From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBB73C43457 for ; Fri, 16 Oct 2020 13:17:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1AB1E207DE for ; Fri, 16 Oct 2020 13:17:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="GxBuew5M" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1AB1E207DE Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A32A96B005D; Fri, 16 Oct 2020 09:17:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9E19B6B0062; Fri, 16 Oct 2020 09:17:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8F8036B0068; Fri, 16 Oct 2020 09:17:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0159.hostedemail.com [216.40.44.159]) by kanga.kvack.org (Postfix) with ESMTP id 75D3C6B005D for ; Fri, 16 Oct 2020 09:17:47 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 29BBF8249980 for ; Fri, 16 Oct 2020 13:17:47 +0000 (UTC) X-FDA: 77377840974.16.bell70_05114412721d Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin16.hostedemail.com (Postfix) with ESMTP id F384D100CADAB for ; Fri, 16 Oct 2020 13:17:46 +0000 (UTC) X-HE-Tag: bell70_05114412721d X-Filterd-Recvd-Size: 7470 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Fri, 16 Oct 2020 13:17:46 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id j7so1442942pgk.5 for ; Fri, 16 Oct 2020 06:17:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QL3/zaLDIDJL7ythZO9+VfLF2/gKs2of9IcU9332u94=; b=GxBuew5MDtRY2618+D5SI58D1s8+noXUXKNpeUsPHxGasQUYna1X1sKnYL/RCr9W+I TVenQkpVDq67PglFCmkdh58kFTtIZnwKbqeKLrbehtV5J8DfV2dSburDCR7Xg2OV2L/w 6pfjAtf4M66sMTQXdPRA5hdiuo14EFCz/Rm9GehD9Dh6UfBOs2YzqtMXHQFFYqhB37Qg 8oQFJqiC7v/dFTqng88tthWe19W2K8rjFRB7OeLt1rpjO7XBT32IWlnjlpCKf0pu8pj+ DruA7hsPqExtfefuXdvLq2Tc/Gy3McU7W/wMd0ASthYJqGXdOMDjmnDIgtp9IczrWrik cEHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QL3/zaLDIDJL7ythZO9+VfLF2/gKs2of9IcU9332u94=; b=uko6BaPFkrkK6oKHA6u7ud1A/Qf+Ebke9cvm/U25GApVWdw4f/VcOfzP/PUTtTYqXE i4asJhcvdlR9XBJrGTj1wGwin05Ntu/RhrAdS59pN4+pA1K+xcwpXyYJIXJ8yLnBAr+B 8ugFtDrIo19lgrZLHu+IdLNq47av6+p4oXVC8Hg6ZQ3j+HBpN8DiDQNJd7Q8PWrnu5mQ T5Mfo3x1vUU3EayxH978vtcHYwLM/q5HPFs6+1qqZG9nVrvDwNI7XxpPQqGE94fjJGp6 zMbPeYxM9qdQXHBjdBc1TyoFjn4Fp2HQsvHPFNew478inlYIS1Oc1V5KSmGBimhmV/3Q rMsQ== X-Gm-Message-State: AOAM533sYIzVtvPBd3VX3IhK1vWdhhyqEUvQsxDmfYz4RBS0ml66NKdi N5VZHzEXZr+H0QB03rsek1DwFYRM2e5J9KPGLnkyjA== X-Google-Smtp-Source: ABdhPJzzHKZfnBav2HobW7A6XwuVJj70HQe8x5G3opXTbj9PUHDUF1SAyaKmCVaW6NmRyIMfki7lXkt/YYotyrfk8tc= X-Received: by 2002:a63:5d07:: with SMTP id r7mr3134194pgb.440.1602854265382; Fri, 16 Oct 2020 06:17:45 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Andrey Konovalov Date: Fri, 16 Oct 2020 15:17:34 +0200 Message-ID: Subject: Re: [PATCH RFC 0/8] kasan: hardware tag-based mode for production use on arm64 To: Marco Elver Cc: Catalin Marinas , Will Deacon , Vincenzo Frascino , Dmitry Vyukov , Alexander Potapenko , Evgenii Stepanov , Andrey Ryabinin , Elena Petrova , Branislav Rankov , Kevin Brodsky , Andrew Morton , kasan-dev , Linux ARM , Linux Memory Management List , LKML Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Oct 15, 2020 at 4:41 PM Marco Elver wrote: > > On Wed, 14 Oct 2020 at 22:44, Andrey Konovalov wrote: > > This patchset is not complete (see particular TODOs in the last patch), > > and I haven't performed any benchmarking yet, but I would like to start the > > discussion now and hear people's opinions regarding the questions mentioned > > below. > > > > === Overview > > > > This patchset adopts the existing hardware tag-based KASAN mode [1] for > > use in production as a memory