From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 28F19C54E55 for ; Thu, 7 Mar 2024 11:11:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Subject:Cc:To:From:Date:References: In-Reply-To:Message-Id:MIME-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=nS6INeSZFtxj4gEubMdCQoua1DPXPnZaHRElftIejLk=; b=GFZD5JShojdHAv +sLsFJkyKmag2fA3yapKMadd4gWOqTPq8SeDyTBhKRYLLM/lXnknmTWZCin5QMYk77WE09kxqdC5Q oBQgVZHywXIKAqp3HEulYqu1aAze7KUNJ/VD3nmC3LKY2OnLJVBlbXycjN5EugCYCiEDRDVS7KUEz bpX9JDQ/y6u5roRK+vfpqd/O14Y6fgJgO6LD0an3uIorMR4COg4RSi7Y3nvhAR80oNoxrd0b8e0js M8AwdwoCLLBrQvWpl4QLIYiwhGVR173nXV48wihl45S3wyFb1Lihbd6CFyfw1wP/YlzL7PhbDOFe2 G5RxFZuMwQg+QXc0busg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1riBer-00000004EKs-0NIk; Thu, 07 Mar 2024 11:11:29 +0000 Received: from wfout5-smtp.messagingengine.com ([64.147.123.148]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1riBeS-00000004E7i-1OwU for linux-arm-kernel@lists.infradead.org; Thu, 07 Mar 2024 11:11:09 +0000 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailfout.west.internal (Postfix) with ESMTP id 24A451C0005B; Thu, 7 Mar 2024 06:10:57 -0500 (EST) Received: from imap51 ([10.202.2.101]) by compute5.internal (MEProxy); Thu, 07 Mar 2024 06:10:58 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arndb.de; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1709809856; x=1709896256; bh=AtFaL5EGzw xRRbAOMHdeBVoU44eLeNyTo8XPDMkPqiY=; b=OSFmEkZCJGBrbqz9g7e/8w0teR WUo9kKzYjoJcjENBEYmlZQeaK0jgDetatmG9hNKwGA9qnPnHZHZDXEsmNN+QkrC2 196R/0u28NUhfZsyMfIg2JYb/s3iyAxEKSlcz9Yjmx6YHZg94MyiNfsn8i0zfQIb F8/MAz5MtvAW7YNNH7vBzrTlGFhZIxu+xOZes60pE+9e5SfZzOOJHwiWJKAL34iS VbVXVLUtOCLrQW4b9AOkqgj2KMKecdtTiIj6dQxvo36y4fAXj3MNmNyUtT2NEA1i XEnSCHmBarAS/cwh/V+/FMLCDBU0/0ZrgAWX9NIl8akvZaaUULbgc1ci7kyw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; t=1709809856; x=1709896256; bh=AtFaL5EGzwxRRbAOMHdeBVoU44eL eNyTo8XPDMkPqiY=; b=Qshz4UXtsyv+fARPcD2AY8botM+ZWZ7PLLmEbnJ9FVO9 zXFSu3Rdj8hP8AGJA002XJNMaof07GnXoJfmFZMWnCKpllzf5a0nc6DUulLomLIw pZdkBE2n83iX61owqb4NdXmWtfIWwHOjR4LnLbtCkx3YYBSkoKW4oh6zCiFrm77T NiGwBIJeaQYqQ3vk2kOzFr+AgammZ7xGyIEzdaOEAexEPQ68otmthKCxFJH7qdiO KObgA+t9WCYvsOYxfAkn2z4/wGcjOtdpYVJl27OUCuxBZoyaHwRlX116uTryO2AD k0kzTfWkPTX6PrBNFZcSoQRmCXw8LwOF3zUBFRy5vg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvledrieefgddvhecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefofgggkfgjfhffhffvvefutgesthdtredtreertdenucfhrhhomhepfdetrhhn ugcuuegvrhhgmhgrnhhnfdcuoegrrhhnugesrghrnhgusgdruggvqeenucggtffrrghtth gvrhhnpeffheeugeetiefhgeethfejgfdtuefggeejleehjeeutefhfeeggefhkedtkeet ffenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegrrh hnugesrghrnhgusgdruggv X-ME-Proxy: Feedback-ID: i56a14606:Fastmail Received: by mailuser.nyi.internal (Postfix, from userid 501) id D9D49B6008D; Thu, 7 Mar 2024 06:10:55 -0500 (EST) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.11.0-alpha0-251-g8332da0bf6-fm-20240305.001-g8332da0b MIME-Version: 1.0 Message-Id: In-Reply-To: <38f9541b-dd88-4d49-af3b-bc7880a4e2f4@arm.com> References: <20240305221824.3300322-1-jeremy.linton@arm.com> <20240305221824.3300322-2-jeremy.linton@arm.com> <202403051526.0BE26F99E@keescook> <34351804-ad1d-498f-932a-c1844b78589f@app.fastmail.com> <38f9541b-dd88-4d49-af3b-bc7880a4e2f4@arm.com> Date: Thu, 07 Mar 2024 12:10:34 +0100 From: "Arnd Bergmann" To: "Jeremy Linton" , "Kees Cook" Cc: linux-arm-kernel@lists.infradead.org, "Catalin Marinas" , "Will Deacon" , "Jason A . Donenfeld" , "Gustavo A. R. Silva" , "Mark Rutland" , "Steven Rostedt" , "Mark Brown" , "Guo Hui" , Manoj.Iyer@arm.com, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, "James Yang" , "Shiyou Huang" Subject: Re: [PATCH 1/1] arm64: syscall: Direct PRNG kstack randomization X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240307_031104_725711_15A92E0F X-CRM114-Status: GOOD ( 38.52 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Mar 6, 2024, at 22:54, Jeremy Linton wrote: > On 3/6/24 14:46, Arnd Bergmann wrote: >> On Wed, Mar 6, 2024, at 00:33, Kees Cook wrote: >>> On Tue, Mar 05, 2024 at 04:18:24PM -0600, Jeremy Linton wrote: >>>> The existing arm64 stack randomization uses the kernel rng to acquire >>>> 5 bits of address space randomization. This is problematic because it >>>> creates non determinism in the syscall path when the rng needs to be >>>> generated or reseeded. This shows up as large tail latencies in some >>>> benchmarks and directly affects the minimum RT latencies as seen by >>>> cyclictest. >>>> >>>> Other architectures are using timers/cycle counters for this function, >>>> which is sketchy from a randomization perspective because it should be >>>> possible to estimate this value from knowledge of the syscall return >>>> time, and from reading the current value of the timer/counters. >> >> As I commented on the previous version, I don't want to see >> a change that only addresses