From patchwork Mon Nov 23 20:14:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 11926653 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-21.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBF87C388F9 for ; Mon, 23 Nov 2020 20:31:09 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4C89420715 for ; Mon, 23 Nov 2020 20:31:09 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="0afU2/Oq"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="lUVUGtgc" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4C89420715 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:To:From:Subject:Mime-Version:Message-Id:Date: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=BGOO9RlxG832stwEHq+NO9+QYmhWBuFS312rbhKr3FA=; b=0afU2/OqZUdAY6yHrfOLOKnBXF fLu4bsY7wBjZUre4ANC4ovJTafMPlK+Mz+wb/lGZ/yT/wgGV5wZf3WXdOeVpy452rEKbgxYiR4/59 a286hUDywmoGW3b9H8QqsvPaiWk7sFU/PDknEB8nryXMoQZ9L1AQYxyrF4r2w8xcQqI1XUqjph8e9 3oS3jqNOWkQraCJAWtLHY6M1CY5DZsL8BcfgYUCaLbR7p5SYWJg1dyach0GnTnRPJJJLGerCNlqI5 rNshEWe9QFCUltdeDDNn4DrcMQmFchdL45P2I44sueFGnxaMV5PbBHrvRItPQpLawjnUMBDhCw8XP OLlowbQg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1khITq-0000fv-Ee; Mon, 23 Nov 2020 20:30:34 +0000 Received: from mail-qk1-x74a.google.com ([2607:f8b0:4864:20::74a]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1khIEj-00025G-O1 for linux-arm-kernel@lists.infradead.org; Mon, 23 Nov 2020 20:15:00 +0000 Received: by mail-qk1-x74a.google.com with SMTP id x196so2868609qkb.12 for ; Mon, 23 Nov 2020 12:14:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:message-id:mime-version:subject:from:to:cc; bh=c7c8JGgo4s/MC71Qht68VJkAl4Zrn9c78/9WNR2CDz4=; b=lUVUGtgcwf2KClKob6I2aex26CAxIu5P8jQWFNSQp38d2J3HovFnUquz0x7odTj1n0 8NCNtaD/dQS1hSJFVQ+bHuSUxIUR2r26/c5oUMuEU3yXuamcymIFkre1zhJ/kI1/fCTc OHuoaHPsEh9eIGNjNV9yPt+Y4CsXFiX4VZxej2sIX/vEuwHfAmhNdZQEXaMX0HcTIyhs b1spdmzZUG0mBwPBAO2vXZHJW3hpgTHBa+ACgIqgR+8SKE+rwqaZIJWCZho78S5YcxWj lDrBF6vyiWNOM3pcmpWrqf4DAKlzq/PffjW6Zz6kf/TPEelgLrhejgX7Un4I+pT8ksjU VXbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:message-id:mime-version:subject:from :to:cc; bh=c7c8JGgo4s/MC71Qht68VJkAl4Zrn9c78/9WNR2CDz4=; b=AwRbVoaDPXUACkKj+gHYXJ4lUd0+Funev+Yo5Uvjd58+1hxEOx3MzcEnbz83M2LNQ4 hGq4Hs3e9+0Mnz9fEY6AcfM4IVVMA/zxNkjrwT8yQxg5vwklrr2nPiDDl/tWQmzVOteO 7uDDxv+AkA/RQVStWenqhIlSQ36UiN8UdmSUmTcuiaw1HEbw3aL3RvFfxVhPC8DRN4hD XztknExX6mOrWp2emPoEnNKODU76wqLo/HurqdwpSCqy4e+tUnHFNPU1DMUl+uiA108B /+VCBC/83vGf30whnHstp/9Ao1oF226Vr/xGtK0HQ/S4YQMKPgIdd3KbjHnwl4kfS+9l svtg== X-Gm-Message-State: AOAM532HZ73xIW+o6nRBOu5Co6/8571jxqHbX1WGvO2eZQUAJ1es9qit mXb0djZ80MK8MWp9+FkTEWZjs+g9L6T7L8Zy X-Google-Smtp-Source: ABdhPJzKpSvlsTUBQiUkCZkxXxjRdzPaeZqGlsPdEEsFy5rkIjuKCrO6xP56X7BJ/kEFz45HpMdl4S8otFB1tX0s X-Received: from andreyknvl3.muc.corp.google.com ([2a00:79e0:15:13:7220:84ff:fe09:7e9d]) (user=andreyknvl job=sendgmr) by 2002:a0c:83a2:: with SMTP id k31mr1254889qva.57.1606162493822; Mon, 23 Nov 2020 12:14:53 -0800 (PST) Date: Mon, 23 Nov 2020 21:14:30 +0100 Message-Id: Mime-Version: 1.0 X-Mailer: git-send-email 2.29.2.454.gaff20da3a2-goog Subject: [PATCH mm v4 00/19] kasan: boot parameters for hardware tag-based mode From: Andrey Konovalov To: Andrew Morton X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201123_151457_945104_9BC52153 X-CRM114-Status: GOOD ( 23.74 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-arm-kernel@lists.infradead.org, Marco Elver , Catalin Marinas , Kevin Brodsky , Will Deacon , Branislav Rankov , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Alexander Potapenko , Evgenii Stepanov , Andrey Konovalov , Andrey Ryabinin , Vincenzo Frascino , Dmitry Vyukov Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org === Overview Hardware tag-based KASAN mode [1] is intended to eventually be used in production as a security mitigation. Therefore there's a need for finer control over KASAN features and for an existence of a kill switch. This patchset adds a few boot parameters for hardware tag-based KASAN that allow to disable or otherwise control particular KASAN features, as well as provides some initial optimizations for running KASAN in production. There's another planned patchset what will further optimize hardware tag-based KASAN, provide proper benchmarking and tests, and will fully enable tag-based KASAN for production use. Hardware tag-based KASAN relies on arm64 Memory Tagging Extension (MTE) [2] to perform memory and pointer tagging. Please see [3] and [4] for detailed analysis of how MTE helps to fight memory safety problems. The features that can be controlled are: 1. Whether KASAN is enabled at all. 2. Whether KASAN collects and saves alloc/free stacks. 3. Whether KASAN panics on a detected bug or not. The patch titled "kasan: add and integrate kasan boot parameters" of this series adds a few new boot parameters. kasan.mode allows to choose one of three main modes: - kasan.mode=off - KASAN is disabled, no tag checks are performed - kasan.mode=prod - only essential production features are enabled - kasan.mode=full - all KASAN features are enabled The chosen mode provides default control values for the features mentioned above. However it's also possible to override the default values by providing: - kasan.stacktrace=off/on - enable stacks collection (default: on for mode=full, otherwise off) - kasan.fault=report/panic - only report tag fault or also panic (default: report) If kasan.mode parameter is not provided, it defaults to full when CONFIG_DEBUG_KERNEL is enabled, and to prod otherwise. It is essential that switching between these modes doesn't require rebuilding the kernel with different configs, as this is required by the Android GKI (Generic Kernel Image) initiative. === Benchmarks For now I've only performed a few simple benchmarks such as measuring kernel boot time and slab memory usage after boot. There's an upcoming patchset which will optimize KASAN further and include more detailed benchmarking results. The benchmarks were performed in QEMU and the results below exclude the slowdown caused by QEMU memory tagging emulation (as it's different from the slowdown that will be introduced by hardware and is therefore irrelevant). KASAN_HW_TAGS=y + kasan.mode=off introduces no performance or memory impact compared to KASAN_HW_TAGS=n. kasan.mode=prod (manually excluding tagging) introduces 3% of performance and no memory impact (except memory used by hardware to store tags) compared to kasan.mode=off. kasan.mode=full has about 40% performance and 30% memory impact over kasan.mode=prod. Both come from alloc/free stack collection. === Notes This patchset is available here: https://github.com/xairy/linux/tree/up-boot-mte-v4 This patchset is based on v11 of "kasan: add hardware tag-based mode for arm64" patchset [1]. For testing in QEMU hardware tag-based KASAN requires: 1. QEMU built from master [6] (use "-machine virt,mte=on -cpu max" arguments to run). 2. GCC version 10. [1] https://lore.kernel.org/linux-arm-kernel/cover.1606161801.git.andreyknvl@google.com/T/#t [2] https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safety [3] https://arxiv.org/pdf/1802.09517.pdf [4] https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Security%20analysis%20of%20memory%20tagging.pdf [5] https://source.android.com/devices/architecture/kernel/generic-kernel-image [6] https://github.com/qemu/qemu === Tags Tested-by: Vincenzo Frascino === History Changes v3 -> v4: - Rebase onto v11 of the HW_TAGS series. - Don't leak objects for generic KASAN when metadata doesn't fit. - Clarify metadata rework patch title. - Drop unnecessary returns kasan_unpoison_object_data() and kasan_poison_slab(). Changes v2 -> v3: - Rebase