From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E108AC433DB for ; Wed, 17 Feb 2021 18:22:32 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9B28664E4A for ; Wed, 17 Feb 2021 18:22:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9B28664E4A Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Z5XQcvYlTIPXLME5fcv7gz5GAsF8pofD3e6uAkNbkYU=; b=jY/fIIN/CTXWo+0ZZ8350XKrh LAhaHwVLlPnpjLQ1NqhI+cPBON1qXtrftps2oYwJoXsPdzC+3mTIFtApmY8+EVwaSvP1THpD6usWu o9th1Jn3n1j/nci0ZJbnGBKJ7BDCdczhuhUhwKeHUZtTEK2g3RBDpNmvAUrLrYmo42+TMhg5VLt8M r0j86cti0UtYvhPZe5qZSJNgllNTsHqfJliZoF6wHOJ7BZjsUB/t7P8OwxRUP/xK33V0h/w8E/FEI FiRmk6C+8Hzh4QDtxnhnYPIQVLdERsFHPziEE0kuwYNm3eVSmERY3+ro27SPy7i1jrEvQoLPYTCF6 c7YARKg+A==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1lCRR3-0007t0-PK; Wed, 17 Feb 2021 18:20:25 +0000 Received: from mail-lf1-x132.google.com ([2a00:1450:4864:20::132]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1lCRR0-0007sQ-Lu for linux-arm-kernel@lists.infradead.org; Wed, 17 Feb 2021 18:20:23 +0000 Received: by mail-lf1-x132.google.com with SMTP id z11so23170551lfb.9 for ; Wed, 17 Feb 2021 10:20:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Y8i0g9QG9GcfcjV4SfK9KOZfpjS43yyxo3Zx1FaTpHg=; b=h7iUpSow9k12uVMOboB5Bjv17rWg/6jjYDY14S/c9H+JtKhmOqzKKU0SXNql5LMSHo 5QUI6VYKH41Q7OVNhB/oRl8/+8YHm/LpjROCeDAL45ObLLq2hUNpbu9IH/1Wm79tGcHw 7I/VLgzKKpQBdyOWC/bbaetILYY449szZWMu2hzrd6QIXUK6Su4OEsgmGEEmv+khIr+Z iv34uRIonT6ZvmaYzrb5/yPNbO6L3PG9NpOnmHBmEj/cnRPa0FJ9d3QXdUsaW3FPBHHs 7RXQ0sx29ZzqUml1Qp9wzvoD0y+zw1iV0vedpNOeo9itpeCTUZGdnKWeiE2ri6WPbIvE hnEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Y8i0g9QG9GcfcjV4SfK9KOZfpjS43yyxo3Zx1FaTpHg=; b=augmumMGzQplJXvoWgZWxntiRr6fNvtInlG5XQ4LTNVgsJo0uNiniI393mqEquRqDw eRv4gXro/54ApfZVxxnY5+5vt7phmy60uTHG3QEQ4Y69fPRbY/XB12Qgd+HWkFgRYEFd ianemUkse8K/LYN+XoU3Z/OCjY3v9n0XRwpcD1t346BjMmidLP6KPtktXy8lmsK8hivC V6pcXiwB4q/ewPUmjrli3rPons1s2ILzxaqAKE78VVsbuY/ja4+ldi5K+bGRBP2gpNJc Ia6GcSi/ySw2OKvTv8nVeZIvIva41JTlRQMRevRYy54apXD/mTnfX1/A67lOMTDZGtDy H9VQ== X-Gm-Message-State: AOAM530P8/kb7ugd3RV4AleHYuPmpwF7PUB4UI9+5xwYI3QMxQk9v/7e mtWr7Hsamx02lCDj7Sc+bnk89Y40YsTA7+p6TAZUsg== X-Google-Smtp-Source: ABdhPJxMOLeAZPfh9/xXXXpTBjyQSpSyJvRHbhY5s0MXSFezU+L7QBkjMpxGQPfs6EC3HXmAYL8YPvDdUF5+IFW0YzQ= X-Received: by 2002:a19:4013:: with SMTP id n19mr89135lfa.543.1613586018064; Wed, 17 Feb 2021 10:20:18 -0800 (PST) MIME-Version: 1.0 References: <3f61af0eee9b495e8e8c032902d033c5@AcuMS.aculab.com> <20210212195255.1321544-1-jiancai@google.com> In-Reply-To: <20210212195255.1321544-1-jiancai@google.com> From: Nick Desaulniers Date: Wed, 17 Feb 2021 10:20:06 -0800 Message-ID: Subject: Re: [PATCH v2] ARM: Implement Clang's SLS mitigation To: Jian Cai X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210217_132022_782910_18CA165F X-CRM114-Status: GOOD ( 25.54 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: LKML , Kees Cook , Arnd Bergmann , Catalin Marinas , Masahiro Yamada , Russell King , Krzysztof Kozlowski , James Morris , Nathan Chancellor , clang-built-linux , linux-security-module@vger.kernel.org, David Laight , Manoj Gupta , =?UTF-8?Q?Andreas_F=C3=A4rber?= , Luis Lozano , Will Deacon , Ard Biesheuvel , Linux ARM , "Serge E. Hallyn" Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Fri, Feb 12, 2021 at 11:53 AM 'Jian Cai' via Clang Built Linux wrote: The oneline of the commit is "ARM: Implement Clang's SLS mitigation," but that's not precise. GCC implements the same flag with the same arguments. There is nothing compiler specific about this patch. (Though perhaps different section names are used, see below). > > This patch adds CONFIG_HARDEN_SLS_ALL that can be used to turn on > -mharden-sls=all, which mitigates the straight-line speculation > vulnerability, speculative execution of the instruction following some > unconditional jumps. Notice -mharden-sls= has other options as below, > and this config turns on the strongest option. > > all: enable all