From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 05C42C43334 for ; Thu, 14 Jul 2022 11:33:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=1fOfviJqd2mK/vPV/Cp3wjd5vI3u/XTHNMdOSVifz2k=; b=1HCHdFHDV4F0Xz 1lpjMWC4zpe2rlBMd5O8W4Vx6VvT02YfsJWnx6gPj8U5OYA7Z3eYJ5lFKRlRcB6Qyd45+/TncJubX xdKaxjkLmFj8clkm4KSkKYvzSKfXEQSSYOxQBtGA3igi+jvmKa8hKS6UwOFWciHaqITgW0EvmIPXO pHzJtsbfY8xCLRqkqnz2Fy9329EJuwlj8xQraYPNX88GAGm4V8H1gSCqdXxzPdidzbyph9qDej1oY qi5sI7IepT0DJuT7unf4x4IzcztWgyhK/Bp6IiLnKFFlNMW3Ne34EPIyPKNrrUrAxmchv+bq2HoIK k0pPvtfUHlprk2RTAMwQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oBx4f-00Dn0t-Ra; Thu, 14 Jul 2022 11:32:05 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oBx4b-00Dmy0-CR for linux-arm-kernel@lists.infradead.org; Thu, 14 Jul 2022 11:32:03 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9561013D5; Thu, 14 Jul 2022 04:31:59 -0700 (PDT) Received: from FVFF77S0Q05N (unknown [10.57.85.183]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 33CBC3F792; Thu, 14 Jul 2022 04:31:58 -0700 (PDT) Date: Thu, 14 Jul 2022 12:31:54 +0100 From: Mark Rutland To: Mark Brown Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Kees Cook , peterz@infradead.org Subject: Re: [PATCH] lkdtm: cfi: add test for HW landing pad CFI Message-ID: References: <20220713151815.295520-1-mark.rutland@arm.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220714_043201_485738_96781116 X-CRM114-Status: GOOD ( 23.96 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Jul 13, 2022 at 05:13:57PM +0100, Mark Brown wrote: > On Wed, Jul 13, 2022 at 04:18:15PM +0100, Mark Rutland wrote: > > Some architectures have coarse-grained HW CFI schemes where indirect > > branches must target a "landing pad" instruction (e.g. BTI on arm64, > > ENDBR on x86). These prevent gadgetization of arbitrary portions of > > functions. > > > Add a test which checks these work as expected. > > > For example, on arm64 HW with BTI this should result in a BTI exception > > being taken: > > > +/* > > + * This tries to call an indirect function with an address which is not a > > + * function entry point. This should be caught by architectures with "landing > > + * pad" instructions (e.g. BTI on arm64, or ENDBR on x86). > > + */ > > +static void lkdtm_CFI_FORWARD_LANDING_PAD(void) > > +{ > > + void (*func)(int *); > > + > > + func = (void *)((unsigned long)lkdtm_increment_void + 4); > > + > > + pr_info("Calling gadget address ...\n"); > > + func(&called_count); > > + > > + pr_err("FAIL: survived gadget function call!\n"); > > +} > > Incrementing the address by 4 here is the right number for arm64 and it > looks like it's also right for the x86_64 ENDBR64 instruction but are we > guaranteed that it'll do the right thing for other architectures, > especially those with variable length instructions - couldn't we just > get an illegal instruction exception due to ending up pointing at > something that isn't the start of an instruction even if CFI isn't > active? > > Not sure that worrying about that at this point isn't making perfect the > enemy of good though, it could be dealt with later. Perhaps just put > the offset behind a #define to make it a tiny bit more discoverable? How about I just add a comment for now? e.g. /* * Skip past a landing pad instruction. * On arm64 all instructions are 4-byte aligned, and x86's ENDBR is 4 * bytes. */ Thanks, Mark. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0442EC43334 for ; Thu, 14 Jul 2022 11:32:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238524AbiGNLcB (ORCPT ); Thu, 14 Jul 2022 07:32:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230299AbiGNLcA (ORCPT ); Thu, 14 Jul 2022 07:32:00 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 5B1F9206 for ; Thu, 14 Jul 2022 04:31:59 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9561013D5; Thu, 14 Jul 2022 04:31:59 -0700 (PDT) Received: from FVFF77S0Q05N (unknown [10.57.85.183]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 33CBC3F792; Thu, 14 Jul 2022 04:31:58 -0700 (PDT) Date: Thu, 14 Jul 2022 12:31:54 +0100 From: Mark Rutland To: Mark Brown Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Kees Cook , peterz@infradead.org Subject: Re: [PATCH] lkdtm: cfi: add test for HW landing pad CFI Message-ID: References: <20220713151815.295520-1-mark.rutland@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Jul 13, 2022 at 05:13:57PM +0100, Mark Brown wrote: > On Wed, Jul 13, 2022 at 04:18:15PM +0100, Mark Rutland wrote: > > Some architectures have coarse-grained HW CFI schemes where indirect > > branches must target a "landing pad" instruction (e.g. BTI on arm64, > > ENDBR on x86). These prevent gadgetization of arbitrary portions of > > functions. > > > Add a test which checks these work as expected. > > > For example, on arm64 HW with BTI this should result in a BTI exception > > being taken: > > > +/* > > + * This tries to call an indirect function with an address which is not a > > + * function entry point. This should be caught by architectures with "landing > > + * pad" instructions (e.g. BTI on arm64, or ENDBR on x86). > > + */ > > +static void lkdtm_CFI_FORWARD_LANDING_PAD(void) > > +{ > > + void (*func)(int *); > > + > > + func = (void *)((unsigned long)lkdtm_increment_void + 4); > > + > > + pr_info("Calling gadget address ...\n"); > > + func(&called_count); > > + > > + pr_err("FAIL: survived gadget function call!\n"); > > +} > > Incrementing the address by 4 here is the right number for arm64 and it > looks like it's also right for the x86_64 ENDBR64 instruction but are we > guaranteed that it'll do the right thing for other architectures, > especially those with variable length instructions - couldn't we just > get an illegal instruction exception due to ending up pointing at > something that isn't the start of an instruction even if CFI isn't > active? > > Not sure that worrying about that at this point isn't making perfect the > enemy of good though, it could be dealt with later. Perhaps just put > the offset behind a #define to make it a tiny bit more discoverable? How about I just add a comment for now? e.g. /* * Skip past a landing pad instruction. * On arm64 all instructions are 4-byte aligned, and x86's ENDBR is 4 * bytes. */ Thanks, Mark.