1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
|
/*-
* Copyright (c) 2014 Andrew Turner
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#ifdef __arm__
#include <arm/asm.h>
#else /* !__arm__ */
#ifndef _MACHINE_ASM_H_
#define _MACHINE_ASM_H_
#undef __FBSDID
#if !defined(lint) && !defined(STRIP_FBSDID)
#define __FBSDID(s) .ident s
#else
#define __FBSDID(s) /* nothing */
#endif
#define _C_LABEL(x) x
#ifdef KDTRACE_HOOKS
#define DTRACE_NOP nop
#else
#define DTRACE_NOP
#endif
#define LENTRY(sym) \
.text; .align 2; .type sym,#function; sym: \
.cfi_startproc; BTI_C; DTRACE_NOP
#define ENTRY(sym) \
.globl sym; LENTRY(sym)
#define EENTRY(sym) \
.globl sym; .text; .align 2; .type sym,#function; sym:
#define LEND(sym) .ltorg; .cfi_endproc; .size sym, . - sym
#define END(sym) LEND(sym)
#define EEND(sym)
#define WEAK_REFERENCE(sym, alias) \
.weak alias; \
.set alias,sym
#define UINT64_C(x) (x)
#if defined(PIC)
#define PIC_SYM(x,y) x ## @ ## y
#else
#define PIC_SYM(x,y) x
#endif
/* Alias for link register x30 */
#define lr x30
/*
* Check whether a given cpu feature is present, in the case it is not we jump
* to the given label. The tmp register should be a register able to hold the
* temporary data.
*/
#define CHECK_CPU_FEAT(tmp, feat_reg, feat, min_val, label) \
mrs tmp, ##feat_reg##_el1; \
ubfx tmp, tmp, ##feat_reg##_##feat##_SHIFT, ##feat_reg##_##feat##_WIDTH; \
cmp tmp, #(##feat_reg##_##feat##_##min_val## >> ##feat_reg##_##feat##_SHIFT); \
b.lt label
/*
* Sets the trap fault handler. The exception handler will return to the
* address in the handler register on a data abort or the xzr register to
* clear the handler. The tmp parameter should be a register able to hold
* the temporary data.
*/
#define SET_FAULT_HANDLER(handler, tmp) \
ldr tmp, [x18, #PC_CURTHREAD]; /* Load curthread */ \
ldr tmp, [tmp, #TD_PCB]; /* Load the pcb */ \
str handler, [tmp, #PCB_ONFAULT] /* Set the handler */
#define ENTER_USER_ACCESS(reg, tmp) \
ldr tmp, =has_pan; /* Get the addr of has_pan */ \
ldr reg, [tmp]; /* Read it */ \
cbz reg, 997f; /* If no PAN skip */ \
.arch_extension pan; \
msr pan, #0; /* Disable PAN checks */ \
.arch_extension nopan; \
997:
#define EXIT_USER_ACCESS(reg) \
cbz reg, 998f; /* If no PAN skip */ \
.arch_extension pan; \
msr pan, #1; /* Enable PAN checks */ \
.arch_extension nopan; \
998:
#define EXIT_USER_ACCESS_CHECK(reg, tmp) \
ldr tmp, =has_pan; /* Get the addr of has_pan */ \
ldr reg, [tmp]; /* Read it */ \
cbz reg, 999f; /* If no PAN skip */ \
.arch_extension pan; \
msr pan, #1; /* Enable PAN checks */ \
.arch_extension nopan; \
999:
/*
* Some AArch64 CPUs speculate past an eret instruction. As the user may
* control the registers at this point add a speculation barrier usable on
* all AArch64 CPUs after the eret instruction.
* TODO: ARMv8.5 adds a specific instruction for this, we could use that
* if we know we are running on something that supports it.
*/
#define ERET \
eret; \
dsb sy; \
isb
/*
* When a CPU that implements FEAT_BTI uses a BR/BLR instruction (or the
* pointer authentication variants, e.g. BLRAA) and the target location
* has the GP attribute in its page table, then the target of the BR/BLR
* needs to be a valid BTI landing pad.
*
* BTI_C should be used at the start of a function and is used in the
* ENTRY macro. It can be replaced by PACIASP or PACIBSP, however these
* also need an appropriate authenticate instruction before returning.
*
* BTI_J should be used as the target instruction when branching with a
* BR instruction within a function.
*
* When using a BR to branch to a new function, e.g. a tail call, then
* the target register should be x16 or x17 so it is compatible with
* the BRI_C instruction.
*
* As these instructions are in the hint space they are a NOP when
* the CPU doesn't implement FEAT_BTI so are safe to use.
*/
#ifdef __ARM_FEATURE_BTI_DEFAULT
#define BTI_C hint #34
#define BTI_J hint #36
#else
#define BTI_C
#define BTI_J
#endif
/*
* To help protect against ROP attacks we can use Pointer Authentication
* to sign the return address before pushing it to the stack.
*
* PAC_LR_SIGN can be used at the start of a function to sign the link
* register with the stack pointer as the modifier. As this is in the hint
* space it is safe to use on CPUs that don't implement pointer
* authentication. It can be used in place of the BTI_C instruction above as
* a valid BTI landing pad instruction.
*
* PAC_LR_AUTH is used to authenticate the link register using the stack
* pointer as the modifier. It should be used in any function that uses
* PAC_LR_SIGN. The stack pointer must be identical in each case.
*/
#ifdef __ARM_FEATURE_PAC_DEFAULT
#define PAC_LR_SIGN hint #25 /* paciasp */
#define PAC_LR_AUTH hint #29 /* autiasp */
#else
#define PAC_LR_SIGN
#define PAC_LR_AUTH
#endif
/*
* GNU_PROPERTY_AARCH64_FEATURE_1_NOTE can be used to insert a note that
* the current assembly file is built with Pointer Authentication (PAC) or
* Branch Target Identification support (BTI). As the linker requires all
* object files in an executable or library to have the GNU property
* note to emit it in the created elf file we need to add a note to all
* assembly files that support BTI so the kernel and dynamic linker can
* mark memory used by the file as guarded.
*
* The GNU_PROPERTY_AARCH64_FEATURE_1_VAL macro encodes the combination
* of PAC and BTI that have been enabled. It can be used as follows:
* GNU_PROPERTY_AARCH64_FEATURE_1_NOTE(GNU_PROPERTY_AARCH64_FEATURE_1_VAL);
*
* To use this you need to include <sys/elf_common.h> for
* GNU_PROPERTY_AARCH64_FEATURE_1_*
*/
#if defined(__ARM_FEATURE_BTI_DEFAULT)
#if defined(__ARM_FEATURE_PAC_DEFAULT)
/* BTI, PAC */
#define GNU_PROPERTY_AARCH64_FEATURE_1_VAL \
(GNU_PROPERTY_AARCH64_FEATURE_1_BTI | GNU_PROPERTY_AARCH64_FEATURE_1_PAC)
#else
/* BTI, no PAC */
#define GNU_PROPERTY_AARCH64_FEATURE_1_VAL \
(GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
#endif
#elif defined(__ARM_FEATURE_PAC_DEFAULT)
/* No BTI, PAC */
#define GNU_PROPERTY_AARCH64_FEATURE_1_VAL \
(GNU_PROPERTY_AARCH64_FEATURE_1_PAC)
#else
/* No BTI, no PAC */
#define GNU_PROPERTY_AARCH64_FEATURE_1_VAL 0
#endif
#if defined(__ARM_FEATURE_BTI_DEFAULT) || defined(__ARM_FEATURE_PAC_DEFAULT)
#define GNU_PROPERTY_AARCH64_FEATURE_1_NOTE(x) \
.section .note.gnu.property, "a"; \
.balign 8; \
.4byte 0x4; /* sizeof(vendor) */ \
.4byte 0x10; /* sizeof(note data) */ \
.4byte (NT_GNU_PROPERTY_TYPE_0); \
.asciz "GNU"; /* vendor */ \
/* note data: */ \
.4byte (GNU_PROPERTY_AARCH64_FEATURE_1_AND); \
.4byte 0x4; /* sizeof(property) */ \
.4byte (x); /* property */ \
.4byte 0
#else
#define GNU_PROPERTY_AARCH64_FEATURE_1_NOTE(x)
#endif
#endif /* _MACHINE_ASM_H_ */
#endif /* !__arm__ */
|
