From patchwork Fri Oct 5 08:47:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kristina Martsenko X-Patchwork-Id: 10627749 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 88AD11515 for ; Fri, 5 Oct 2018 09:48:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8704328997 for ; Fri, 5 Oct 2018 09:48:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7B1A5289B6; Fri, 5 Oct 2018 09:48:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 09E0728997 for ; Fri, 5 Oct 2018 09:48:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=PHFXLcza882Igy+ygBSOebsyrnLezCHx/LEchjf53sk=; b=lHFBUnKRr0eWWRAKblgMeQIYC1 S38eJxLWdEc6yjQJfmZzy7UTekI1xpQ3x5xzxYz7tEHpfCUfXDGCQvhwmrLv24PA/eP3q6YQhwhUc HjzKnTv7/hFXrDqO9B+fHEZKn9S2IXEZa6DxkMsrCBrJfwrR6XMpuW7Vqd/2sqWsEIz0PqHHgbRFK CY8N1dnPDbcD99nUzqhfnK1kU0PWyOeSbiUeUnzlWm9QMkCrx3drmpyi5bfWfyf1nc4t9/1R6tFLc bv0rEOpG2Q+aHUZAFA9wKN4riCCEbOaGyB+lRdvCcmkatNKuvqqRoiTZ60QC5BZSg78upiHj/I5P7 qbJt3fMw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1g8MiU-0002jk-Nj; Fri, 05 Oct 2018 09:48:14 +0000 Received: from merlin.infradead.org ([2001:8b0:10b:1231::1]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1g8MhF-0002Cw-HR for linux-arm-kernel@bombadil.infradead.org; Fri, 05 Oct 2018 09:46:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=UnNiQOodXRr3Pgd/SPKtwkWFa6koidjSXw7piIu7amA=; b=EVwmsv4DendUt4LYmswi9cyXk fyrkzjoTBlARgLofbVNPyg/VQzbMAZQtPrXU1JgAHmLk8XbUii2Vi0njhYgesTgdqv7R2fI2rdGWg K4P8OVFqpNuy1DqN1jVLDT3z0RBbJYTjuCBB+QBqiXBsX4INVNSHARWRM6JXC4N1ZQ9OWOAir28SN zWEf5nM00cJSgg2GLS/eVC8WnEKwCh5fpRc3aXKQaebAts25NjyNBcSlyAWTw3liYSQSck0ijTIjY j0Q1p2gXWM9bDqvBn4OauJPssJth7oTjXzT2QBjQMI75WUKiawdCJhZQLRsVVEj284NsvD0hJ4RKJ 5ln7XoMUA==; Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70] helo=foss.arm.com) by merlin.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1g8LpF-0002Aq-1F for linux-arm-kernel@lists.infradead.org; Fri, 05 Oct 2018 08:51:09 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id C49E616A3; Fri, 5 Oct 2018 01:51:03 -0700 (PDT) Received: from moonbear.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 8F75B3F5B3; Fri, 5 Oct 2018 01:51:00 -0700 (PDT) From: Kristina Martsenko To: linux-arm-kernel@lists.infradead.org Subject: [RFC 17/17] arm64: compile the kernel with ptrauth -msign-return-address Date: Fri, 5 Oct 2018 09:47:54 +0100 Message-Id: <20181005084754.20950-18-kristina.martsenko@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20181005084754.20950-1-kristina.martsenko@arm.com> References: <20181005084754.20950-1-kristina.martsenko@arm.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181005_045109_174689_5CC3569A X-CRM114-Status: GOOD ( 14.10 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , linux-arch@vger.kernel.org, Andrew Jones , Jacob Bramley , Arnd Bergmann , Ard Biesheuvel , Marc Zyngier , Catalin Marinas , Adam Wallis , "Suzuki K . Poulose" , Will Deacon , Christoffer Dall , kvmarm@lists.cs.columbia.edu, Ramana Radhakrishnan , Amit Kachhap , Dave P Martin , linux-kernel@vger.kernel.org, Kees Cook MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Compile all functions with two ptrauth instructions: paciasp in the prologue to sign the return address, and autiasp in the epilogue to authenticate the return address. This should help protect the kernel against attacks using return-oriented programming. CONFIG_ARM64_PTR_AUTH enables pointer auth for both userspace and the kernel. Signed-off-by: Mark Rutland Signed-off-by: Kristina Martsenko --- arch/arm64/Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile index 106039d25e2f..dbcd43ea99d8 100644 --- a/arch/arm64/Makefile +++ b/arch/arm64/Makefile @@ -56,6 +56,10 @@ KBUILD_AFLAGS += $(lseinstr) $(brokengasinst) KBUILD_CFLAGS += $(call cc-option,-mabi=lp64) KBUILD_AFLAGS += $(call cc-option,-mabi=lp64) +ifeq ($(CONFIG_ARM64_PTR_AUTH),y) +KBUILD_CFLAGS += -msign-return-address=all +endif + ifeq ($(CONFIG_CPU_BIG_ENDIAN), y) KBUILD_CPPFLAGS += -mbig-endian CHECKFLAGS += -D__AARCH64EB__