From: Amit Daniel Kachhap <amit.kachhap@arm.com>
To: linux-arm-kernel@lists.infradead.org
Cc: Mark Rutland <mark.rutland@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Mark Brown <broonie@kernel.org>,
James Morse <james.morse@arm.com>,
Amit Daniel Kachhap <amit.kachhap@arm.com>,
Vincenzo Frascino <Vincenzo.Frascino@arm.com>,
Will Deacon <will@kernel.org>, Daniel Kiss <daniel.kiss@arm.com>
Subject: [PATCH] arm64: Optimize ptrauth by enabling it for non-leaf functions
Date: Tue, 14 Apr 2020 15:02:21 +0530 [thread overview]
Message-ID: <1586856741-26839-1-git-send-email-amit.kachhap@arm.com> (raw)
Compilers are optimized to not store the stack frame record for the leaf
function in the stack so applying pointer authentication in the leaf
function is not useful from security point of view.
This patch changes compiler option to -mbranch-protection=pac-ret and
-msign-return-address=non-leaf.
Reported-by: Daniel Kiss <daniel.kiss@arm.com>
Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
---
arch/arm64/Kconfig | 4 ++--
arch/arm64/Makefile | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 40fb05d..29cfe05 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1541,11 +1541,11 @@ config ARM64_PTR_AUTH
config CC_HAS_BRANCH_PROT_PAC_RET
# GCC 9 or later, clang 8 or later
- def_bool $(cc-option,-mbranch-protection=pac-ret+leaf)
+ def_bool $(cc-option,-mbranch-protection=pac-ret)
config CC_HAS_SIGN_RETURN_ADDRESS
# GCC 7, 8
- def_bool $(cc-option,-msign-return-address=all)
+ def_bool $(cc-option,-msign-return-address=non-leaf)
config AS_HAS_PAC
def_bool $(as-option,-Wa$(comma)-march=armv8.3-a)
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 85e4149..895f506 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -70,8 +70,8 @@ endif
branch-prot-flags-y += $(call cc-option,-mbranch-protection=none)
ifeq ($(CONFIG_ARM64_PTR_AUTH),y)
-branch-prot-flags-$(CONFIG_CC_HAS_SIGN_RETURN_ADDRESS) := -msign-return-address=all
-branch-prot-flags-$(CONFIG_CC_HAS_BRANCH_PROT_PAC_RET) := -mbranch-protection=pac-ret+leaf
+branch-prot-flags-$(CONFIG_CC_HAS_SIGN_RETURN_ADDRESS) := -msign-return-address=non-leaf
+branch-prot-flags-$(CONFIG_CC_HAS_BRANCH_PROT_PAC_RET) := -mbranch-protection=pac-ret
# -march=armv8.3-a enables the non-nops instructions for PAC, to avoid the
# compiler to generate them and consequently to break the single image contract
# we pass it only to the assembler. This option is utilized only in case of non
--
2.7.4
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2020-04-14 9:32 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-14 9:32 Amit Daniel Kachhap [this message]
2020-04-14 10:00 ` [PATCH] arm64: Optimize ptrauth by enabling it for non-leaf functions Will Deacon
2020-04-14 10:16 ` Mark Rutland
2020-04-14 10:58 ` Amit Kachhap
2020-04-14 11:11 ` Mark Rutland
2020-04-14 11:00 ` Will Deacon
2020-04-14 11:09 ` Mark Rutland
2020-04-14 13:10 ` Will Deacon
2020-04-14 14:07 ` Mark Rutland
2020-04-29 8:38 ` Amit Kachhap
2020-04-14 10:49 ` Amit Kachhap
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1586856741-26839-1-git-send-email-amit.kachhap@arm.com \
--to=amit.kachhap@arm.com \
--cc=Vincenzo.Frascino@arm.com \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=daniel.kiss@arm.com \
--cc=james.morse@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).