From patchwork Mon Jun 13 13:40:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 12879568 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 37760C433EF for ; Mon, 13 Jun 2022 13:42:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=bUj+9w5MJ3dk2GO3ZL0sg7Vce3cw+TgAMMHXe2FMD08=; b=NSEGIWmQoofaQd BDmugjrLPg3kyRgImU8ILy8FV/82//gceoLoblTlG6nsKGaTRjZeCw9LzhSTVpH+ueGHz8y2Uyy3E Fh0Mvk1L/g/0w0peWAEcPh96dhFNy8shRwBJpmMiQlX4O4gm3XK06XNA8rqjDoe9cSMZSTxrhVgID CsVCsPnisvjtaHvc3S5+q0z21/3Mt2Ow15+JJdnlXSUcBtsd76OqDpcH1s2sfrQ2PZFXzlcLPZwET 5aqeQjoWtcBM6+zcMM3ParkfMGsAM575VKrHdebhUjcJb8vc457R3otXH7qiOQ1gNModNX73bx/ko xN4fscrMyop3XOAMZ8Jg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1o0kJM-003v2T-Tk; Mon, 13 Jun 2022 13:40:57 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1o0kIp-003uew-1c for linux-arm-kernel@lists.infradead.org; Mon, 13 Jun 2022 13:40:24 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 43BA9613B3; Mon, 13 Jun 2022 13:40:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6C877C34114; Mon, 13 Jun 2022 13:40:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655127621; bh=LAFLikX1fVFWBmpKqtMNFJcbI/RikludPV81eUvQf6M=; h=From:To:Cc:Subject:Date:From; b=H7zyqBHYFUs0JkOYrZb+bTrlKWUpD8qSKjeUApVn6yYeDptSyFbAJKRwOitaKXGLg sVNUy0YuBuNZhmD99Aw8d6E1nK4Kbc5yOHXgUc0KTUh7Dqx4c+JhM01bUUPYtR/DVa U3SSUjSaPeqtIdMoItGQQdJ1bRs4uIATi4K6z4FFG6Opxn8Cx94o/DBaWixijg3oqg eML8v96iy5rZqoCPy1sddnsjUF9L9iW6sBsFbm8ld1ZWvU7825L1nb4ojKDmibsF+A wDkMhyIghx+Or7hYAv3PuSImHe49fpHVTt0oLa/lUARuIBKRRqO/xVzVlFqwAV1VAx spNQkn34wGPBA== From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org Cc: catalin.marinas@arm.com, will@kernel.org, mark.rutland@arm.com, maz@kernel.org, Ard Biesheuvel , Kees Cook , Sami Tolvanen , Fangrui Song , Nick Desaulniers , Dan Li Subject: [PATCH v3 0/3] arm64: dynamic shadow call stack support Date: Mon, 13 Jun 2022 15:40:05 +0200 Message-Id: <20220613134008.3760481-1-ardb@kernel.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4244; h=from:subject; bh=LAFLikX1fVFWBmpKqtMNFJcbI/RikludPV81eUvQf6M=; b=owEB7QES/pANAwAKAcNPIjmS2Y8kAcsmYgBipz4yWM2/oITmdpKgfNyMJxQm5OWEwDDcqI/enQgq IJnBo9eJAbMEAAEKAB0WIQT72WJ8QGnJQhU3VynDTyI5ktmPJAUCYqc+MgAKCRDDTyI5ktmPJOYUC/ 9wbA7CC+kMMrpP2ame+aqzpHZO9KcqaWeyCgot/wY3S3+EZ309FRK/j/Srf3aTGGi/cnpRoJV8DCpl D3fwzFV9zLPC1fZ+QwLLoPdXVwrU/JlP1d0KpVHo8ljB89h9qdXQYoE/iX0fM1DRdOxjhEXypt5k1u X++xnptUHDp4PEFsy4xamF9OAgG0tQiah9YGSjYEwmU0scOjPmMXY3cpJvDuBp+Ahu0KzzBQ+kVvzw ERx2J9OxjhG+0pY1wL4BQRZboadYBYFAZbPK61YWX1LigwYmvza+Ax0K+manyVULdnOhHUt+P7c8uZ dyJ50CRRQjBue+zvshYZwJ8kc1WX89vzDqZHkpruL8zcpakQCOmgexeMkaqLa7jwsBVZPya1Dyvtcv sCTEsuXqf0ipAZjAHX7s4C8ZcKZLhwXCnZN5arYekT1eoc2lqD6KAsXfxAg84I3g3atpDVJRV54Hid YyQRt5M+FVbc/Lcp9gVKZyUpNhqF8ZFqujluojX/zEe2E= X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220613_064023_215258_EC5DE005 X-CRM114-Status: GOOD ( 21.00 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Generic kernel images such as Android's GKI usually enable all available security features, which are typically implemented in such a way that they only take effect if the underlying hardware can support it, but don't interfere with correct and efficient operation otherwise. For shadow call stack support, which is always supported by the hardware, it means it will be enabled even if pointer authentication