Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp2805133pxb; Mon, 1 Nov 2021 02:08:00 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzusPSoYujeOpbGeUN0s99tvHEo/FacVEENUJfrKHanRGsnGWITWK34DlxYEfqycHvRCOSP X-Received: by 2002:a02:cd9e:: with SMTP id l30mr21175411jap.86.1635757680482; Mon, 01 Nov 2021 02:08:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1635757680; cv=none; d=google.com; s=arc-20160816; b=dIXu7lnrFG/DdZYpegjat0LuiM70H+vstw2fve8mjkzQRls6CkWxhpSBIUWPIIey6I q/54W4iS5wJHfTu6mB1PoyW+F/N/RBufB/5oyr0S85CrPZ5YkhdFW+77tIYxCOTpNjD0 gzhGMVqDHydfLbp1hjmUoKBKs+UaUrbgC9ZAx/Tdll4AuKV7cpXF8ouXkGEWqGEBTlPX hV4jXzM71JyhzNHbTxAgTQw//1dNdB4PUDt5XdoNK4YR8NcLZOSThdP0ojcGLNnE8Ocz eEsFU/gV+05GUg2CVE2OC23I4JJx1Tpw+PUlHs46fEOVLZGVBf2s+ODk+kgEmGEEQYx0 1KYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=8e2Zw1HhTX3FErHDM4Hv2jUGCHYSSUs72uIP19ebFBg=; b=aYYtdqJhhJJp9Kdyw9tsiCbKkrlTlJEt+SEBRiDjj9V64gv12ECg3PlE9j568EHwmO WRGBqkEI0Ye9V/wg35o+qAhvjKcz4b4KRPveFuMpYetYJlZ844fyiOD3ofVXigBVTS4T 7TzJd2dX/yK+cUd+nBJsFOIxFJi/LVAxsewFDkbhPI0Xd5vDm+8XtDLBnf2MdvmGDe57 Y3lQk3xNkPm6WMGcm+nPkP/lzXxQCDFgBgCvRc9znDx/VDaZq6HH7dysWf22ds6wrZFv w2qu0OUGuVCz2ZtuzWOdqiZlf3gI1Fd63VC2rrEvBRx/FWycEmBx7XMqgCyVuzq4SGGy FSGA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=casper.20170209 header.b=O1NgmmcA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id j13si990916ilu.121.2021.11.01.02.07.48; Mon, 01 Nov 2021 02:08:00 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=casper.20170209 header.b=O1NgmmcA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231743AbhKAJJY (ORCPT + 99 others); Mon, 1 Nov 2021 05:09:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231223AbhKAJJX (ORCPT ); Mon, 1 Nov 2021 05:09:23 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 795FDC061714; Mon, 1 Nov 2021 02:06:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=8e2Zw1HhTX3FErHDM4Hv2jUGCHYSSUs72uIP19ebFBg=; b=O1NgmmcArlP/CVyTZedoMJoN+8 lyvZ0PYu4u2unqztHfgbNIhvSpCwUbqAat2uSORK3lDJ0WGkUaAbocCsY9aifIktmwU2oWOnvmLIh n+dSmIJgXu/iTkWVLfZzbh9DsX7vTij+rue4uY0ftwyLm1hOjWR20yjQxljOIZhWcpS7bYwJRbG2i LB/xN10BH5LXBWXBDzGdlL9kYDtTtp7bAUAeyGdwmZgVtJZALa6N9tg1JBk54fGRb2ZCvXeBE3yls Xs+OUVYBD7WjSx+CJY1e0Zyw3GUgkpT68YefNSGmgvuIYnl9SQTcTL1VvC/f2jXtC1TEJbZ2Rnw/G d7habtoQ==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=worktop.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1mhTCY-003duA-EH; Mon, 01 Nov 2021 09:02:35 +0000 Received: by worktop.programming.kicks-ass.net (Postfix, from userid 1000) id A41899822A3; Mon, 1 Nov 2021 10:01:55 +0100 (CET) Date: Mon, 1 Nov 2021 10:01:55 +0100 From: Peter Zijlstra To: Ard Biesheuvel Cc: Sami Tolvanen , Mark Rutland , X86 ML , Kees Cook , Josh Poimboeuf , Nathan Chancellor , Nick Desaulniers , Sedat Dilek , Steven Rostedt , linux-hardening@vger.kernel.org, Linux Kernel Mailing List , llvm@lists.linux.dev Subject: Re: [PATCH] static_call,x86: Robustify trampoline patching Message-ID: <20211101090155.GW174703@worktop.programming.kicks-ass.net> References: <20211030180249.GU174703@worktop.programming.kicks-ass.net> <20211031163920.GV174703@worktop.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 01, 2021 at 12:36:18AM +0100, Ard Biesheuvel wrote: > On Sun, 31 Oct 2021 at 21:45, Peter Zijlstra wrote: > > > > On Sun, Oct 31, 2021 at 09:21:56PM +0100, Ard Biesheuvel wrote: > > > > > That means we can support static calls on arm64 now without breaking > > > Clang CFI, and work on a solution for the redundant jumps on a more > > > relaxed schedule. > > > > Yes, arm64 has a 'problem' with having already merged the clang-cfi > > stuff :/ > > > > I'm hoping the x86 solution can be an alternative CFI scheme, I'm > > starting to really hate this one. And I'm not at all convinced the > > proposed scheme is the best possible scheme given the constraints of > > kernel code. AFAICT it's a compromise made in userspace. > > Your scheme only works with IBT: the value of %r11 is under the > adversary's control so it could just point it at 'foo+0x10' if it > wants to call foo indirectly, and circumvent the check. So without IBT > (or BTI), I think the check fundamentally belongs in the caller, not > in the callee. How is that not true for the jump table approach? Like I showed earlier, it is *trivial* to reconstruct the actual function pointer from a jump-table entry pointer. In any case, I really want the discussion to start at square one, and show/explain why any chosen CFI scheme is actually good for the kernel. Just because clang happened to have implemented it, doesn't make it the most suitable scheme for the kernel.