From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FAACC28CC0 for ; Wed, 29 May 2019 19:06:55 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CEF6E24074 for ; Wed, 29 May 2019 19:06:54 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="K0jsmDIn" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CEF6E24074 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=L3etFPGknbXRH6bJFsmMrWGnprqVFG5UzgxRtxwzdy4=; b=K0jsmDInGnJaYMbtJmY3z9AMoG 4wDTeJGdB9B8iBWReM8zcTDBRw8TzMHaIIqdZ19PxBLUNOgqKfPDQdF3xMoVNEHXE0CWqsw0wsnma N5RqiXC0t+b+xzQYs/NXt+4gtruDftFwfY7npzw/4kuLgZJERdbahKQqovRqEEUYw/0xVaCRFQntm ZG+uqmrvrbZxe3CLfjSWKtJRTZzeG8U36SAFhKZTHrKZWmiOvMQcGI9OPtGQAseByOLfPlYepS++4 nfp52BTbdt1R6+hBYVu+bhDE/3XHz1qqQBYSEBP+Ky/knPJQmw1Nu7dNHNxbSTp/sNojQzEj8cBfv 6DQ0e2yw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hW3uT-00026z-RK; Wed, 29 May 2019 19:06:49 +0000 Received: from foss.arm.com ([217.140.101.70]) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hW3sg-0007m0-Tb for linux-arm-kernel@lists.infradead.org; Wed, 29 May 2019 19:05:07 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9369115A2; Wed, 29 May 2019 12:04:58 -0700 (PDT) Received: from moonbear.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id C60783F59C; Wed, 29 May 2019 12:04:56 -0700 (PDT) From: Kristina Martsenko To: linux-arm-kernel@lists.infradead.org Subject: [RFC v2 7/7] arm64: compile the kernel with ptrauth return address signing Date: Wed, 29 May 2019 20:03:32 +0100 Message-Id: <20190529190332.29753-8-kristina.martsenko@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190529190332.29753-1-kristina.martsenko@arm.com> References: <20190529190332.29753-1-kristina.martsenko@arm.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190529_120458_966362_B2CB6674 X-CRM114-Status: GOOD ( 19.43 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Kees Cook , Ard Biesheuvel , Catalin Marinas , Suzuki K Poulose , Will Deacon , Ramana Radhakrishnan , Amit Kachhap , Dave Martin MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org Compile all non-leaf functions with two ptrauth instructions: PACIASP in the prologue to sign the return address, and AUTIASP in the epilogue to authenticate the return address (from the stack). If authentication fails, the return will cause an instruction abort to be taken, followed by an oops and killing the task. This should help protect the kernel against attacks using return-oriented programming. The new instructions are in the HINT encoding space, so on a system without ptrauth they execute as NOPs. CONFIG_ARM64_PTR_AUTH now not only enables ptrauth for userspace and KVM guests, but also automatically builds the kernel with ptrauth instructions if the compiler supports it. If there is no compiler support, we do not warn that the kernel was built without ptrauth instructions. GCC 7 and 8 support the -msign-return-address option, while GCC 9 deprecates that option and replaces it with -mbranch-protection. Support both options. Signed-off-by: Kristina Martsenko --- Changes since RFC v1: - Fixed support for compilers without ptrauth - Added support for the new -mbranch-protection option - Switched from protecting all functions to only protecting non-leaf functions (for no good reason, I have not done e.g. gadget analysis) - Moved __no_ptrauth definition to this patch, depending on compiler support - Updated the Kconfig symbol description - Updated the commit message arch/arm64/Kconfig | 12 +++++++++++- arch/arm64/Makefile | 6 ++++++ arch/arm64/include/asm/pointer_auth.h | 6 ++++++ 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index f4c1e9b30129..3ce93d88fae1 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1295,11 +1295,15 @@ config ARM64_PTR_AUTH and other attacks. This option enables these instructions at EL0 (i.e. for userspace). - Choosing this option will cause the kernel to initialise secret keys for each process at exec() time, with these keys being context-switched along with the process. + If the compiler supports the -mbranch-protection or + -msign-return-address flag (e.g. GCC 7 or later), then this option + will also cause the kernel itself to be compiled with return address + protection. + The feature is detected at runtime. If the feature is not present in hardware it will not be advertised to userspace nor will it be enabled. @@ -1308,6 +1312,12 @@ config ARM64_PTR_AUTH then the secondary CPU will be offlined. On such a system, this option should not be selected. +config CC_HAS_BRANCH_PROT_PAC_RET + def_bool $(cc-option,-mbranch-protection=pac-ret) + +config CC_HAS_SIGN_RETURN_ADDRESS + def_bool $(cc-option,-msign-return-address=non-leaf) + endmenu config ARM64_SVE diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile index b025304bde46..1dfbe755b531 100644 --- a/arch/arm64/Makefile +++ b/arch/arm64/Makefile @@ -66,6 +66,12 @@ stack_protector_prepare: prepare0 include/generated/asm-offsets.h)) endif +ifeq ($(CONFIG_ARM64_PTR_AUTH),y) +pac-flags-$(CONFIG_CC_HAS_SIGN_RETURN_ADDRESS) := -msign-return-address=non-leaf +pac-flags-$(CONFIG_CC_HAS_BRANCH_PROT_PAC_RET) := -mbranch-protection=pac-ret +KBUILD_CFLAGS += $(pac-flags-y) +endif + ifeq ($(CONFIG_CPU_BIG_ENDIAN), y) KBUILD_CPPFLAGS += -mbig-endian CHECKFLAGS += -D__AARCH64EB__ diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h index 5491c34b4dc3..3a83c40ffd8a 100644 --- a/arch/arm64/include/asm/pointer_auth.h +++ b/arch/arm64/include/asm/pointer_auth.h @@ -15,7 +15,13 @@ * allows pointer authentication to be enabled/disabled within the function * (but leaves the function unprotected by pointer authentication). */ +#if defined(CONFIG_CC_HAS_BRANCH_PROT_PAC_RET) +#define __no_ptrauth __attribute__((target("branch-protection=none"))) +#elif defined(CONFIG_CC_HAS_SIGN_RETURN_ADDRESS) +#define __no_ptrauth __attribute__((target("sign-return-address=none"))) +#else #define __no_ptrauth +#endif /* * Each key is a 128-bit quantity which is split across a pair of 64-bit -- 2.11.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel