pointer-auth-aarch64.cc (7978B)
1 // Copyright 2018, VIXL authors 2 // All rights reserved. 3 // 4 // Redistribution and use in source and binary forms, with or without 5 // modification, are permitted provided that the following conditions are met: 6 // 7 // * Redistributions of source code must retain the above copyright notice, 8 // this list of conditions and the following disclaimer. 9 // * Redistributions in binary form must reproduce the above copyright notice, 10 // this list of conditions and the following disclaimer in the documentation 11 // and/or other materials provided with the distribution. 12 // * Neither the name of ARM Limited nor the names of its contributors may be 13 // used to endorse or promote products derived from this software without 14 // specific prior written permission. 15 // 16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS CONTRIBUTORS "AS IS" AND 17 // ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 18 // WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 19 // DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE 20 // FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 // DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 22 // SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 23 // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 25 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 27 #ifdef VIXL_INCLUDE_SIMULATOR_AARCH64 28 29 #include "utils-vixl.h" 30 31 #include "simulator-aarch64.h" 32 33 namespace vixl { 34 namespace aarch64 { 35 36 // Randomly generated example keys for simulating only. 37 const Simulator::PACKey Simulator::kPACKeyIA = {0xc31718727de20f71, 38 0xab9fd4e14b2fec51, 39 0}; 40 const Simulator::PACKey Simulator::kPACKeyIB = {0xeebb163b474e04c8, 41 0x5267ac6fc280fb7c, 42 1}; 43 const Simulator::PACKey Simulator::kPACKeyDA = {0x5caef808deb8b1e2, 44 0xd347cbc06b7b0f77, 45 0}; 46 const Simulator::PACKey Simulator::kPACKeyDB = {0xe06aa1a949ba8cc7, 47 0xcfde69e3db6d0432, 48 1}; 49 50 // The general PAC key isn't intended to be used with AuthPAC so we ensure the 51 // key number is invalid and asserts if used incorrectly. 52 const Simulator::PACKey Simulator::kPACKeyGA = {0xfcd98a44d564b3d5, 53 0x6c56df1904bf0ddc, 54 -1}; 55 56 static uint64_t GetNibble(uint64_t in_data, int position) { 57 return (in_data >> position) & 0xf; 58 } 59 60 static uint64_t ShuffleNibbles(uint64_t in_data) { 61 static int in_positions[16] = 62 {4, 36, 52, 40, 44, 0, 24, 12, 56, 60, 8, 32, 16, 28, 20, 48}; 63 uint64_t out_data = 0; 64 for (int i = 0; i < 16; i++) { 65 out_data |= GetNibble(in_data, in_positions[i]) << (4 * i); 66 } 67 return out_data; 68 } 69 70 static uint64_t SubstituteNibbles(uint64_t in_data) { 71 // Randomly chosen substitutes. 72 static uint64_t subs[16] = 73 {4, 7, 3, 9, 10, 14, 0, 1, 15, 2, 8, 6, 12, 5, 11, 13}; 74 uint64_t out_data = 0; 75 for (int i = 0; i < 16; i++) { 76 int index = (in_data >> (4 * i)) & 0xf; 77 out_data |= subs[index] << (4 * i); 78 } 79 return out_data; 80 } 81 82 // Rotate nibble to the left by the amount specified. 83 static uint64_t RotNibble(uint64_t in_cell, int amount) { 84 VIXL_ASSERT((amount >= 0) && (amount <= 3)); 85 86 in_cell &= 0xf; 87 uint64_t temp = (in_cell << 4) | in_cell; 88 return (temp >> (4 - amount)) & 0xf; 89 } 90 91 static uint64_t BigShuffle(uint64_t in_data) { 92 uint64_t out_data = 0; 93 for (int i = 0; i < 4; i++) { 94 uint64_t n12 = GetNibble(in_data, 4 * (i + 12)); 95 uint64_t n8 = GetNibble(in_data, 4 * (i + 8)); 96 uint64_t n4 = GetNibble(in_data, 4 * (i + 4)); 97 uint64_t n0 = GetNibble(in_data, 4 * (i + 0)); 98 99 uint64_t t0 = RotNibble(n8, 2) ^ RotNibble(n4, 1) ^ RotNibble(n0, 1); 100 uint64_t t1 = RotNibble(n12, 1) ^ RotNibble(n4, 2) ^ RotNibble(n0, 1); 101 uint64_t t2 = RotNibble(n12, 2) ^ RotNibble(n8, 1) ^ RotNibble(n0, 1); 102 uint64_t t3 = RotNibble(n12, 1) ^ RotNibble(n8, 1) ^ RotNibble(n4, 2); 103 104 out_data |= t3 << (4 * (i + 0)); 105 out_data |= t2 << (4 * (i + 4)); 106 out_data |= t1 << (4 * (i + 8)); 107 out_data |= t0 << (4 * (i + 12)); 108 } 109 return out_data; 110 } 111 112 // A simple, non-standard hash function invented for simulating. It mixes 113 // reasonably well, however it is unlikely to be cryptographically secure and 114 // may have a higher collision chance than other hashing algorithms. 115 uint64_t Simulator::ComputePAC(uint64_t data, uint64_t context, PACKey key) { 116 uint64_t working_value = data ^ key.high; 117 working_value = BigShuffle(working_value); 118 working_value = ShuffleNibbles(working_value); 119 working_value ^= key.low; 120 working_value = ShuffleNibbles(working_value); 121 working_value = BigShuffle(working_value); 122 working_value ^= context; 123 working_value = SubstituteNibbles(working_value); 124 working_value = BigShuffle(working_value); 125 working_value = SubstituteNibbles(working_value); 126 127 return working_value; 128 } 129 130 // The TTBR is selected by bit 63 or 55 depending on TBI for pointers without 131 // codes, but is always 55 once a PAC code is added to a pointer. For this 132 // reason, it must be calculated at the call site. 133 uint64_t Simulator::CalculatePACMask(uint64_t ptr, PointerType type, int ttbr) { 134 int bottom_pac_bit = GetBottomPACBit(ptr, ttbr); 135 int top_pac_bit = GetTopPACBit(ptr, type); 136 return ExtractUnsignedBitfield64(top_pac_bit, 137 bottom_pac_bit, 138 0xffffffffffffffff & ~kTTBRMask) 139 << bottom_pac_bit; 140 } 141 142 uint64_t Simulator::AuthPAC(uint64_t ptr, 143 uint64_t context, 144 PACKey key, 145 PointerType type) { 146 VIXL_ASSERT((key.number == 0) || (key.number == 1)); 147 148 uint64_t pac_mask = CalculatePACMask(ptr, type, (ptr >> 55) & 1); 149 uint64_t original_ptr = 150 ((ptr & kTTBRMask) == 0) ? (ptr & ~pac_mask) : (ptr | pac_mask); 151 152 uint64_t pac = ComputePAC(original_ptr, context, key); 153 154 uint64_t error_code = 1 << key.number; 155 if ((pac & pac_mask) == (ptr & pac_mask)) { 156 return original_ptr; 157 } else { 158 int error_lsb = GetTopPACBit(ptr, type) - 2; 159 uint64_t error_mask = UINT64_C(0x3) << error_lsb; 160 return (original_ptr & ~error_mask) | (error_code << error_lsb); 161 } 162 } 163 164 uint64_t Simulator::AddPAC(uint64_t ptr, 165 uint64_t context, 166 PACKey key, 167 PointerType type) { 168 int top_pac_bit = GetTopPACBit(ptr, type); 169 170 // TODO: Properly handle the case where extension bits are bad and TBI is 171 // turned off, and also test me. 172 VIXL_ASSERT(HasTBI(ptr, type)); 173 int ttbr = (ptr >> 55) & 1; 174 uint64_t pac_mask = CalculatePACMask(ptr, type, ttbr); 175 uint64_t ext_ptr = (ttbr == 0) ? (ptr & ~pac_mask) : (ptr | pac_mask); 176 177 uint64_t pac = ComputePAC(ext_ptr, context, key); 178 179 // If the pointer isn't all zeroes or all ones in the PAC bitfield, corrupt 180 // the resulting code. 181 if (((ptr & (pac_mask | kTTBRMask)) != 0x0) && 182 ((~ptr & (pac_mask | kTTBRMask)) != 0x0)) { 183 pac ^= UINT64_C(1) << (top_pac_bit - 1); 184 } 185 186 uint64_t ttbr_shifted = static_cast<uint64_t>(ttbr) << 55; 187 return (pac & pac_mask) | ttbr_shifted | (ptr & ~pac_mask); 188 } 189 190 uint64_t Simulator::StripPAC(uint64_t ptr, PointerType type) { 191 uint64_t pac_mask = CalculatePACMask(ptr, type, (ptr >> 55) & 1); 192 return ((ptr & kTTBRMask) == 0) ? (ptr & ~pac_mask) : (ptr | pac_mask); 193 } 194 } // namespace aarch64 195 } // namespace vixl 196 197 #endif // VIXL_INCLUDE_SIMULATOR_AARCH64