onto v10 of the HW_TAGS series. - Add missing return type for kasan_enabled(). - Always define random_tag() as a function. - Mark kasan wrappers as __always_inline. - Don't "kasan: simplify kasan_poison_kfree" as it's based on a false assumption, add a comment instead. - Address documentation comments. - Use instead of . - Rework switches in mm/kasan/hw_tags.c. - Don't init tag in ____kasan_kmalloc(). - Correctly check SLAB_TYPESAFE_BY_RCU flag in mm/kasan/common.c. - Readability fixes for "kasan: clean up metadata allocation and usage". - Change kasan_never_merge() to return SLAB_KASAN instead of excluding it from flags. - (Vincenzo) Address concerns from checkpatch.pl (courtesy of Marco Elver). Changes v1 -> v2: - Rebased onto v9 of the HW_TAGS patchset. - Don't initialize static branches in kasan_init_hw_tags_cpu(), as cpu_enable_mte() can't sleep; do in in kasan_init_hw_tags() instead. - Rename kasan.stacks to kasan.stacktrace. Changes RFC v2 -> v1: - Rebrand the patchset from fully enabling production use to partially addressing that; another optimization and testing patchset will be required. - Rebase onto v8 of KASAN_HW_TAGS series. - Fix "ASYNC" -> "async" typo. - Rework depends condition for VMAP_STACK and update config text. - Remove unneeded reset_tag() macro, use kasan_reset_tag() instead. - Rename kasan.stack to kasan.stacks to avoid confusion with stack instrumentation. - Introduce kasan_stack_collection_enabled() and kasan_is_enabled() helpers. - Simplify kasan_stack_collection_enabled() usage. - Rework SLAB_KASAN flag and metadata allocation (see the corresponding patch for details). - Allow cache merging with KASAN_HW_TAGS when kasan.stacks is off. - Use sync mode dy default for both prod and full KASAN modes. - Drop kasan.trap=sync/async boot parameter, as async mode isn't supported yet. - Choose prod or full mode depending on CONFIG_DEBUG_KERNEL when no kasan.mode boot parameter is provided. - Drop krealloc optimization changes, those will be included in a separate patchset. - Update KASAN documentation to mention boot parameters. Changes RFC v1 -> RFC v2: - Rework boot parameters. - Drop __init from empty kasan_init_tags() definition. - Add cpu_supports_mte() helper that can be used during early boot and use it in kasan_init_tags() - Lots of new KASAN optimization commits. Andrey Konovalov (19): kasan: simplify quarantine_put call site kasan: rename get_alloc/free_info kasan: introduce set_alloc_info kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK kasan: allow VMAP_STACK for HW_TAGS mode kasan: remove __kasan_unpoison_stack kasan: inline kasan_reset_tag for tag-based modes kasan: inline random_tag for HW_TAGS kasan: open-code kasan_unpoison_slab kasan: inline (un)poison_range and check_invalid_free kasan: add and integrate kasan boot parameters kasan, mm: check kasan_enabled in annotations kasan, mm: rename kasan_poison_kfree kasan: don't round_up too much kasan: simplify assign_tag and set_tag calls kasan: clarify comment in __kasan_kfree_large kasan: sanitize objects when metadata doesn't fit kasan, mm: allow cache merging with no metadata kasan: update documentation Documentation/dev-tools/kasan.rst | 186 ++++++++++++-------- arch/Kconfig | 8 +- arch/arm64/kernel/sleep.S | 2 +- arch/x86/kernel/acpi/wakeup_64.S | 2 +- include/linux/kasan.h | 245 ++++++++++++++++++++------ include/linux/mm.h | 22 ++- mm/kasan/common.c | 283 ++++++++++++++++++------------ mm/kasan/generic.c | 27 +-- mm/kasan/hw_tags.c | 185 +++++++++++++++---- mm/kasan/kasan.h | 120 +++++++++---- mm/kasan/quarantine.c | 19 +- mm/kasan/report.c | 61 ++++--- mm/kasan/report_hw_tags.c | 2 +- mm/kasan/report_sw_tags.c | 15 +- mm/kasan/shadow.c | 5 +- mm/kasan/sw_tags.c | 17 +- mm/mempool.c | 4 +- mm/slab_common.c | 3 +- 18 files changed, 829 insertions(+), 377 deletions(-)