From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A68DC388F7 for ; Tue, 10 Nov 2020 22:24:50 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 70F03206B2 for ; Tue, 10 Nov 2020 22:24:49 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="qd3Cs5Q4" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 70F03206B2 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EB7C46B005D; Tue, 10 Nov 2020 17:24:48 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E67E66B006E; Tue, 10 Nov 2020 17:24:48 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D06916B0072; Tue, 10 Nov 2020 17:24:48 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0205.hostedemail.com [216.40.44.205]) by kanga.kvack.org (Postfix) with ESMTP id A17096B005D for ; Tue, 10 Nov 2020 17:24:48 -0500 (EST) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 4737F362B for ; Tue, 10 Nov 2020 22:24:48 +0000 (UTC) X-FDA: 77469939456.26.cream79_2d07d3a272f8 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin26.hostedemail.com (Postfix) with ESMTP id 250F01804B656 for ; Tue, 10 Nov 2020 22:24:48 +0000 (UTC) X-HE-Tag: cream79_2d07d3a272f8 X-Filterd-Recvd-Size: 11232 Received: from mail-pg1-f194.google.com (mail-pg1-f194.google.com [209.85.215.194]) by imf08.hostedemail.com (Postfix) with ESMTP for ; Tue, 10 Nov 2020 22:24:47 +0000 (UTC) Received: by mail-pg1-f194.google.com with SMTP id f38so11509279pgm.2 for ; Tue, 10 Nov 2020 14:24:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Ucd1v1fmt9Aox8XVlg3EWNREpeq3rzghILv47+FEoWM=; b=qd3Cs5Q4zD9FN0h/khO9RMtqTvfg7O6eyjCISpARPCPCATV4vG5DirNu9mAXW5I84T ULT+AtPvVcMU/ztiqOH4R+ZOId+bvaZsk2suw2frMQrRFT7ckqs0TnZOScxPI+BLlRXL 0Qmteo1HURp5lnxLkyOcXCRc+PKeAjYZgkfHFQWzm0yBTOguVC0IHxG1lRibMCPZK3MM wcTZOTtdX4FUtQ4DRPRtzH7Qr31ClXjABBv3viqidQ2nUsPT5Ffqjq0Rzu8Cy2hnDaKa YbGF90LFH2p5PCY5hL0BEZG6Y1WsdS3azADHK1hAhCArGjL519/jJvnohdDkNvsEx6Zp oCHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Ucd1v1fmt9Aox8XVlg3EWNREpeq3rzghILv47+FEoWM=; b=jDjidKyZqW19Yqnwl7IdjnjwkZDuglIEOYq/3YeVoceEj+vpYRdVorQtpVAFM0+keq CCB6JCYfgzgOhX8ozZSahwu4YYYY0/fpRe28uJy9CxISlFVjMBmpEevhtIBkSNgxFur5 0MMDVpD071hrFMt7f89/ftHfYLbWN3JCDBd9l/vbBBigw7iNoos3H02eVdJn+UPvuvFo 7qFV/zohRWUiFxr4XxXpoH4yUfpdIEhhgVIGFN8p3nXPAvYoQePKBtSfHzJgbKT55+lA b7B5rBMywgD/lXaToNnLKFgDdT0Yz2JiKLVIOxzwv4S2sYWnS/LKb338ImWMS37JN/+8 C59A== X-Gm-Message-State: AOAM530Koc3VUUx0YlwQOvw4piSPfgD/ineJU0KHujSSUpnZIoyXM80S +WRzOIm5eW2hnOVibKwbWs/HYbpkKr9crF7leT24NA== X-Google-Smtp-Source: ABdhPJyZfDFXhwsd1+Iq7h8kSbUfCK+bJ881Ml71HNzH45UNvs62nV+pID0jjYxKPKW7LC2jzeu8XzAcQ9mqMhQqK5M= X-Received: by 2002:a17:90a:eb02:: with SMTP id j2mr349233pjz.136.1605047086391; Tue, 10 Nov 2020 14:24:46 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Andrey Konovalov Date: Tue, 10 Nov 2020 23:24:35 +0100 Message-ID: Subject: Re: [PATCH v2 00/20] kasan: boot parameters for hardware tag-based mode To: Dmitry Vyukov , Alexander Potapenko , Marco Elver , Catalin Marinas , Vincenzo Frascino , Evgenii Stepanov Cc: Will Deacon , Andrey Ryabinin , Branislav Rankov , Kevin Brodsky , Andrew Morton , kasan-dev , Linux ARM , Linux Memory Management List , LKML Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 10, 2020 at 11:20 PM Andrey Konovalov wrote: > > === Overview > > Hardware tag-based KASAN mode [1] is intended to eventually be used in > production as a security mitigation. Therefore there's a need for finer > control over KASAN features and for an existence of a kill switch. > > This patchset adds a few boot parameters for hardware tag-based KASAN that > allow to disable or otherwise control particular KASAN features, as well > as provides some initial optimizations for running KASAN in production. > > There's another planned patchset what will further optimize hardware > tag-based KASAN, provide proper benchmarking and tests, and will fully > enable tag-based KASAN for production use. > > Hardware tag-based KASAN relies on arm64 Memory Tagging Extension (MTE) > [2] to perform memory and pointer tagging. Please see [3] and [4] for > detailed analysis of how MTE helps to fight memory safety problems. > > The features that can be controlled are: > > 1. Whether KASAN is enabled at all. > 2. Whether KASAN collects and saves alloc/free stacks. > 3. Whether KASAN panics on a detected bug or not. > > The patch titled "kasan: add and integrate kasan boot parameters" of this > series adds a few new boot parameters. > > kasan.mode allows to choose one of three main modes: > > - kasan.mode=off - KASAN is disabled, no tag checks are performed > - kasan.mode=prod - only essential production features are enabled > - kasan.mode=full - all KASAN features are enabled > > The chosen mode provides default control values for the features mentioned > above. However it's also possible to override the default values by > providing: > > - kasan.stacktrace=off/on - enable stacks collection > (default: on for mode=full, otherwise off) > - kasan.fault=report/panic - only report tag fault or also panic > (default: report) > > If kasan.mode parameter is not provided, it defaults to full when > CONFIG_DEBUG_KERNEL is enabled, and to prod otherwise. Can I get everyone's Ack on these boot parameters? > > It is essential that switching between these modes doesn't require > rebuilding the kernel with different configs, as this is required by > the Android GKI (Generic Kernel Image) initiative. > > === Benchmarks > > For now I've only performed a few simple benchmarks such as measuring > kernel boot time and slab memory usage after boot. There's an upcoming > patchset which will optimize KASAN further and include more detailed > benchmarking results. > > The benchmarks were performed in QEMU and the results below exclude the > slowdown caused by QEMU memory tagging emulation (as it's different from > the slowdown that will be introduced by hardware and is therefore > irrelevant). > > KASAN_HW_TAGS=y + kasan.mode=off introduces no performance or memory > impact compared to KASAN_HW_TAGS=n. > > kasan.mode=prod (manually excluding tagging) introduces 3% of performance > and no memory impact (except memory used by hardware to store tags) > compared to kasan.mode=off. > > kasan.mode=full has about 40% performance and 30% memory impact over > kasan.mode=prod. Both come from alloc/free stack collection. > > === Notes > > This patchset is available here: > > https://github.com/xairy/linux/tree/up-boot-mte-v2 > > and on Gerrit here: > > https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/3707 > > This patchset is based on v9 of "kasan: add hardware tag-based mode for > arm64" patchset [1]. > > For testing in QEMU hardware tag-based KASAN requires: > > 1. QEMU built from master [6] (use "-machine virt,mte=on -cpu max" arguments > to run). > 2. GCC version 10. > > [1] https://lkml.org/lkml/2020/11/10/1187 > [2] https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safety > [3] https://arxiv.org/pdf/1802.09517.pdf > [4] https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Security%20analysis%20of%20memory%20tagging.pdf > [5] https://source.android.com/devices/architecture/kernel/generic-kernel-image > [6] https://github.com/qemu/qemu > > === History > > Changes v1 -> v2: > - Rebased onto v9 of the HW_TAGS patchset. > - Don't initialize static branches in kasan_init_hw_tags_cpu(), as > cpu_enable_mte() can't sleep; do in in kasan_init_hw_tags() instead. > - Rename kasan.stacks to kasan.stacktrace. > > Changes RFC v2 -> v1: > - Rebrand the patchset from fully enabling production use to partially > addressing that; another optimization and testing patchset will be > required. > - Rebase onto v8 of KASAN_HW_TAGS series. > - Fix "ASYNC" -> "async" typo. > - Rework depends condition for VMAP_STACK and update config text. > - Remove unneeded reset_tag() macro, use kasan_reset_tag() instead. > - Rename kasan.stack to kasan.stacks to avoid confusion with stack > instrumentation. > - Introduce kasan_stack_collection_enabled() and kasan_is_enabled() > helpers. > - Simplify kasan_stack_collection_enabled() usage. > - Rework SLAB_KASAN flag and metadata allocation (see the corresponding > patch for details). > - Allow cache merging with KASAN_HW_TAGS when kasan.stacks is off. > - Use sync mode dy default for both prod and full KASAN modes. > - Drop kasan.trap=sync/async boot parameter, as async mode isn't supported > yet. > - Choose prod or full mode depending on CONFIG_DEBUG_KERNEL when no > kasan.mode boot parameter is provided. > - Drop krealloc optimization changes, those will be included in a separate > patchset. > - Update KASAN documentation to mention boot parameters. > > Changes RFC v1 -> RFC v2: > - Rework boot parameters. > - Drop __init from empty kasan_init_tags() definition. > - Add cpu_supports_mte() helper that can be used during early boot and use > it in kasan_init_tags() > - Lots of new KASAN optimization commits. > > Andrey Konovalov (20): > kasan: simplify quarantine_put call site > kasan: rename get_alloc/free_info > kasan: introduce set_alloc_info > kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK > kasan: allow VMAP_STACK for HW_TAGS mode > kasan: remove __kasan_unpoison_stack > kasan: inline kasan_reset_tag for tag-based modes > kasan: inline random_tag for HW_TAGS > kasan: inline kasan_poison_memory and check_invalid_free > kasan: inline and rename kasan_unpoison_memory > kasan: add and integrate kasan boot parameters > kasan, mm: check kasan_enabled in annotations > kasan: simplify kasan_poison_kfree > kasan, mm: rename kasan_poison_kfree > kasan: don't round_up too much > kasan: simplify assign_tag and set_tag calls > kasan: clarify comment in __kasan_kfree_large > kasan: clean up metadata allocation and usage > kasan, mm: allow cache merging with no metadata > kasan: update documentation > > Documentation/dev-tools/kasan.rst | 180 ++++++++++++-------- > arch/Kconfig | 8 +- > arch/arm64/kernel/sleep.S | 2 +- > arch/x86/kernel/acpi/wakeup_64.S | 2 +- > include/linux/kasan.h | 253 +++++++++++++++++++++------ > include/linux/mm.h | 22 ++- > kernel/fork.c | 2 +- > mm/kasan/common.c | 274 ++++++++++++++++++------------ > mm/kasan/generic.c | 27 +-- > mm/kasan/hw_tags.c | 183 ++++++++++++++++---- > mm/kasan/kasan.h | 113 ++++++++---- > mm/kasan/quarantine.c | 13 +- > mm/kasan/report.c | 61 ++++--- > mm/kasan/report_hw_tags.c | 2 +- > mm/kasan/report_sw_tags.c | 13 +- > mm/kasan/shadow.c | 5 +- > mm/kasan/sw_tags.c | 17 +- > mm/mempool.c | 2 +- > mm/slab_common.c | 13 +- > 19 files changed, 826 insertions(+), 366 deletions(-) > > -- > 2.29.2.222.g5d2a92d10f8-goog >