Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1573520 > unrolled thread
| Started by | Kees Cook <keescook@chromium.org> |
|---|---|
| First post | 2017-02-04 00:30 +0100 |
| Last post | 2017-02-11 00:40 +0100 |
| Articles | 4 on this page of 24 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 0/4] refcount_t followups... Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[PATCH 2/4] lkdtm: convert to refcount_t testing Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[tip:locking/core] lkdtm: Convert to refcount_t testing tip-bot for Kees Cook <tipbot@zytor.com> - 2017-02-10 09:50 +0100
[PATCH 3/4] bug: Switch data corruption check to __must_check Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[PATCH 1/4] refcount_t: fix Kconfig help Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-05 16:50 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-06 00:40 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-06 10:00 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-06 18:00 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 09:40 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 12:20 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 13:40 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 15:00 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 16:10 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 17:10 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 18:40 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 19:00 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-08 10:20 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-08 10:50 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-08 16:00 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-08 22:30 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-09 11:30 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-11 00:40 +0100
Page 2 of 2 — ← Prev page 1 [2]
| From | Mark Rutland <mark.rutland@arm.com> |
|---|---|
| Date | 2017-02-08 16:00 +0100 |
| Subject | Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION |
| Message-ID | <t8BSW-1B1-21@gated-at.bofh.it> |
| In reply to | #1576375 |
On Wed, Feb 08, 2017 at 10:12:50AM +0100, Peter Zijlstra wrote:
> On x86 have have __ex_table and __bug_table. The former is used for all
> sorts of things, including fixing up faults.
>
> Now, our struct exception_table_entry has a third field used to specify
> a handler, see commit:
>
> 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options")
Ah; neat!
> Still, if we want to allow a generic implementation that does a function
> call, the handler prototype should probably look like:
>
> void exception_value(unsigned long value);
>
> Which means the arch bits need a trampoline and we also need to encode
> that. The best I've come up with is having nr_regs trampolines and
> stuffing the trampoline function in the ->handler field and then using
> the ->to field to encode the actual handler.
>
> Something like:
>
> #define EX_REG_HANDLER(_reg) \
> bool ex_handler_value_##_reg(const struct exception_table_entry *fixup, \
> struct pt_regs *regs, int trapnr) \
> { \
> void (*handler)(unsigned long) = \
> (void *)((unsigned long)&fixup->to + fixup->to); \
> \
> if (trapnr != X86_TRAP_UD) \
> return false; \
> \
> regs->ip += 2; /* size of UD2 instruction */ \
> handler(regs->_reg); \
> return true; \
> }
>
> EX_REG_HANDLER(bx);
> EX_REG_HANDLER(cx);
> ...
> EX_REG_HANDLER(ss);
>
>
> asm (
> " .macro reg_to_handler r\n"
> " .irp rs,bx,cx,...,ss\n"
> " .ifc \\r, %\\rs\n"
> " ex_handler_value_\\rs\n"
> " .endif\n"
> " .endr\n"
> " .endm\n"
> );
>
> #define EXCEPTION_VALUE(val, handler) \
> asm volatile ("1: ud2" \
> _ASM_EXTABLE_HANDLE(1b, handler, \
> reg_to_handler %0) \
> : : "r" (val))
>
>
> Where the generic version can simply be:
>
> #define EXCEPTION_VALUE(val, handler) handler((unsigned long)val)
>
> Makes sense?
That all makes sense to me.
I'll take a look at putting together an arm64 equivalent to the x86
extable patch, along with cleanup to our SW breakpoint code (which we
use in lieu for x86's UD2).
Thanks,
Mark.
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2017-02-08 22:30 +0100 |
| Subject | Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION |
| Message-ID | <t8HYn-5wK-41@gated-at.bofh.it> |
| In reply to | #1576375 |
On Wed, Feb 8, 2017 at 1:12 AM, Peter Zijlstra <peterz@infradead.org> wrote:
> On Tue, Feb 07, 2017 at 05:55:42PM +0000, Mark Rutland wrote:
>> On Tue, Feb 07, 2017 at 06:30:36PM +0100, Peter Zijlstra wrote:
>> > On Tue, Feb 07, 2017 at 04:03:01PM +0000, Mark Rutland wrote:
>> > > For x86 it's a little painful due to '%' in the register names, but it looks
>> > > possible. The below appears to do the mangling correctly (then screams due to
>> > > the mangled result being nonexistent).
>> >
>> > > asm(
>> > > " .macro reg_to_offset r\n"
>> > > " .irp rs,eax,ebx,ecx,edx\n"
>> > > " .ifc \\r, %\\rs\n"
>> > > " __offset_of_\\rs\n"
>> > > " .endif\n"
>> > > " .endr\n"
>> > > " .endm\n"
>> > > );
>> > >
>> > > #define asm_sym(var) asm volatile("reg_to_offset %0\n" : : "r" (var))
>> >
>> > Oh gawd that's a most gnarly hack.
>>
>> :)
>>
>> > Do we want to go do that for all archs or somehow cook a generic
>> > fallback that ends up doing a full function call or something?
>>
>> Given the arch-specific reg->blah mapping is so "fun", I guess a generic
>> fallback would be a good start.