one architecture like this. If you >> are convinced that using a cycle counter is a mistake, then we >> should do the same thing on the other architectures as well >> that currently use a cycle counter. > > I personally tend to agree as long as we aren't creating a similar set > of problems for those architectures as we are seeing on arm. Currently > the kstack rng on/off choice is basically zero overhead for them. I think we have two separate problems to solve here: how strong a kernel stack randomization should be on a given system, and who gets to make the decision. For the strength, we have at least four options: - strong rng, most expensive - your new prng, less strong but somewhat cheaper and/or more predictable overhead - cycle counter, cheap but probably even less strong, needs architecture code. - no rng, no overhead and no protection. On architectures that have a cheap hardware rng instruction, you can count that one as well. For picking between the options, we have - architecture maintainer - defconfig (CONFIG_RANDOMIZE_KSTACK_OFFSET) - boot time (randomize_kstack_offset=on) For both of these lists, I would like to see as few options as possible, and in particular I think the architecture maintainer should not make that decision for the users. If we want to improve this, I would start by changing the binary CONFIG_RANDOMIZE_KSTACK_OFFSET option into a three-way choice between cycle counter (where available), strong rng and off, possibly adding the cycle counter option to the two architectures that currently don't use it, while moving the strong rng into common code. After that, we can debate adding a fourth option, or replacing one of the existing two that is too slow or not random enough. >> Won't that defeat the purpose of the patch that was intended >> to make the syscall latency more predictable? At least the >> simpler approaches of reseeding from the kstack_rng() >> function itself would have this problem, deferring it to >> another context comes with a separate set of problems. > > And that describes why I've not come up with an inline reseeding > solution. Which of course isn't a problem on !arm if one just pushes a > few bits of a cycle counter into the rnd_state every few dozen syscalls, > or whatever. Mark R, mentioned offline the idea of just picking a few > bits off CNTVCT as a seed, but its so slow it basically has to be used > to fuzz a bit or two of rnd_state on some fairly long interval. Long > enough that if someone has a solution for extracting rnd_state it might > not add any additional security. Or that is my take, since i'm not a big > fan of any independent counter/clock based RNG seeding (AFAIK, entropy > from clocks requires multiple _independent_ sources). I'm not sure I understand the logic. Do you mean that accessing CNTVCT itself is slow, or that reseeding based on CNTVCT is slow because of the overhead of reseeding? On powerpc/s390/x86, the low bits of the respective cycle counter is simply used without any kind of bit shuffling, and we already rely on the cycle counter to be fast to access since it's used for timekeeping anywhere. There is not even any attempt to use the most random bits of the cycle counter, as both the high 22 to 24 bits get masked out (to keep the wasted stack space small) and the low 3 or 4 bits get ignored because of stack alignment. If there was any desire to make it more random, a trivial improvement would be: +++ b/include/linux/randomize_kstack.h @@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset); if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \ &randomize_kstack_offset)) { \ u32 offset = raw_cpu_read(kstack_offset); \ - offset ^= (rand); \ + offset = ror32(offset, 5) & (rand); \ raw_cpu_write(kstack_offset, offset); \ } \ } while (0) My impression is that is is already bordering on becoming a "bespoke rng" implementation that Jason was objecting to, so the current version is intentionally left weak in order to not even give the appearance of being a security relevant feature. > This is a bit out of my wheelhouse, so I defer to anyone with a better > feel or some actual data. > > The best plan I have at the moment is just some deferred work to call > kstack_rng_setup on some call or time based interval, which AFAIK isn't > ideal for RT workloads which expect ~100% CPU isolation. Plus, that > solution assumes we have some handle on how fast an attacker can extract > kstackrng sufficiently to make predictions. I think you fundamentally can't have both. If you rely on the reseeding to happen for a particular number of syscalls, you eventually end up blocking on it, regardless of the context it runs in. Deferring it to another process means blocking for longer, and deferring it to a low-priority task would mean that real-time tasks get less randomness. Arnd _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel