From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933367AbdC3RC7 (ORCPT ); Thu, 30 Mar 2017 13:02:59 -0400 Received: from mail-it0-f50.google.com ([209.85.214.50]:35121 "EHLO mail-it0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750766AbdC3RC6 (ORCPT ); Thu, 30 Mar 2017 13:02:58 -0400 MIME-Version: 1.0 In-Reply-To: <466B31B4-0535-44EE-B0F0-F758A79A7B4F@gmail.com> References: <1490811363-93944-1-git-send-email-keescook@chromium.org> <1490811363-93944-2-git-send-email-keescook@chromium.org> <466B31B4-0535-44EE-B0F0-F758A79A7B4F@gmail.com> From: Kees Cook Date: Thu, 30 Mar 2017 10:02:55 -0700 X-Google-Sender-Auth: NVDvkszHOWcwN69HszD68fDOsNg Message-ID: Subject: Re: [RFC v2][PATCH 01/11] Introduce rare_write() infrastructure To: Ho-Eun Ryu Cc: "kernel-hardening@lists.openwall.com" , Mark Rutland , Andy Lutomirski , PaX Team , Emese Revfy , Russell King , "x86@kernel.org" , LKML , "linux-arm-kernel@lists.infradead.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Mar 30, 2017 at 12:44 AM, Ho-Eun Ryu wrote: > >> On 30 Mar 2017, at 3:23 AM, Kees Cook wrote: >> >> On Wed, Mar 29, 2017 at 11:15 AM, Kees Cook wrote: >>> +/* >>> + * Build "write rarely" infrastructure for flipping memory r/w >>> + * on a per-CPU basis. >>> + */ >>> +#ifndef CONFIG_HAVE_ARCH_RARE_WRITE >>> +# define __wr_rare >>> +# define __wr_rare_type >>> +# define __rare_write(__var, __val) (__var = (__val)) >>> +# define rare_write_begin() do { } while (0) >>> +# define rare_write_end() do { } while (0) >>> +#else >>> +# define __wr_rare __ro_after_init >>> +# define __wr_rare_type const >>> +# ifdef CONFIG_HAVE_ARCH_RARE_WRITE_MEMCPY >>> +# define __rare_write_n(dst, src, len) ({ \ >>> + BUILD_BUG(!builtin_const(len)); \ >>> + __arch_rare_write_memcpy((dst), (src), (len)); \ >>> + }) >>> +# define __rare_write(var, val) __rare_write_n(&(var), &(val), sizeof(var)) >>> +# else >>> +# define __rare_write(var, val) ((*(typeof((typeof(var))0) *)&(var)) = (val)) >>> +# endif >>> +# define rare_write_begin() __arch_rare_write_begin() >>> +# define rare_write_end() __arch_rare_write_end() >>> +#endif >>> +#define rare_write(__var, __val) ({ \ >>> + rare_write_begin(); \ >>> + __rare_write(__var, __val); \ >>> + rare_write_end(); \ >>> + __var; \ >>> +}) >>> + >> >> Of course, only after sending this do I realize that the MEMCPY case >> will need to be further adjusted, since it currently can't take >> literals. I guess something like this needs to be done: >> >> #define __rare_write(var, val) ({ \ >> typeof(var) __src = (val); \ >> __rare_write_n(&(var), &(__src), sizeof(var)); \ >> }) >> > > Right, and it has a problem with BUILD_BUG, which causes compilation error when CONFIG_HABE_ARCH_RARE_WRITE_MEMCPY is true > BUILD_BUG is defined in but includes > > Please see the following. > > diff --git a/include/linux/compiler.h b/include/linux/compiler.h > index 3334fa9..3fa50e1 100644 > --- a/include/linux/compiler.h > +++ b/include/linux/compiler.h > @@ -350,11 +350,11 @@ static __always_inline void __write_once_size(volatile vo\ > id *p, void *res, int s > # define __wr_rare __ro_after_init > # define __wr_rare_type const > # ifdef CONFIG_HAVE_ARCH_RARE_WRITE_MEMCPY > -# define __rare_write_n(dst, src, len) ({ \ > - BUILD_BUG(!builtin_const(len)); \ > - __arch_rare_write_memcpy((dst), (src), (len)); \ > +# define __rare_write_n(var, val, len) ({ \ > + typeof(val) __val = val; \ > + __arch_rare_write_memcpy(&(var), &(__val), (len)); \ > }) > -# define __rare_write(var, val) __rare_write_n(&(var), &(val), sizeof(var)) > +# define __rare_write(var, val) __rare_write_n((var), (val), sizeof(var)) > # else > # define __rare_write(var, val) ((*(typeof((typeof(var))0) *)&(var)) = (val)\ > ) > # endif Thanks for the catch, I'll update this (I'll use compiletime_assert, which is defined in compiler.h). -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: keescook@chromium.org (Kees Cook) Date: Thu, 30 Mar 2017 10:02:55 -0700 Subject: [RFC v2][PATCH 01/11] Introduce rare_write() infrastructure In-Reply-To: <466B31B4-0535-44EE-B0F0-F758A79A7B4F@gmail.com> References: <1490811363-93944-1-git-send-email-keescook@chromium.org> <1490811363-93944-2-git-send-email-keescook@chromium.org> <466B31B4-0535-44EE-B0F0-F758A79A7B4F@gmail.com> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Thu, Mar 30, 2017 at 12:44 AM, Ho-Eun Ryu wrote: > >> On 30 Mar 2017, at 3:23 AM, Kees Cook wrote: >> >> On Wed, Mar 29, 2017 at 11:15 AM, Kees Cook wrote: >>> +/* >>> + * Build "write rarely" infrastructure for flipping memory r/w >>> + * on a per-CPU basis. >>> + */ >>> +#ifndef CONFIG_HAVE_ARCH_RARE_WRITE >>> +# define __wr_rare >>> +# define __wr_rare_type >>> +# define __rare_write(__var, __val) (__var = (__val)) >>> +# define rare_write_begin() do { } while (0) >>> +# define rare_write_end() do { } while (0) >>> +#else >>> +# define __wr_rare __ro_after_init >>> +# define __wr_rare_type const >>> +# ifdef CONFIG_HAVE_ARCH_RARE_WRITE_MEMCPY >>> +# define __rare_write_n(dst, src, len) ({ \ >>> + BUILD_BUG(!builtin_const(len)); \ >>> + __arch_rare_write_memcpy((dst), (src), (len)); \ >>> + }) >>> +# define __rare_write(var, val) __rare_write_n(&(var), &(val), sizeof(var)) >>> +# else >>> +# define __rare_write(var, val) ((*(typeof((typeof(var))0) *)&(var)) = (val)) >>> +# endif >>> +# define rare_write_begin() __arch_rare_write_begin() >>> +# define rare_write_end() __arch_rare_write_end() >>> +#endif >>> +#define rare_write(__var, __val) ({ \ >>> + rare_write_begin(); \ >>> + __rare_write(__var, __val); \ >>> + rare_write_end(); \ >>> + __var; \ >>> +}) >>> + >> >> Of course, only after sending this do I realize that the MEMCPY case >> will need to be further adjusted, since it currently can't take >> literals. I guess something like this needs to be done: >> >> #define __rare_write(var, val) ({ \ >> typeof(var) __src = (val); \ >> __rare_write_n(&(var), &(__src), sizeof(var)); \ >> }) >> > > Right, and it has a problem with BUILD_BUG, which causes compilation error when CONFIG_HABE_ARCH_RARE_WRITE_MEMCPY is true > BUILD_BUG is defined in but includes > > Please see the following. > > diff --git a/include/linux/compiler.h b/include/linux/compiler.h > index 3334fa9..3fa50e1 100644 > --- a/include/linux/compiler.h > +++ b/include/linux/compiler.h > @@ -350,11 +350,11 @@ static __always_inline void __write_once_size(volatile vo\ > id *p, void *res, int s > # define __wr_rare __ro_after_init > # define __wr_rare_type const > # ifdef CONFIG_HAVE_ARCH_RARE_WRITE_MEMCPY > -# define __rare_write_n(dst, src, len) ({ \ > - BUILD_BUG(!builtin_const(len)); \ > - __arch_rare_write_memcpy((dst), (src), (len)); \ > +# define __rare_write_n(var, val, len) ({ \ > + typeof(val) __val = val; \ > + __arch_rare_write_memcpy(&(var), &(__val), (len)); \ > }) > -# define __rare_write(var, val) __rare_write_n(&(var), &(val), sizeof(var)) > +# define __rare_write(var, val) __rare_write_n((var), (val), sizeof(var)) > # else > # define __rare_write(var, val) ((*(typeof((typeof(var))0) *)&(var)) = (val)\ > ) > # endif Thanks for the catch, I'll update this (I'll use compiletime_assert, which is defined in compiler.h). -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: <466B31B4-0535-44EE-B0F0-F758A79A7B4F@gmail.com> References: <1490811363-93944-1-git-send-email-keescook@chromium.org> <1490811363-93944-2-git-send-email-keescook@chromium.org> <466B31B4-0535-44EE-B0F0-F758A79A7B4F@gmail.com> From: Kees Cook Date: Thu, 30 Mar 2017 10:02:55 -0700 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [RFC v2][PATCH 01/11] Introduce rare_write() infrastructure To: Ho-Eun Ryu Cc: "kernel-hardening@lists.openwall.com" , Mark Rutland , Andy Lutomirski , PaX Team , Emese Revfy , Russell King , "x86@kernel.org" , LKML , "linux-arm-kernel@lists.infradead.org" List-ID: On Thu, Mar 30, 2017 at 12:44 AM, Ho-Eun Ryu wrote: > >> On 30 Mar 2017, at 3:23 AM, Kees Cook wrote: >> >> On Wed, Mar 29, 2017 at 11:15 AM, Kees Cook wrote: >>> +/* >>> + * Build "write rarely" infrastructure for flipping memory r/w >>> + * on a per-CPU basis. >>> + */ >>> +#ifndef CONFIG_HAVE_ARCH_RARE_WRITE >>> +# define __wr_rare >>> +# define __wr_rare_type >>> +# define __rare_write(__var, __val) (__var = (__val)) >>> +# define rare_write_begin() do { } while (0) >>> +# define rare_write_end() do { } while (0) >>> +#else >>> +# define __wr_rare __ro_after_init >>> +# define __wr_rare_type const >>> +# ifdef CONFIG_HAVE_ARCH_RARE_WRITE_MEMCPY >>> +# define __rare_write_n(dst, src, len) ({ \ >>> + BUILD_BUG(!builtin_const(len)); \ >>> + __arch_rare_write_memcpy((dst), (src), (len)); \ >>> + }) >>> +# define __rare_write(var, val) __rare_write_n(&(var), &(val), sizeof(var)) >>> +# else >>> +# define __rare_write(var, val) ((*(typeof((typeof(var))0) *)&(var)) = (val)) >>> +# endif >>> +# define rare_write_begin() __arch_rare_write_begin() >>> +# define rare_write_end() __arch_rare_write_end() >>> +#endif >>> +#define rare_write(__var, __val) ({ \ >>> + rare_write_begin(); \ >>> + __rare_write(__var, __val); \ >>> + rare_write_end(); \ >>> + __var; \ >>> +}) >>> + >> >> Of course, only after sending this do I realize that the MEMCPY case >> will need to be further adjusted, since it currently can't take >> literals. I guess something like this needs to be done: >> >> #define __rare_write(var, val) ({ \ >> typeof(var) __src = (val); \ >> __rare_write_n(&(var), &(__src), sizeof(var)); \ >> }) >> > > Right, and it has a problem with BUILD_BUG, which causes compilation error when CONFIG_HABE_ARCH_RARE_WRITE_MEMCPY is true > BUILD_BUG is defined in but includes > > Please see the following. > > diff --git a/include/linux/compiler.h b/include/linux/compiler.h > index 3334fa9..3fa50e1 100644 > --- a/include/linux/compiler.h > +++ b/include/linux/compiler.h > @@ -350,11 +350,11 @@ static __always_inline void __write_once_size(volatile vo\ > id *p, void *res, int s > # define __wr_rare __ro_after_init > # define __wr_rare_type const > # ifdef CONFIG_HAVE_ARCH_RARE_WRITE_MEMCPY > -# define __rare_write_n(dst, src, len) ({ \ > - BUILD_BUG(!builtin_const(len)); \ > - __arch_rare_write_memcpy((dst), (src), (len)); \ > +# define __rare_write_n(var, val, len) ({ \ > + typeof(val) __val = val; \ > + __arch_rare_write_memcpy(&(var), &(__val), (len)); \ > }) > -# define __rare_write(var, val) __rare_write_n(&(var), &(val), sizeof(var)) > +# define __rare_write(var, val) __rare_write_n((var), (val), sizeof(var)) > # else > # define __rare_write(var, val) ((*(typeof((typeof(var))0) *)&(var)) = (val)\ > ) > # endif Thanks for the catch, I'll update this (I'll use compiletime_assert, which is defined in compiler.h). -Kees -- Kees Cook Pixel Security