LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Kristina Martsenko <kristina.martsenko@arm.com>
To: Ramana Radhakrishnan <ramana.radhakrishnan@foss.arm.com>,
	"linux-arm-kernel@lists.infradead.org" 
	<linux-arm-kernel@lists.infradead.org>
Cc: Adam Wallis <awallis@codeaurora.org>,
	Amit Kachhap <Amit.Kachhap@arm.com>,
	Andrew Jones <drjones@redhat.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	Arnd Bergmann <arnd@arndb.de>,
	Catalin Marinas <Catalin.Marinas@arm.com>,
	Christoffer Dall <Christoffer.Dall@arm.com>,
	Dave P Martin <Dave.Martin@arm.com>,
	Jacob Bramley <Jacob.Bramley@arm.com>,
	Kees Cook <keescook@chromium.org>,
	Marc Zyngier <Marc.Zyngier@arm.com>,
	Mark Rutland <Mark.Rutland@arm.com>,
	Suzuki Poulose <Suzuki.Poulose@arm.com>,
	Will Deacon <Will.Deacon@arm.com>,
	"kvmarm@lists.cs.columbia.edu" <kvmarm@lists.cs.columbia.edu>,
	"linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [RFC 17/17] arm64: compile the kernel with ptrauth -msign-return-address
Date: Thu, 11 Oct 2018 15:00:57 +0100
Message-ID: <edbb3ad0-a38e-743f-f2e7-2241f2ed12ee@arm.com> (raw)
In-Reply-To: <cd1eface-aebb-b654-c57c-91690087957f@foss.arm.com>

On 05/10/2018 10:01, Ramana Radhakrishnan wrote:
> On 05/10/2018 09:47, Kristina Martsenko wrote:
>> Compile all functions with two ptrauth instructions: paciasp in the
>> prologue to sign the return address, and autiasp in the epilogue to
>> authenticate the return address. This should help protect the kernel
>> against attacks using return-oriented programming.
>>
>> CONFIG_ARM64_PTR_AUTH enables pointer auth for both userspace and the
>> kernel.
>>
>> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
>> Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
>> ---
>>   arch/arm64/Makefile | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
>> index 106039d25e2f..dbcd43ea99d8 100644
>> --- a/arch/arm64/Makefile
>> +++ b/arch/arm64/Makefile
>> @@ -56,6 +56,10 @@ KBUILD_AFLAGS    += $(lseinstr) $(brokengasinst)
>>   KBUILD_CFLAGS    += $(call cc-option,-mabi=lp64)
>>   KBUILD_AFLAGS    += $(call cc-option,-mabi=lp64)
>>   +ifeq ($(CONFIG_ARM64_PTR_AUTH),y)
>> +KBUILD_CFLAGS    += -msign-return-address=all
> 
> Glad to see this being done and being proposed for mainline.
> 
> I can see why you would prefer this though have you guys experimented at
> all with -msign-return-address=non-leaf as well ?

I've tried non-leaf and it works too. I'd be fine with switching to it,
I'm not sure which would be better for the kernel.

What kind of experiments did you have in mind? If I understand
correctly, then compared to non-leaf, "all" additionally protects leaf
functions that write to the stack. I don't know how many of those there
are in the kernel (or will be in the future). I also don't know the
additional performance impact of "all", as I don't think we have any
v8.3 hardware to test on yet. There is a minor code size impact (0.36%
on the current kernel), but I'm not sure how much that matters.

> Orthogonally and just fair warning - the command lines for this are also
> being revised to provide ROP and JOP protection using BTI from v8.5-a
> during the GCC-9 timeframe but I suspect that's a different option.

Thanks. I expect it will be a separate Kconfig option to build the
kernel with BTI and pointer auth, yes.

> Reviewed-by: Ramana Radhakrishnan  <ramana.radhakrishnan@arm.com>

Thanks!

Kristina

  reply index

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-05  8:47 [PATCH 00/17] ARMv8.3 pointer authentication support Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 01/17] arm64: add pointer authentication register bits Kristina Martsenko
2018-10-11 16:28   ` Will Deacon
2018-10-12  8:53     ` Mark Rutland
2018-10-12  8:56       ` Will Deacon
2018-10-12  9:50         ` Mark Rutland
2018-10-05  8:47 ` [PATCH v5 02/17] arm64/kvm: consistently handle host HCR_EL2 flags Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 03/17] arm64/kvm: hide ptrauth from guests Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 04/17] arm64: Don't trap host pointer auth use to EL2 Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 05/17] arm64/cpufeature: detect pointer authentication Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 06/17] asm-generic: mm_hooks: allow hooks to be overridden individually Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 07/17] arm64: add basic pointer authentication support Kristina Martsenko
2018-10-11 16:00   ` Suzuki K Poulose
2018-10-19 11:15   ` Catalin Marinas
2018-10-19 11:24     ` Will Deacon
2018-10-19 15:36       ` Kees Cook
2018-10-19 15:49         ` Will Deacon
2018-10-19 16:05           ` Kees Cook
2018-10-19 16:16             ` Will Deacon
2018-10-19 15:54         ` Mark Rutland
2018-10-19 16:49       ` Cyrill Gorcunov
2018-11-14 18:11       ` Will Deacon
2018-11-15 10:25         ` Dave Martin
2018-10-23  8:36     ` Ramana Radhakrishnan
2018-10-23 10:20       ` Will Deacon
2018-10-05  8:47 ` [PATCH v5 08/17] arm64: expose user PAC bit positions via ptrace Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 09/17] arm64: perf: strip PAC when unwinding userspace Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 10/17] arm64: enable pointer authentication Kristina Martsenko
2018-10-05  8:47 ` [PATCH v5 11/17] arm64: docs: document " Kristina Martsenko
2018-10-05  9:04   ` Ramana Radhakrishnan
2018-10-16 16:14     ` Kristina Martsenko
2018-10-19 11:35       ` Catalin Marinas
2018-10-19 11:47         ` Marc Zyngier
2018-10-19 12:22         ` Will Deacon
2018-10-19 14:42         ` Kristina Martsenko
2018-10-19 15:10           ` Catalin Marinas
2018-10-19 17:45             ` Will Deacon
2018-11-02  6:02               ` Jon Masters
2018-10-24 10:56         ` Ramana Radhakrishnan
2018-10-15 22:35   ` Kees Cook
2018-11-02  9:46     ` Ramana Radhakrishnan
2018-10-05  8:47 ` [RFC 12/17] arm64: move ptrauth keys to thread_info Kristina Martsenko
2018-10-19 11:38   ` Catalin Marinas
2018-10-05  8:47 ` [RFC 13/17] arm64: install user ptrauth keys at kernel exit time Kristina Martsenko
2018-10-05  8:47 ` [RFC 14/17] arm64: unwind: strip PAC from kernel addresses Kristina Martsenko
2018-10-05  8:47 ` [RFC 15/17] arm64: enable ptrauth earlier Kristina Martsenko
2018-10-06 12:51   ` Amit Kachhap
2018-10-05  8:47 ` [RFC 16/17] arm64: initialize and switch ptrauth kernel keys Kristina Martsenko
2018-10-06 12:56   ` Amit Kachhap
2018-10-05  8:47 ` [RFC 17/17] arm64: compile the kernel with ptrauth -msign-return-address Kristina Martsenko
2018-10-05  9:01   ` Ramana Radhakrishnan
2018-10-11 14:00     ` Kristina Martsenko [this message]
2018-10-11 14:23   ` Vladimir Murzin
2018-10-15 22:38     ` Kees Cook
2018-10-15 22:42 ` [PATCH 00/17] ARMv8.3 pointer authentication support Kees Cook
2018-11-13 16:17   ` Kristina Martsenko
2018-11-13 23:09     ` Kees Cook
2018-11-14 15:54       ` Kristina Martsenko
2018-11-14 21:47       ` Mark Rutland
2018-11-14 22:48         ` Kees Cook
2018-10-19 12:36 ` Will Deacon
2018-10-23  8:39   ` Ramana Radhakrishnan

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=edbb3ad0-a38e-743f-f2e7-2241f2ed12ee@arm.com \
    --to=kristina.martsenko@arm.com \
    --cc=Amit.Kachhap@arm.com \
    --cc=Catalin.Marinas@arm.com \
    --cc=Christoffer.Dall@arm.com \
    --cc=Dave.Martin@arm.com \
    --cc=Jacob.Bramley@arm.com \
    --cc=Marc.Zyngier@arm.com \
    --cc=Mark.Rutland@arm.com \
    --cc=Suzuki.Poulose@arm.com \
    --cc=Will.Deacon@arm.com \
    --cc=ard.biesheuvel@linaro.org \
    --cc=arnd@arndb.de \
    --cc=awallis@codeaurora.org \
    --cc=drjones@redhat.com \
    --cc=keescook@chromium.org \
    --cc=kvmarm@lists.cs.columbia.edu \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ramana.radhakrishnan@foss.arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git