corruption mitigation. Hardware tag-based > > KASAN relies on arm64 Memory Tagging Extension (MTE) [2] to perform memory > > and pointer tagging. Please see [3] and [4] for detailed analysis of how > > MTE helps to fight memory safety problems. > > > > The current plan is reuse CONFIG_KASAN_HW_TAGS for production, but add a > > boot time switch, that allows to choose between a debugging mode, that > > includes all KASAN features as they are, and a production mode, that only > > includes the essentials like tag checking. > > > > It is essential that switching between these modes doesn't require > > rebuilding the kernel with different configs, as this is required by the > > Android GKI initiative [5]. > > > > The last patch of this series adds a new boot time parameter called > > kasan_mode, which can have the following values: > > > > - "kasan_mode=on" - only production features > > - "kasan_mode=debug" - all debug features > > - "kasan_mode=off" - no checks at all (not implemented yet) > > > > Currently outlined differences between "on" and "debug": > > > > - "on" doesn't keep track of alloc/free stacks, and therefore doesn't > > require the additional memory to store those > > - "on" uses asyncronous tag checking (not implemented yet) > > > > === Questions > > > > The intention with this kind of a high level switch is to hide the > > implementation details. Arguably, we could add multiple switches that allow > > to separately control each KASAN or MTE feature, but I'm not sure there's > > much value in that. > > > > Does this make sense? Any preference regarding the name of the parameter > > and its values? > > KASAN itself used to be a debugging tool only. So introducing an "on" > mode which no longer follows this convention may be confusing. Yeah, perhaps "on" is not the best name here. > Instead, maybe the following might be less confusing: > > "full" - current "debug", normal KASAN, all debugging help available. > "opt" - current "on", optimized mode for production. How about "prod" here? > "on" - automatic selection => chooses "full" if CONFIG_DEBUG_KERNEL, > "opt" otherwise. > "off" - as before. It actually makes sense to depend on CONFIG_DEBUG_KERNEL, I like this idea. > > Also, if there is no other kernel boot parameter named "kasan" yet, > maybe it could just be "kasan=..." ? Sounds good to me too. > > What should be the default when the parameter is not specified? I would > > argue that it should be "debug" (for hardware that supports MTE, otherwise > > "off"), as it's the implied default for all other KASAN modes. > > Perhaps we could make this dependent on CONFIG_DEBUG_KERNEL as above. > I do not think that having the full/debug KASAN enabled on production > kernels adds any value because for it to be useful requires somebody > to actually look at the stacktraces; I think that choice should be > made explicitly if it's a production kernel. My guess is that we'll > save explaining performance differences and resulting headaches for > ourselves and others that way. Ack. > > Should we somehow control whether to panic the kernel on a tag fault? > > Another boot time parameter perhaps? > > It already respects panic_on_warn, correct? Yes, but Android is unlikely to enable panic_on_warn as they have warnings happening all over. AFAIR Pixel 3/4 kernels actually have a custom patch that enables kernel panic for KASAN crashes specifically (even though they don't obviously use KASAN in production), and I think it's better to provide a similar facility upstream. Maybe call it panic_on_kasan or something?