| Message ID | 1571300065-10236-1-git-send-email-amit.kachhap@arm.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | arm64: return address signing | expand |
Hi Amit, On 17/10/2019 09:14, Amit Daniel Kachhap wrote: > This series improves function return address protection for the arm64 kernel, by > compiling the kernel with ARMv8.3 Pointer Authentication instructions (ptrauth > referred hereafter). This should help protect the kernel against attacks using > return-oriented programming. > > Patch 9 and 10 are newly added and hence sent as RFC. Please don't mix 'RFC' in a series. If one patch is RFC, the whole series should be marked like that, including the cover letter. git format-patch's '--rfc' option will do this for you. If this is 'v3', please mark all the patches 'v3' too. Adding '-v 3' to git format-patch will do this for you. > High-level changes since RFC v2 [1] (detailed changes are listed in patches): > - Moved enabling, key setup and context switch to assembly, to avoid using > the pointer auth compiler attribute which Clang does not support (thanks > Suzuki for the initial code!). > - Added code to restore keys after cpu resume. > - __builtin_return_address will now mask pac bits. > - Changed gcc compiler options to add ptrauth instructions in all functions > and not just non-leaf functions. This may be revisited later due to > performance concerns. > - Rebased onto v5.4-rc2. > - Added Reviewed-by's. > This series do not implement few things or have known limitations: > - ftrace function tracer does not work with this series. But after using > the posted series [2] based on -fpatchable-function-entry, it works fine. > - kprobes/uprobes and other tracing may need some rework with ptrauth. > - kdump, other debug may need some rework with ptrauth. > - Generate some randomness for ptrauth keys during kernel early booting. Its good to have this list in the cover letter. (thanks!) Could you expand on the kprobes point? Is it emulating/stepping the ptrauth instructions, or stuff like kretprobes, that overwrite the lr? (arch_prepare_kretprobe()). (or both!) SDEI (firmware assisted NMI) may be called with the user-keys, kernel-keys, or half-way-through switching keys. I don't think this is a problem, it just means the key in use is unknown. Thanks, James > [1] https://lore.kernel.org/linux-arm-kernel/20190529190332.29753-1-kristina.martsenko@arm.com/ > [2] https://patchwork.kernel.org/patch/10803279/
Hi, On 10/23/19 11:01 PM, James Morse wrote: > Hi Amit, > > On 17/10/2019 09:14, Amit Daniel Kachhap wrote: >> This series improves function return address protection for the arm64 kernel, by >> compiling the kernel with ARMv8.3 Pointer Authentication instructions (ptrauth >> referred hereafter). This should help protect the kernel against attacks using >> return-oriented programming. >> >> Patch 9 and 10 are newly added and hence sent as RFC. > > Please don't mix 'RFC' in a series. If one patch is RFC, the whole series should be marked > like that, including the cover letter. git format-patch's '--rfc' option will do this for > you. > > If this is 'v3', please mark all the patches 'v3' too. Adding '-v 3' to git format-patch > will do this for you. Yes sure . I will do like this. > > >> High-level changes since RFC v2 [1] (detailed changes are listed in patches): >> - Moved enabling, key setup and context switch to assembly, to avoid using >> the pointer auth compiler attribute which Clang does not support (thanks >> Suzuki for the initial code!). >> - Added code to restore keys after cpu resume. >> - __builtin_return_address will now mask pac bits. >> - Changed gcc compiler options to add ptrauth instructions in all functions >> and not just non-leaf functions. This may be revisited later due to >> performance concerns. >> - Rebased onto v5.4-rc2. >> - Added Reviewed-by's. > >> This series do not implement few things or have known limitations: >> - ftrace function tracer does not work with this series. But after using >> the posted series [2] based on -fpatchable-function-entry, it works fine. >> - kprobes/uprobes and other tracing may need some rework with ptrauth. >> - kdump, other debug may need some rework with ptrauth. >> - Generate some randomness for ptrauth keys during kernel early booting. > > Its good to have this list in the cover letter. (thanks!) > > Could you expand on the kprobes point? Is it emulating/stepping the ptrauth instructions, > or stuff like kretprobes, that overwrite the lr? (arch_prepare_kretprobe()). > (or both!) Yes I should have expanded it here. Currently it is able step both PACIASP and AUTIASP instruction as krpobes/kretprobes keeps same register context. In negative case, kretprobe may cause some issue. Need to look more into it. > > SDEI (firmware assisted NMI) may be called with the user-keys, kernel-keys, or > half-way-through switching keys. I don't think this is a problem, it just means the key in > use is unknown. Thanks for pointing this out. Yes the ptrauth keys save/store may be added in SDEI handler. I will check more on it. Thanks, Amit Daniel > > > Thanks, > > James > > >> [1] https://lore.kernel.org/linux-arm-kernel/20190529190332.29753-1-kristina.martsenko@arm.com/ >> [2] https://patchwork.kernel.org/patch/10803279/