From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4596AC433EF for ; Wed, 10 Nov 2021 11:11:07 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 1477D610D2 for ; Wed, 10 Nov 2021 11:11:07 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 1477D610D2 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=DLbqhfaiQYvi6K0xVVW9YscnOE1c7hkEgkkvBtfyhV4=; b=2Qc8SEvQPbqfRS vdvo0zoF85682qBXw6yCs7m6DiFSZKJsB6+uXhUabnHPI3docg4snIMm+oDu3f4FPpL3aQWPX4S5W TapHtLDTcT6yug+IVRBBKajVsn1s742C4G9NmBT0XE1KBH56UpnZ8qEANPrEaJzwKb+ekpPF3smrE 7iJLaZuwokk6mgHKOoVi3azFe/6W/qZErTZ8sFmqAR7XSdBLWwTEldgKEbDxMPWcivI/NqnDWigbz 24fFWg1dA08ttRtCQtxXBFgmAlmP8spvFNocgoFCKvzhx1etyfGxW16/vKJRvOd22zraDOXNSHIxL wuex5ygCexbBXE2uw2Ow==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mklUM-005Fwm-9Z; Wed, 10 Nov 2021 11:09:58 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mklUI-005FvV-0Q for linux-arm-kernel@lists.infradead.org; Wed, 10 Nov 2021 11:09:55 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 55F0D101E; Wed, 10 Nov 2021 03:09:52 -0800 (PST) Received: from FVFF77S0Q05N (unknown [10.57.59.50]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 256323F718; Wed, 10 Nov 2021 03:09:50 -0800 (PST) Date: Wed, 10 Nov 2021 11:09:40 +0000 From: Mark Rutland To: Quentin Perret Cc: Ard Biesheuvel , Linux ARM , Linux Kernel Mailing List , Catalin Marinas , James Morse , Will Deacon , Frederic Weisbecker , Peter Zijlstra , Kees Cook , Sami Tolvanen , Andy Lutomirski , Josh Poimboeuf , Steven Rostedt Subject: Re: [PATCH v6 2/2] arm64: implement support for static call trampolines Message-ID: References: <20211105145917.2828911-1-ardb@kernel.org> <20211105145917.2828911-3-ardb@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211110_030954_121254_4ED7A718 X-CRM114-Status: GOOD ( 22.70 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi, On Tue, Nov 09, 2021 at 07:02:21PM +0000, Quentin Perret wrote: > On Tuesday 09 Nov 2021 at 19:09:21 (+0100), Ard Biesheuvel wrote: > > Android relies heavily on tracepoints for vendor hooks, and given the > > performance impact of CFI on indirect calls, there has been interest > > in enabling static calls to replace them. Hhmm.... what exactly is a "vendor hook" in this context, and what is it doing with a tracepoint? From an upstream perspective that sounds somewhat fishy usage. > > Quentin, anything to add here? > > Yes, Android should definitely benefit from static calls. > > Modules attaching to tracepoints cause a measurable overhead w/ CFI as > the jump target is a bit harder to verify if it is not in-kernel. Where does that additional overhead come from when the target is not in-kernel? I hope that I am wrong in understanding that __cfi_slowpath_diag() means we're always doing an out-of-line check when calling into a module? If that were the case, that would seem to be a much more general problem with the current clang CFI scheme, and my fear here is that we're adding fragility and complexity in specific plces to work around general problems with the CFI scheme. Thanks, Mark. > But sadly that's a common pattern for GKI. The current 'workaround' in > Android has been to just plain disable CFI around all tracepoints in the > kernel, which is a bit sad from a security PoV. But there was really no other > option at the time, and we needed the performance back. Static calls would be > a far superior solution as they would avoid much of the CFI overhead, and are > not vulnerable in the CFI sense (that is, the branch target can't be easily > overridden with a random OOB write from a dodgy driver). So yes, we'd really > like to have those please :) > > Thanks, > Quentin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel