* [PATCH v3 0/2] Work around missing `bti c` in modules
@ 2022-09-02 0:15 D Scott Phillips
2022-09-02 0:15 ` [PATCH v3 1/2] arm64: Handle kernel BTI exceptions D Scott Phillips
2022-09-02 0:15 ` [PATCH v3 2/2] arm64: Work around missing `bti c` in modules D Scott Phillips
0 siblings, 2 replies; 5+ messages in thread
From: D Scott Phillips @ 2022-09-02 0:15 UTC (permalink / raw)
To: Mark Brown, linux-arm-kernel; +Cc: Catalin Marinas, Will Deacon, patches
Changes since v2:
- Split the kernel BTI exception behavior change into a separate patch
Changes since v1:
- Add the gcc bug id into the traps.c comment
- Cover the try_module_get with the preempt_disable
- Add a CC_HAS_ config for the compiler bug that we'll eventually refine
D Scott Phillips (2):
arm64: Handle kernel BTI exceptions
arm64: Work around missing `bti c` in modules
arch/arm64/Kconfig | 3 +++
arch/arm64/kernel/entry-common.c | 12 +++++++++
arch/arm64/kernel/traps.c | 43 ++++++++++++++++++++++++++++++--
3 files changed, 56 insertions(+), 2 deletions(-)
--
2.37.2
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v3 1/2] arm64: Handle kernel BTI exceptions
2022-09-02 0:15 [PATCH v3 0/2] Work around missing `bti c` in modules D Scott Phillips
@ 2022-09-02 0:15 ` D Scott Phillips
2022-09-02 10:28 ` Mark Brown
2022-09-02 0:15 ` [PATCH v3 2/2] arm64: Work around missing `bti c` in modules D Scott Phillips
1 sibling, 1 reply; 5+ messages in thread
From: D Scott Phillips @ 2022-09-02 0:15 UTC (permalink / raw)
To: Mark Brown, linux-arm-kernel; +Cc: Catalin Marinas, Will Deacon, patches
Send BTI exceptions to the do_bti handler, killing the current task with
SIGSEGV instead of panicking. This is to allow a later patch to apply a
compiler bug workaround.
Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
---
arch/arm64/kernel/entry-common.c | 12 ++++++++++++
arch/arm64/kernel/traps.c | 8 ++++++--
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index c75ca36b4a49..dad27e854d8c 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -388,6 +388,15 @@ static void noinstr el1_undef(struct pt_regs *regs)
exit_to_kernel_mode(regs);
}
+static void noinstr el1_bti(struct pt_regs *regs)
+{
+ enter_from_kernel_mode(regs);
+ local_daif_inherit(regs);
+ do_bti(regs);
+ local_daif_mask();
+ exit_to_kernel_mode(regs);
+}
+
static void noinstr el1_dbg(struct pt_regs *regs, unsigned long esr)
{
unsigned long far = read_sysreg(far_el1);
@@ -427,6 +436,9 @@ asmlinkage void noinstr el1h_64_sync_handler(struct pt_regs *regs)
case ESR_ELx_EC_UNKNOWN:
el1_undef(regs);
break;
+ case ESR_ELx_EC_BTI:
+ el1_bti(regs);
+ break;
case ESR_ELx_EC_BREAKPT_CUR:
case ESR_ELx_EC_SOFTSTP_CUR:
case ESR_ELx_EC_WATCHPT_CUR:
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index b7fed33981f7..56e1782fcf54 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -501,8 +501,12 @@ NOKPROBE_SYMBOL(do_undefinstr);
void do_bti(struct pt_regs *regs)
{
- BUG_ON(!user_mode(regs));
- force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
+ if (user_mode(regs)) {
+ force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
+ return;
+ }
+
+ die("Oops - BTI", regs, 0);
}
NOKPROBE_SYMBOL(do_bti);
--
2.37.2
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v3 2/2] arm64: Work around missing `bti c` in modules
2022-09-02 0:15 [PATCH v3 0/2] Work around missing `bti c` in modules D Scott Phillips
2022-09-02 0:15 ` [PATCH v3 1/2] arm64: Handle kernel BTI exceptions D Scott Phillips
@ 2022-09-02 0:15 ` D Scott Phillips
2022-09-02 11:32 ` Mark Brown
1 sibling, 1 reply; 5+ messages in thread
From: D Scott Phillips @ 2022-09-02 0:15 UTC (permalink / raw)
To: Mark Brown, linux-arm-kernel; +Cc: Catalin Marinas, Will Deacon, patches
GCC does not insert a `bti c` instruction at the beginning of a function
when all callers reach the function through a direct branch[1]. In the case
of cross-section calls (like __init to non __init), a thunk may be inserted
which uses an indirect branch. If that happens, the first instruction in
the callee function will result in a Branch Target Exception due to the
missing `bti c`.
Handle Branch Target Exceptions which happen in the kernel due to module
calls from __init to non-__init by clearing PSTATE.BTYPE and resuming.
[1]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106671
Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
---
arch/arm64/Kconfig | 3 +++
arch/arm64/kernel/traps.c | 35 +++++++++++++++++++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 9fb9fff08c94..8038842fa6b9 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1896,6 +1896,9 @@ config ARM64_BTI_KERNEL
is enabled and the system supports BTI all kernel code including
modular code must have BTI enabled.
+config CC_HAS_CROSS_SECTION_BTI_MISSING
+ def_bool CC_IS_GCC # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106671
+
config CC_HAS_BRANCH_PROT_PAC_RET_BTI
# GCC 9 or later, clang 8 or later
def_bool $(cc-option,-mbranch-protection=pac-ret+leaf+bti)
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 56e1782fcf54..315a305a4f1d 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -501,11 +501,46 @@ NOKPROBE_SYMBOL(do_undefinstr);
void do_bti(struct pt_regs *regs)
{
+ struct module *mod;
+
if (user_mode(regs)) {
force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
return;
}
+ /*
+ * GCC does not insert a `bti c` instruction at the beginning
+ * of a function when all callers reach the function through a
+ * direct branch. In the case of cross-section calls (like
+ * __init to non __init), a thunk may be inserted which uses
+ * an indirect branch. If that happens, the first instruction
+ * in the callee function will result in a Branch Target
+ * Exception due to the missing `bti c`.
+ *
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106671
+ *
+ * If that's the case here, clear PSTATE.BTYPE and resume.
+ */
+ if (IS_ENABLED(CONFIG_CC_HAS_CROSS_SECTION_BTI_MISSING)) {
+ preempt_disable();
+ mod = __module_text_address(regs->pc);
+
+ if (mod && try_module_get(mod)) {
+ bool from_init;
+
+ from_init = within_module_init(regs->regs[30], mod);
+ module_put(mod);
+
+ if (from_init) {
+ preempt_enable();
+ regs->pstate &= ~PSR_BTYPE_MASK;
+ return;
+ }
+ }
+
+ preempt_enable();
+ }
+
die("Oops - BTI", regs, 0);
}
NOKPROBE_SYMBOL(do_bti);
--
2.37.2
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3 1/2] arm64: Handle kernel BTI exceptions
2022-09-02 0:15 ` [PATCH v3 1/2] arm64: Handle kernel BTI exceptions D Scott Phillips
@ 2022-09-02 10:28 ` Mark Brown
0 siblings, 0 replies; 5+ messages in thread
From: Mark Brown @ 2022-09-02 10:28 UTC (permalink / raw)
To: D Scott Phillips; +Cc: linux-arm-kernel, Catalin Marinas, Will Deacon, patches
[-- Attachment #1.1: Type: text/plain, Size: 609 bytes --]
On Thu, Sep 01, 2022 at 05:15:50PM -0700, D Scott Phillips wrote:
> Send BTI exceptions to the do_bti handler, killing the current task with
> SIGSEGV instead of panicking. This is to allow a later patch to apply a
> compiler bug workaround.
There's arguments either way here - this is less destructive, but you
could say that since these exceptions are supposed to indicate a
security issue stopping the whole kernel has some safety advantages,
though it does also open up DoS opportunities. I don't have a strong
opinion here, I mildly prefer this approach.
Reviewed-by: Mark Brown <broonie@kernel.org>
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
[-- Attachment #2: Type: text/plain, Size: 176 bytes --]
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3 2/2] arm64: Work around missing `bti c` in modules
2022-09-02 0:15 ` [PATCH v3 2/2] arm64: Work around missing `bti c` in modules D Scott Phillips
@ 2022-09-02 11:32 ` Mark Brown
0 siblings, 0 replies; 5+ messages in thread
From: Mark Brown @ 2022-09-02 11:32 UTC (permalink / raw)
To: D Scott Phillips; +Cc: linux-arm-kernel, Catalin Marinas, Will Deacon, patches
[-- Attachment #1.1: Type: text/plain, Size: 511 bytes --]
On Thu, Sep 01, 2022 at 05:15:51PM -0700, D Scott Phillips wrote:
> GCC does not insert a `bti c` instruction at the beginning of a function
> when all callers reach the function through a direct branch[1]. In the case
> of cross-section calls (like __init to non __init), a thunk may be inserted
> which uses an indirect branch. If that happens, the first instruction in
> the callee function will result in a Branch Target Exception due to the
> missing `bti c`.
Reviewed-by: Mark Brown <broonie@kernel.org>
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
[-- Attachment #2: Type: text/plain, Size: 176 bytes --]
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-09-02 11:34 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-02 0:15 [PATCH v3 0/2] Work around missing `bti c` in modules D Scott Phillips
2022-09-02 0:15 ` [PATCH v3 1/2] arm64: Handle kernel BTI exceptions D Scott Phillips
2022-09-02 10:28 ` Mark Brown
2022-09-02 0:15 ` [PATCH v3 2/2] arm64: Work around missing `bti c` in modules D Scott Phillips
2022-09-02 11:32 ` Mark Brown
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.