PAC key changes when kernel code is preempted

[Derrick McKee]

On Fri, Apr 30, 2021 at 11:04 AM Mark Rutland <mark.rutland at arm.com> wrote:
>
> On Fri, Apr 30, 2021 at 10:40:04AM -0400, Derrick McKee wrote:
> > Hi,
> >
> > I am noticing that when kernel code is preempted, PAC keys seem to
> > change when resuming execution.  For instance, when I read
> > APDAKeyHi_EL1 and APDAKeyLo_EL1, sleep, and read them again, the
> > values are different.  Is this the intended behavior?
>
> This is expected; kernel-side we only use the IA keys (which should stay
> the same from a kernel task's PoV), and the other keys (IB, DA, DB, GA)
> are not supposed to be used within the kernel.
>
> Up to and including v5.12, the other keys are switched at entry to/from
> userspace, and so may change from the PoV of a kernel thread across
> preemption.

Thanks for the response.  When was the preservation and restoration of
the IA key added to the kernel, because in my 5.10 code base, I am
seeing the IA key change for the kernel between system calls.

> With the patches merged for v5.13, the other keys will be
> switched with the task, but userspace can reset these at any time, and
> they are still not supposed to be used within the kernel.
>
> > If so, how can I ensure that the keys do not change?  The different
> > keys are causing PAC authentication to fail on pointers signed using
> > the stale key.  Thanks.
>
> I take it this is non-mainline code? We shouldn't be using the other
> keys today.

Yeah, I'm a doctorate researcher attempting to combine PAC and MTE to
harden kernel modules, which is why I am trying to make sure PAC keys
are the same. Pointers to kernel data are being signed and
authenticated using different keys.  It actually doesn't matter for
our purposes what key is used, just that the key remains the same
whenever kernel code gets executed.

Thanks.
--
Derrick McKee