is also supported, and enabled for signing return addresses stored on the stack. The additional security provided by shadow call stack is only marginal in this case, whereas the performance overhead is not. Given that return address signing is based on PACIASP/AUTIASP instructions that implicitly operate on the return address register (X30) and are not idempotent (i.e., each needs to be emitted exactly once before the return address is stored on the ordinary stack and after it has been retrieved from it), we can convert these instruction 1:1 into shadow call stack pushes and pops involving the register X30. As this is something that can be done at runtime rather than build time, we can do this conditionally based on whether or not return address signing is supported on the underlying hardware. In order to be able to unwind call stacks that involve return address signing, whether or not the return address is currently signed is tracked by DWARF CFI directives in the unwinding metadata. This means we can use this information to locate all PACIASP/AUTIASP instructions in the binary, instead of having to use brute force and go over all instructions in the entire program. This series implements this approach for Clang, which has recently been fixed to emit all these CFI directives correctly. This series is based on an older PoC sent out last year [0] that targeted GCC only (due to this issue). This v3 targets Clang only, as GCC has its own issues with CFI accuracy. Changes since v2 [1]: - don't enable unwind table generation for nVHE code - it cannot be patched anyway so it has no use for it; - drop checks for ID reg overrides - fix some remaining TODOs regarding augmentation data and the code alignment factor - disable PAC for leaf functions when dynamic SCS is configured, so that we don't end up with SCS pushes and pops in all leaf functions too; - add I-cache maintenance after code patching - add Rb's from Nick and Kees. Changes since RFC v1: - implement boot time check for PAC/BTI support, and only enable dynamic SCS if neither are supported; - implement module patching as well; - switch to Clang, and drop workaround for GCC bug; [0] https://lore.kernel.org/linux-arm-kernel/20211013152243.2216899-1-ardb@kernel.org/ [1] https://lore.kernel.org/linux-arm-kernel/20220505161011.1801596-1-ardb@kernel.org/ Cc: Kees Cook Cc: Sami Tolvanen Cc: Fangrui Song Cc: Nick Desaulniers Cc: Dan Li Ard Biesheuvel (3): arm64: unwind: add asynchronous unwind tables to kernel and modules scs: add support for dynamic shadow call stacks arm64: implement dynamic shadow call stack for Clang Makefile | 2 + arch/Kconfig | 7 + arch/arm64/Kconfig | 12 + arch/arm64/Makefile | 15 +- arch/arm64/include/asm/module.lds.h | 8 + arch/arm64/include/asm/scs.h | 45 ++++ arch/arm64/kernel/Makefile | 2 + arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/irq.c | 2 +- arch/arm64/kernel/module.c | 8 + arch/arm64/kernel/patch-scs.c | 257 ++++++++++++++++++++ arch/arm64/kernel/sdei.c | 2 +- arch/arm64/kernel/setup.c | 4 + arch/arm64/kernel/vmlinux.lds.S | 13 + arch/arm64/kvm/hyp/nvhe/Makefile | 1 + drivers/firmware/efi/libstub/Makefile | 1 + include/linux/scs.h | 16 ++ kernel/scs.c | 14 +- 18 files changed, 406 insertions(+), 6 deletions(-) create mode 100644 arch/arm64/kernel/patch-scs.c