPRN_HDEXCR_RO)));
 }
 
+#ifdef CONFIG_CHECKPOINT_RESTORE
+static int hashkeyr_active(struct task_struct *target, const struct user_regset *regset)
+{
+       if (!cpu_has_feature(CPU_FTR_ARCH_31))
+               return -ENODEV;
+
+       return regset->n;
+}
+
+static int hashkeyr_get(struct task_struct *target, const struct user_regset *regset,
+                       struct membuf to)
+{
+       if (!cpu_has_feature(CPU_FTR_ARCH_31))
+               return -ENODEV;
+
+       return membuf_store(&to, target->thread.hashkeyr);
+}
+
+static int hashkeyr_set(struct task_struct *target, const struct user_regset *regset,
+                       unsigned int pos, unsigned int count, const void *kbuf,
+                       const void __user *ubuf)
+{
+       if (!cpu_has_feature(CPU_FTR_ARCH_31))
+               return -ENODEV;
+
+       return user_regset_copyin(&pos, &count, &kbuf, &ubuf, &target->thread.hashkeyr,
+                                 0, sizeof(unsigned long));
+}
+#endif /* CONFIG_CHECKPOINT_RESTORE */
 #endif /* CONFIG_PPC_BOOK3S_64 */
 
 #ifdef CONFIG_PPC_MEM_KEYS
@@ -649,6 +678,13 @@ static const struct user_regset native_regsets[] = {
                .size = sizeof(u64), .align = sizeof(u64),
                .active = dexcr_active, .regset_get = dexcr_get
        },
+#ifdef CONFIG_CHECKPOINT_RESTORE
+       [REGSET_HASHKEYR] = {
+               .core_note_type = NT_PPC_HASHKEYR, .n = ELF_NHASHKEYR,
+               .size = sizeof(u64), .align = sizeof(u64),
+               .active = hashkeyr_active, .regset_get = hashkeyr_get, .set = hashkeyr_set
+       },
+#endif
 #endif
 #ifdef CONFIG_PPC_MEM_KEYS
        [REGSET_PKEY] = {

diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h
index cfa31f1eb5d74494fba023417d8e5b643d332ba0..b705b301d88f28008065ab7f2f700b865a77528c 100644 (file)
--- a/include/uapi/linux/elf.h
+++ b/include/uapi/linux/elf.h
@@ -404,6 +404,7 @@ typedef struct elf64_shdr {
 #define NT_PPC_TM_CDSCR        0x10f           /* TM checkpointed Data Stream Control Register */
 #define NT_PPC_PKEY    0x110           /* Memory Protection Keys registers */
 #define NT_PPC_DEXCR   0x111           /* PowerPC DEXCR registers */
+#define NT_PPC_HASHKEYR        0x112           /* PowerPC HASHKEYR register */
 #define NT_386_TLS     0x200           /* i386 TLS slots (struct user_desc) */
 #define NT_386_IOPERM  0x201           /* x86 io permission bitmap (1=deny) */
 #define NT_X86_XSTATE  0x202           /* x86 extended state using xsave */