Hi Richard, Thanks again for this, and sorry for the radiosilence -- I broke my arm the weekend this was sent, and once I had recovered enough to use a computer again this had slipped off my TODO list.
I've just given this a go, applied atop of this morning's HEAD commit (ba2a9a9e6318bfd93a2306dec40137e198205b86), which only had trivial diff conflicts. With a somewhat instrumented kernel booted under TCG with cpu=max, I see: * pauth=off takes ~20s real time to boot to a prompt * pauth=on takes ~250s real time to boot to a prompt * pauth=on,pauth-impdef=true takes ~35s real time to boot to a prompt ... which is a significant improvement, and makes this usable for my testing setup! I also checked that this caught pointer modification, which it does: | # echo CORRUPT_PAC > /sys/kernel/debug/provoke-crash/DIRECT | [ 92.897446] lkdtm: Performing direct entry CORRUPT_PAC | [ 92.899007] lkdtm: changing PAC parameters to force function return failure... | [ 92.901989] Unable to handle kernel paging request at virtual address bfffbe2dc161abac | [ 92.904137] Mem abort info: | [ 92.905480] ESR = 0x86000004 | [ 92.906613] EC = 0x21: IABT (current EL), IL = 32 bits | [ 92.908480] SET = 0, FnV = 0 | [ 92.909381] EA = 0, S1PTW = 0 | [ 92.910566] [bfffbe2dc161abac] address between user and kernel address ranges | [ 92.913238] Internal error: Oops: 86000004 [#1] PREEMPT SMP | [ 92.915670] CPU: 1 PID: 244 Comm: bash Not tainted 5.9.0-rc3-00106-g2634241baafc #6 | [ 92.917251] Hardware name: linux,dummy-virt (DT) | [ 92.919361] pstate: 80400005 (Nzcv daif +PAN -UAO BTYPE=--) | [ 92.921284] pc : 0xbfffbe2dc161abac | [ 92.923882] lr : lkdtm_CORRUPT_PAC+0x84/0xc4 | [ 92.925219] sp : ffff800010583c80 | [ 92.926372] x29: ffff800010583c80 x28: ffff0001f5fac600 | [ 92.928594] x27: 0000000000000000 x26: ffffbe2dc2b6e648 | [ 92.930249] x25: ffff800010583df0 x24: 000000000000000c | [ 92.932146] x23: ffff0001f15fb000 x22: ffffbe2dc31dfdc0 | [ 92.933807] x21: ffffbe2dc2b6e728 x20: 000000000000000c | [ 92.935812] x19: 0000000000000001 x18: 0080000000000000 | [ 92.937663] x17: 0000000000000000 x16: 0000000000000000 | [ 92.939341] x15: 0000000000000001 x14: ffffbe2dc3e42810 | [ 92.940959] x13: 0000000000000001 x12: 0000000000000000 | [ 92.942679] x11: ffffbe2dc2e0f4c8 x10: ffffbe2dc2817530 | [ 92.944855] x9 : 6b20657479622d32 x8 : 3320646e61707865 | [ 92.946847] x7 : 00000000beb3692b x6 : ffff0001f5fad3d8 | [ 92.948936] x5 : ffff0001f5fac600 x4 : 0000000000000000 | [ 92.950721] x3 : ffffbe2dc0600000 x2 : ffffbe2dc2840000 | [ 92.952615] x1 : ffff0001f5fac600 x0 : 0000000000000000 | [ 92.954758] Call trace: | [ 92.956237] 0xbfffbe2dc161abac | [ 92.957753] lkdtm_do_action+0x3c/0x50 | [ 92.959378] direct_entry+0x1a4/0x268 | [ 92.961202] full_proxy_write+0x94/0xd8 | [ 92.962779] vfs_write+0x138/0x350 | [ 92.964500] ksys_write+0x98/0x168 | [ 92.965930] __arm64_sys_write+0x24/0x38 | [ 92.967731] el0_svc_common.constprop.3+0xe8/0x258 | [ 92.969384] do_el0_svc+0xb4/0xf8 | [ 92.970696] el0_sync_handler+0x1a8/0x218 | [ 92.972497] el0_sync+0x158/0x180 | [ 92.974560] Code: bad PC value | [ 92.976782] ---[ end trace 434c9ef9ca3d6114 ]--- ... so this all looks good to me, and it would be nice to see merged! Feel free to add: Tested-by: Mark Rutland <mark.rutl...@arm.com> Thanks, Mark.