>>
>> I haven't figured out all the plumbing details. It'd be nice to reuse
>> the bug infrastructure so that arches don't have to implement another
>> trap and callback pair, but I guess the reg details need to live in
>> another data structure.
>
> On x86 have have __ex_table and __bug_table. The former is used for all
> sorts of things, including fixing up faults.
>
> Now, our struct exception_table_entry has a third field used to specify
> a handler, see commit:
>
> 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options")
>
> Also, given we trigger things with a known instruction at these sites,
> the ->to field is reusable and can be used to encode the register
> offset.
>
> Still, if we want to allow a generic implementation that does a function
> call, the handler prototype should probably look like:
>
> void exception_value(unsigned long value);
>
> Which means the arch bits need a trampoline and we also need to encode
> that. The best I've come up with is having nr_regs trampolines and
> stuffing the trampoline function in the ->handler field and then using
> the ->to field to encode the actual handler.
>
> Something like:
>
> #define EX_REG_HANDLER(_reg) \
> bool ex_handler_value_##_reg(const struct exception_table_entry *fixup, \
> struct pt_regs *regs, int trapnr) \
> { \
> void (*handler)(unsigned long) = \
> (void *)((unsigned long)&fixup->to + fixup->to); \
> \
> if (trapnr != X86_TRAP_UD) \
> return false; \
> \
> regs->ip += 2; /* size of UD2 instruction */ \
> handler(regs->_reg); \
> return true; \
> }
>
> EX_REG_HANDLER(bx);
> EX_REG_HANDLER(cx);
> ...
> EX_REG_HANDLER(ss);
>
>
> asm (
> " .macro reg_to_handler r\n"
> " .irp rs,bx,cx,...,ss\n"
> " .ifc \\r, %\\rs\n"
> " ex_handler_value_\\rs\n"
> " .endif\n"
> " .endr\n"
> " .endm\n"
> );
>
> #define EXCEPTION_VALUE(val, handler) \
> asm volatile ("1: ud2" \
> _ASM_EXTABLE_HANDLE(1b, handler, \
> reg_to_handler %0) \
> : : "r" (val))
>
>
> Where the generic version can simply be:
>
> #define EXCEPTION_VALUE(val, handler) handler((unsigned long)val)
>
>
> Makes sense?
Ooooh, that is intense. And the trampolines (EX_REG_HANDLERs) are all
just there to catch whatever register gcc decides to stuff the value
into? *cover face* Sure, okay. :)
I wonder how many existing WARN callsites could be repurposed to use this?
-Kees
--
Kees Cook
Pixel Security
[toc] | [prev] | [next] | [standalone]
| From | Peter Zijlstra <peterz@infradead.org> |
|---|---|
| Date | 2017-02-09 11:30 +0100 |
| Subject | Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION |
| Message-ID | <t8U9c-4Wt-15@gated-at.bofh.it> |
| In reply to | #1577092 |
On Wed, Feb 08, 2017 at 01:20:26PM -0800, Kees Cook wrote:
> Ooooh, that is intense. And the trampolines (EX_REG_HANDLERs) are all
> just there to catch whatever register gcc decides to stuff the value
> into? *cover face* Sure, okay. :)
Right, they shouldn't be big functions, but barring whole program LTO
there's just no knowing which are unused.
> I wonder how many existing WARN callsites could be repurposed to use this?
At the very least all WARN/BUG instances with trivial @format argument
that are inlined I think. For example, things like:
static inline some_function()
{
/* ... */
WARN(cond, "blah blah blah\n");
/* ... */
}
where the format has no arguments. Here we can out-of-line the printk()
stuff, which, as is the purpose here, shrinks the size of the inline.
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2017-02-11 00:40 +0100 |
| Subject | Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION |
| Message-ID | <t9sXg-1A0-7@gated-at.bofh.it> |
| In reply to | #1577458 |
On Thu, Feb 9, 2017 at 2:27 AM, Peter Zijlstra <peterz@infradead.org> wrote:
> On Wed, Feb 08, 2017 at 01:20:26PM -0800, Kees Cook wrote:
>
>> Ooooh, that is intense. And the trampolines (EX_REG_HANDLERs) are all
>> just there to catch whatever register gcc decides to stuff the value
>> into? *cover face* Sure, okay. :)
>
> Right, they shouldn't be big functions, but barring whole program LTO
> there's just no knowing which are unused.
>
>> I wonder how many existing WARN callsites could be repurposed to use this?
>
> At the very least all WARN/BUG instances with trivial @format argument
> that are inlined I think. For example, things like:
>
> static inline some_function()
> {
> /* ... */
> WARN(cond, "blah blah blah\n");
> /* ... */
> }
>
> where the format has no arguments. Here we can out-of-line the printk()
> stuff, which, as is the purpose here, shrinks the size of the inline.
Unless there is some other unholy macros trick, I think we'd need a
separate "WARN_CONST" or something macro to do this (i.e.
WARN_CONST(const, const_str) instead of WARN(cond, fmt, ...)), since
detecting a single-item vararg in a macro is very weird/impossible to
do. Hrmm.
-Kees
--
Kees Cook
Pixel Security
[toc] | [prev] | [standalone]
Page 2 of 2 — ← Prev page 1 [2]
Back to top | Article view | linux.kernel
csiph-web