1 /*- 2 * Copyright (c) 2014 Andrew Turner 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #ifndef _MACHINE_ASM_H_ 28 #define _MACHINE_ASM_H_ 29 30 #undef __FBSDID 31 #if !defined(lint) && !defined(STRIP_FBSDID) 32 #define __FBSDID(s) .ident s 33 #else 34 #define __FBSDID(s) /* nothing */ 35 #endif 36 37 #define _C_LABEL(x) x 38 39 #ifdef KDTRACE_HOOKS 40 #define DTRACE_NOP nop 41 #else 42 #define DTRACE_NOP 43 #endif 44 45 #define LENTRY(sym) \ 46 .text; .align 2; .type sym,#function; sym: \ 47 .cfi_startproc; BTI_C; DTRACE_NOP 48 #define ENTRY(sym) \ 49 .globl sym; LENTRY(sym) 50 #define EENTRY(sym) \ 51 .globl sym; .text; .align 2; .type sym,#function; sym: 52 #define LEND(sym) .ltorg; .cfi_endproc; .size sym, . - sym 53 #define END(sym) LEND(sym) 54 #define EEND(sym) 55 56 #define WEAK_REFERENCE(sym, alias) \ 57 .weak alias; \ 58 .set alias,sym 59 60 #define UINT64_C(x) (x) 61 62 #if defined(PIC) 63 #define PIC_SYM(x,y) x ## @ ## y 64 #else 65 #define PIC_SYM(x,y) x 66 #endif 67 68 /* Alias for link register x30 */ 69 #define lr x30 70 71 /* 72 * Sets the trap fault handler. The exception handler will return to the 73 * address in the handler register on a data abort or the xzr register to 74 * clear the handler. The tmp parameter should be a register able to hold 75 * the temporary data. 76 */ 77 #define SET_FAULT_HANDLER(handler, tmp) \ 78 ldr tmp, [x18, #PC_CURTHREAD]; /* Load curthread */ \ 79 ldr tmp, [tmp, #TD_PCB]; /* Load the pcb */ \ 80 str handler, [tmp, #PCB_ONFAULT] /* Set the handler */ 81 82 #define ENTER_USER_ACCESS(reg, tmp) \ 83 ldr tmp, =has_pan; /* Get the addr of has_pan */ \ 84 ldr reg, [tmp]; /* Read it */ \ 85 cbz reg, 997f; /* If no PAN skip */ \ 86 .inst 0xd500409f | (0 << 8); /* Clear PAN */ \ 87 997: 88 89 #define EXIT_USER_ACCESS(reg) \ 90 cbz reg, 998f; /* If no PAN skip */ \ 91 .inst 0xd500409f | (1 << 8); /* Set PAN */ \ 92 998: 93 94 #define EXIT_USER_ACCESS_CHECK(reg, tmp) \ 95 ldr tmp, =has_pan; /* Get the addr of has_pan */ \ 96 ldr reg, [tmp]; /* Read it */ \ 97 cbz reg, 999f; /* If no PAN skip */ \ 98 .inst 0xd500409f | (1 << 8); /* Set PAN */ \ 99 999: 100 101 /* 102 * Some AArch64 CPUs speculate past an eret instruction. As the user may 103 * control the registers at this point add a speculation barrier usable on 104 * all AArch64 CPUs after the eret instruction. 105 * TODO: ARMv8.5 adds a specific instruction for this, we could use that 106 * if we know we are running on something that supports it. 107 */ 108 #define ERET \ 109 eret; \ 110 dsb sy; \ 111 isb 112 113 /* 114 * When a CPU that implements FEAT_BTI uses a BR/BLR instruction (or the 115 * pointer authentication variants, e.g. BLRAA) and the target location 116 * has the GP attribute in its page table, then the target of the BR/BLR 117 * needs to be a valid BTI landing pad. 118 * 119 * BTI_C should be used at the start of a function and is used in the 120 * ENTRY macro. It can be replaced by PACIASP or PACIBSP, however these 121 * also need an appropriate authenticate instruction before returning. 122 * 123 * BTI_J should be used as the target instruction when branching with a 124 * BR instruction within a function. 125 * 126 * When using a BR to branch to a new function, e.g. a tail call, then 127 * the target register should be x16 or x17 so it is compatible with 128 * the BRI_C instruction. 129 * 130 * As these instructions are in the hint space they are a NOP when 131 * the CPU doesn't implement FEAT_BTI so are safe to use. 132 */ 133 #ifdef __ARM_FEATURE_BTI_DEFAULT 134 #define BTI_C hint #34 135 #define BTI_J hint #36 136 #else 137 #define BTI_C 138 #define BTI_J 139 #endif 140 141 /* 142 * To help protect against ROP attacks we can use Pointer Authentication 143 * to sign the return address before pushing it to the stack. 144 * 145 * PAC_LR_SIGN can be used at the start of a function to sign the link 146 * register with the stack pointer as the modifier. As this is in the hint 147 * space it is safe to use on CPUs that don't implement pointer 148 * authentication. It can be used in place of the BTI_C instruction above as 149 * a valid BTI landing pad instruction. 150 * 151 * PAC_LR_AUTH is used to authenticate the link register using the stack 152 * pointer as the modifier. It should be used in any function that uses 153 * PAC_LR_SIGN. The stack pointer must be identical in each case. 154 */ 155 #ifdef __ARM_FEATURE_PAC_DEFAULT 156 #define PAC_LR_SIGN hint #25 /* paciasp */ 157 #define PAC_LR_AUTH hint #29 /* autiasp */ 158 #else 159 #define PAC_LR_SIGN 160 #define PAC_LR_AUTH 161 #endif 162 163 /* 164 * GNU_PROPERTY_AARCH64_FEATURE_1_NOTE can be used to insert a note that 165 * the current assembly file is built with Pointer Authentication (PAC) or 166 * Branch Target Identification support (BTI). As the linker requires all 167 * object files in an executable or library to have the GNU property 168 * note to emit it in the created elf file we need to add a note to all 169 * assembly files that support BTI so the kernel and dynamic linker can 170 * mark memory used by the file as guarded. 171 * 172 * The GNU_PROPERTY_AARCH64_FEATURE_1_VAL macro encodes the combination 173 * of PAC and BTI that have been enabled. It can be used as follows: 174 * GNU_PROPERTY_AARCH64_FEATURE_1_NOTE(GNU_PROPERTY_AARCH64_FEATURE_1_VAL); 175 * 176 * To use this you need to include <sys/elf_common.h> for 177 * GNU_PROPERTY_AARCH64_FEATURE_1_* 178 */ 179 #if defined(__ARM_FEATURE_BTI_DEFAULT) 180 #if defined(__ARM_FEATURE_PAC_DEFAULT) 181 /* BTI, PAC */ 182 #define GNU_PROPERTY_AARCH64_FEATURE_1_VAL \ 183 (GNU_PROPERTY_AARCH64_FEATURE_1_BTI | GNU_PROPERTY_AARCH64_FEATURE_1_PAC) 184 #else 185 /* BTI, no PAC */ 186 #define GNU_PROPERTY_AARCH64_FEATURE_1_VAL \ 187 (GNU_PROPERTY_AARCH64_FEATURE_1_BTI) 188 #endif 189 #elif defined(__ARM_FEATURE_PAC_DEFAULT) 190 /* No BTI, PAC */ 191 #define GNU_PROPERTY_AARCH64_FEATURE_1_VAL \ 192 (GNU_PROPERTY_AARCH64_FEATURE_1_PAC) 193 #else 194 /* No BTI, no PAC */ 195 #define GNU_PROPERTY_AARCH64_FEATURE_1_VAL 0 196 #endif 197 198 #if defined(__ARM_FEATURE_BTI_DEFAULT) || defined(__ARM_FEATURE_PAC_DEFAULT) 199 #define GNU_PROPERTY_AARCH64_FEATURE_1_NOTE(x) \ 200 .section .note.gnu.property, "a"; \ 201 .balign 8; \ 202 .4byte 0x4; /* sizeof(vendor) */ \ 203 .4byte 0x10; /* sizeof(note data) */ \ 204 .4byte (NT_GNU_PROPERTY_TYPE_0); \ 205 .asciz "GNU"; /* vendor */ \ 206 /* note data: */ \ 207 .4byte (GNU_PROPERTY_AARCH64_FEATURE_1_AND); \ 208 .4byte 0x4; /* sizeof(property) */ \ 209 .4byte (x); /* property */ \ 210 .4byte 0 211 #else 212 #define GNU_PROPERTY_AARCH64_FEATURE_1_NOTE(x) 213 #endif 214 215 #endif /* _MACHINE_ASM_H_ */ 216