From patchwork Wed Apr 10 20:29:19 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathieu Desnoyers X-Patchwork-Id: 32254 Received: (qmail 19261 invoked by alias); 10 Apr 2019 20:29:25 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 18569 invoked by uid 89); 10 Apr 2019 20:29:24 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-17.9 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_PASS autolearn=ham version=3.3.1 spammy=57 X-HELO: mail.efficios.com DKIM-Filter: OpenDKIM Filter v2.10.3 mail.efficios.com 2B11F1D5402 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficios.com; s=default; t=1554928160; bh=SnPtn6Kglai7FPgDVxEngiNmEWyxw0Il9J+v8PyYSMs=; h=Date:From:To:Message-ID:MIME-Version; b=qwkrXTMMTu771lCi/wNtsbqCZfQ0NZwIL9Wjqdf6x0EGp2slE23uFz/rlVqi8AEf3 bGvsCAyOjqk+rzf8mlIiwAt8r/vwW0jICOszSU3bedobzHzrGWFmC71qocMXGuGKCt YwHRxJPd47imW4VyQMkbJrzhsFHMlQWL5+HUxpIrgiVZ5TAuPfekRhefghSNG2Acfk SDdNeSZFvXEWqoOrcAtH9wH9Sh8ftim4eX2woUWYCnMdlD320YBTemXCWcaLmMC71+ cQ/EAKfsTq9UGofAW4rv16QOOOyFAtfT1VeCd9zgBTJldteBawMQl5VJ9vejl1oGru f6RhYmv2JQhxQ== Date: Wed, 10 Apr 2019 16:29:19 -0400 (EDT) From: Mathieu Desnoyers To: Will Deacon Cc: libc-alpha , linux-kernel , carlos Message-ID: <1933578130.3292.1554928159928.JavaMail.zimbra@efficios.com> In-Reply-To: <1050734985.2625.1554838340011.JavaMail.zimbra@efficios.com> References: <1050734985.2625.1554838340011.JavaMail.zimbra@efficios.com> Subject: Re: rseq/arm32: choosing rseq code signature MIME-Version: 1.0 ----- On Apr 9, 2019, at 3:32 PM, Mathieu Desnoyers mathieu.desnoyers@efficios.com wrote: > Hi Will, > > We are about to include the code signature required prior to restartable > sequences abort handlers into glibc, which will make this ABI choice final. > We need architecture maintainer input on that signature value. > > That code signature is placed before each abort handler, so the kernel can > validate that it is indeed jumping to an abort handler (and not some > arbitrary attacker-chosen code). The signature is never executed. > > The current discussion thread on the glibc mailing list leads us towards > using a trap with uncommon immediate operand, which simplifies integration > with disassemblers, emulators, makes it easier to debug if the control > flow gets redirected there by mistake, and is nicer for some architecture's > speculative execution. > > We can have different signatures for each sub-architecture, as long as they > don't have to co-exist within the same process. We can special-case with > #ifdef for each sub-architecture and endianness if need be. If the architecture > has instruction set extensions that can co-exist with the architecture > instruction set within the same process (e.g. thumb for arm), we need to take > into account to which instruction the chosen signature value would map (and > possibly decide if we need to extend rseq to support many signatures). > > Here is an example of rseq signature definition template: > > /* > * TODO: document trap instruction objdump output on each sub-architecture > * instruction sets, as well as instruction set extensions. > */ > #define RSEQ_SIG 0x######## > > Ideally we'd need a patch on top of the Linux kernel > tools/testing/selftests/rseq/rseq-arm.h file that updates > the signature value, so I can then pick it up for the glibc > patchset. Would the following diff work for you ? If so, can I get your acked-by ? > > Thanks! > > Mathieu > > -- > Mathieu Desnoyers > EfficiOS Inc. > http://www.efficios.com diff --git a/tools/testing/selftests/rseq/rseq-arm.h b/tools/testing/selftests/rseq/rseq-arm.h index 5f262c54364f..1f261ad2ac1b 100644 --- a/tools/testing/selftests/rseq/rseq-arm.h +++ b/tools/testing/selftests/rseq/rseq-arm.h @@ -5,7 +5,17 @@ * (C) Copyright 2016-2018 - Mathieu Desnoyers */ -#define RSEQ_SIG 0x53053053 +/* + * RSEQ_SIG uses the udf A32 instruction with an uncommon immediate operand + * value 0x5305. This traps if user-space reaches this instruction by mistake, + * and the uncommon operand ensures the kernel does not move the instruction + * pointer to attacker-controlled code on rseq abort. + * + * The instruction pattern is: + * + * e7f530f5 udf #21253 ; 0x5305 + */ +#define RSEQ_SIG 0xe7f530f5 #define rseq_smp_mb() __asm__ __volatile__ ("dmb" ::: "memory", "cc") #define rseq_smp_rmb() __asm__ __volatile__ ("dmb" ::: "memory", "cc") @@ -78,7 +88,8 @@ do { \ __rseq_str(table_label) ":\n\t" \ ".word " __rseq_str(version) ", " __rseq_str(flags) "\n\t" \ ".word " __rseq_str(start_ip) ", 0x0, " __rseq_str(post_commit_offset) ", 0x0, " __rseq_str(abort_ip) ", 0x0\n\t" \ - ".word " __rseq_str(RSEQ_SIG) "\n\t" \ + ".arm\n\t" \ + ".inst " __rseq_str(RSEQ_SIG) "\n\t" \ __rseq_str(label) ":\n\t" \ teardown \ "b %l[" __rseq_str(abort_label) "]\n\t"