mitigations against Straight Line Speculation that are implemented. > none: disable all mitigations against Straight Line Speculation. > retbr: enable the mitigation against Straight Line Speculation for RET and BR instructions. > blr: enable the mitigation against Straight Line Speculation for BLR instructions. > > Link: https://reviews.llvm.org/D93221 > Link: https://reviews.llvm.org/D81404 > Link: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation > https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions#SLS2 > > Suggested-by: Manoj Gupta > Suggested-by: Nathan Chancellor > Suggested-by: David Laight > Signed-off-by: Jian Cai I observe lots of linker warnings with this applied on linux-next: ld.lld: warning: init/built-in.a(main.o):(.text.__llvm_slsblr_thunk_x0) is being placed in '.text.__llvm_slsblr_thunk_x0' You need to modify arch/arm64/kernel/vmlinux.lds.S and arch/arm/kernel/vmlinux.lds.S (and possibly arch/arm/boot/compressed/vmlinux.lds.S as well) to add these sections back into .text so that the linkers don't place these orphaned sections in wild places. The resulting aarch64 kernel image doesn't even boot (under emulation). For 32b ARM: ld.lld: warning: init/built-in.a(main.o):(.text.__llvm_slsblr_thunk_arm_r0) is being placed in '.text.__llvm_slsblr_thunk_arm_r0' ... ld.lld: warning: init/built-in.a(main.o):(.text.__llvm_slsblr_thunk_thumb_r0) is being placed in '.text.__llvm_slsblr_thunk_thumb_r0' ... And the image doesn't boot (under emulation). > --- > > Changes v1 -> v2: > Update the description and patch based on Nathan and David's comments. > > arch/arm/Makefile | 4 ++++ > arch/arm64/Makefile | 4 ++++ > security/Kconfig.hardening | 7 +++++++ > 3 files changed, 15 insertions(+) > > diff --git a/arch/arm/Makefile b/arch/arm/Makefile > index 4aaec9599e8a..11d89ef32da9 100644 > --- a/arch/arm/Makefile > +++ b/arch/arm/Makefile > @@ -48,6 +48,10 @@ CHECKFLAGS += -D__ARMEL__ > KBUILD_LDFLAGS += -EL > endif > > +ifeq ($(CONFIG_HARDEN_SLS_ALL), y) > +KBUILD_CFLAGS += -mharden-sls=all > +endif > + > # > # The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and > # later may result in code being generated that handles signed short and signed > diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile > index 90309208bb28..ca7299b356a9 100644 > --- a/arch/arm64/Makefile > +++ b/arch/arm64/Makefile > @@ -34,6 +34,10 @@ $(warning LSE atomics not supported by binutils) > endif > endif > > +ifeq ($(CONFIG_HARDEN_SLS_ALL), y) > +KBUILD_CFLAGS += -mharden-sls=all > +endif > + > cc_has_k_constraint := $(call try-run,echo \ > 'int main(void) { \ > asm volatile("and w0, w0, %w0" :: "K" (4294967295)); \ > diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening > index 269967c4fc1b..9266d8d1f78f 100644 > --- a/security/Kconfig.hardening > +++ b/security/Kconfig.hardening > @@ -121,6 +121,13 @@ choice > > endchoice > > +config HARDEN_SLS_ALL > + bool "enable SLS vulnerability hardening" > + def_bool $(cc-option,-mharden-sls=all) This fails to set CONFIG_HARDEN_SLS_ALL for me with: $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make LLVM=1 LLVM_IAS=1 -j72 defconfig $ grep SLS_ALL .config # CONFIG_HARDEN_SLS_ALL is not set but it's flipped on there for arm64 defconfig: $ ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- make LLVM=1 LLVM_IAS=1 -j72 defconfig $ grep SLS_ALL .config CONFIG_HARDEN_SLS_ALL=y What's going on there? Is the cc-option Kconfig macro broken for Clang when cross compiling 32b ARM? I can still enable CONFIG_HARDEN_SLS_ALL via menuconfig, but I wonder if the default value is funny because the cc-option check is failing? > + help > + Enables straight-line speculation vulnerability hardening > + at highest level. > + > config GCC_PLUGIN_STRUCTLEAK_VERBOSE > bool "Report forcefully initialized variables" > depends on GCC_PLUGIN_STRUCTLEAK > -- -- Thanks, ~Nick Desaulniers _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel