lkml.org 
[lkml]   [2019]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: rseq/arm32: choosing rseq code signature
    ----- On Apr 9, 2019, at 3:32 PM, Mathieu Desnoyers mathieu.desnoyers@efficios.com wrote:

    > Hi Will,
    >
    > We are about to include the code signature required prior to restartable
    > sequences abort handlers into glibc, which will make this ABI choice final.
    > We need architecture maintainer input on that signature value.
    >
    > That code signature is placed before each abort handler, so the kernel can
    > validate that it is indeed jumping to an abort handler (and not some
    > arbitrary attacker-chosen code). The signature is never executed.
    >
    > The current discussion thread on the glibc mailing list leads us towards
    > using a trap with uncommon immediate operand, which simplifies integration
    > with disassemblers, emulators, makes it easier to debug if the control
    > flow gets redirected there by mistake, and is nicer for some architecture's
    > speculative execution.
    >
    > We can have different signatures for each sub-architecture, as long as they
    > don't have to co-exist within the same process. We can special-case with
    > #ifdef for each sub-architecture and endianness if need be. If the architecture
    > has instruction set extensions that can co-exist with the architecture
    > instruction set within the same process (e.g. thumb for arm), we need to take
    > into account to which instruction the chosen signature value would map (and
    > possibly decide if we need to extend rseq to support many signatures).
    >
    > Here is an example of rseq signature definition template:
    >
    > /*
    > * TODO: document trap instruction objdump output on each sub-architecture
    > * instruction sets, as well as instruction set extensions.
    > */
    > #define RSEQ_SIG 0x########
    >
    > Ideally we'd need a patch on top of the Linux kernel
    > tools/testing/selftests/rseq/rseq-arm.h file that updates
    > the signature value, so I can then pick it up for the glibc
    > patchset.

    Would the following diff work for you ? If so, can I get your
    acked-by ?

    diff --git a/tools/testing/selftests/rseq/rseq-arm.h b/tools/testing/selftests/rseq/rseq-arm.h
    index 5f262c54364f..1f261ad2ac1b 100644
    --- a/tools/testing/selftests/rseq/rseq-arm.h
    +++ b/tools/testing/selftests/rseq/rseq-arm.h
    @@ -5,7 +5,17 @@
    * (C) Copyright 2016-2018 - Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    */

    -#define RSEQ_SIG 0x53053053
    +/*
    + * RSEQ_SIG uses the udf A32 instruction with an uncommon immediate operand
    + * value 0x5305. This traps if user-space reaches this instruction by mistake,
    + * and the uncommon operand ensures the kernel does not move the instruction
    + * pointer to attacker-controlled code on rseq abort.
    + *
    + * The instruction pattern is:
    + *
    + * e7f530f5 udf #21253 ; 0x5305
    + */
    +#define RSEQ_SIG 0xe7f530f5

    #define rseq_smp_mb() __asm__ __volatile__ ("dmb" ::: "memory", "cc")
    #define rseq_smp_rmb() __asm__ __volatile__ ("dmb" ::: "memory", "cc")
    @@ -78,7 +88,8 @@ do { \
    __rseq_str(table_label) ":\n\t" \
    ".word " __rseq_str(version) ", " __rseq_str(flags) "\n\t" \
    ".word " __rseq_str(start_ip) ", 0x0, " __rseq_str(post_commit_offset) ", 0x0, " __rseq_str(abort_ip) ", 0x0\n\t" \
    - ".word " __rseq_str(RSEQ_SIG) "\n\t" \
    + ".arm\n\t" \
    + ".inst " __rseq_str(RSEQ_SIG) "\n\t" \
    __rseq_str(label) ":\n\t" \
    teardown \
    "b %l[" __rseq_str(abort_label) "]\n\t"

    >
    > Thanks!
    >
    > Mathieu
    >
    > --
    > Mathieu Desnoyers
    > EfficiOS Inc.
    > http://www.efficios.com

    --
    Mathieu Desnoyers
    EfficiOS Inc.
    http://www.efficios.com

    \
     
     \ /
      Last update: 2019-04-10 22:30    [W:5.914 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site