From patchwork Wed Feb 21 02:02:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeremy Linton X-Patchwork-Id: 13564843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D68EFC48BC4 for ; Wed, 21 Feb 2024 02:03:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=UoQevFakqNxQIkdMVD4AXsCBTqOOSfMzc5A1ctoRBE0=; b=IZabVWnl/REf1H ncuEVkFfEBYroN5QZsdlS6aF5M7u59daZB7Y5IdzKRYd4KqLKuGB1SR+uzsRLeN4jDG4eDGZuEx64 XKrrapjmv0Zp/Qvd/SFVNsGF7z31HENhO3nUaNbVHKdnkwTSSZVeDD/L/GmCF+7PjnOSKNVx+3JsC qvbx1G/JkLkKQPa3joxK5IitSW4chcxDAQf9Q3MgZ0DdroUE7d+571eTtMuT/vTAXCgZIIR/PpjbJ 0D78toFzRJnHFP+pWVuRWZtXR+wUvn3QgezvxFbBRH+Pel3dxrSoTG9HbIUhYMzWn0QavcPpsGFD9 6s7dYCV5plHFqkW7SqIg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rcbxI-0000000GoJt-0PvW; Wed, 21 Feb 2024 02:03:28 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rcbxF-0000000GoJE-0rzZ for linux-arm-kernel@lists.infradead.org; Wed, 21 Feb 2024 02:03:26 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9EE08FEC; Tue, 20 Feb 2024 18:03:54 -0800 (PST) Received: from mammon-tx2.austin.arm.com (mammon-tx2.austin.arm.com [10.118.28.65]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id DAC763F766; Tue, 20 Feb 2024 18:03:15 -0800 (PST) From: Jeremy Linton To: linux-arm-kernel@lists.infradead.org Cc: catalin.marinas@arm.com, will@kernel.org, keescook@chromium.org, gustavoars@kernel.org, mark.rutland@arm.com, rostedt@goodmis.org, arnd@arndb.de, broonie@kernel.org, guohui@uniontech.com, Manoj.Iyer@arm.com, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, Jeremy Linton , James Yang , Shiyou Huang Subject: [RFC] arm64: syscall: Direct PRNG kstack randomization Date: Tue, 20 Feb 2024 20:02:58 -0600 Message-ID: <20240221020258.1210148-1-jeremy.linton@arm.com> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240220_180325_368652_BB353353 X-CRM114-Status: GOOD ( 17.76 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The existing arm64 stack randomization uses the kernel rng to acquire 5 bits of address space randomization. This is problematic because it creates non determinism in the syscall path when the rng needs to be generated or reseeded. This shows up as large tail latencies in some benchmarks and directly affects the minimum RT latencies as seen by cyclictest. Other architectures are using timers/cycle counters for this function, which is sketchy from a randomization perspective because it should be possible to estimate this value from knowledge of the syscall return time, and from reading the current value of the timer/counters. So, a poor rng should be better than the cycle counter if it is hard to extract the stack offsets sufficiently to be able to detect the PRNG's period. So, we can potentially choose a 'better' or larger PRNG, going as far as using one of the CSPRNGs already in the kernel, but the overhead increases appropriately. Further, there are a few options for reseeding, possibly out of the syscall path, but is it even useful in this case? Reported-by: James Yang Reported-by: Shiyou Huang Signed-off-by: Jeremy Linton --- arch/arm64/kernel/syscall.c | 55 ++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c index 9a70d9746b66..70143cb8c7be 100644 --- a/arch/arm64/kernel/syscall.c +++ b/arch/arm64/kernel/syscall.c @@ -37,6 +37,59 @@ static long __invoke_syscall(struct pt_regs *regs, syscall_fn_t syscall_fn) return syscall_fn(regs); } +#ifdef CONFIG_RANDOMIZE_KSTACK_OFFSET +DEFINE_PER_CPU(u32, kstackrng); +static u32 xorshift32(u32 state) +{ + /* + * From top of page 4 of Marsaglia, "Xorshift RNGs" + * This algorithm is intended to have a period 2^32 -1 + * And should not be used anywhere else outside of this + * code path. + */ + state ^= state << 13; + state ^= state >> 17; + state ^= state << 5; + return state; +} + +static u16 kstack_rng(void) +{ + u32 rng = raw_cpu_read(kstackrng); + + rng = xorshift32(rng); + raw_cpu_write(kstackrng, rng); + return rng & 0x1ff; +} + +/* Should we reseed? */ +static int kstack_rng_setup(unsigned int cpu) +{ + u32 rng_seed; + + do { + rng_seed = get_random_u32(); + } while (!rng_seed); + raw_cpu_write(kstackrng, rng_seed); + return 0; +} + +static int kstack_init(void) +{ + int ret; + + ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "arm64/cpuinfo:kstackrandomize", + kstack_rng_setup, NULL); + if (ret < 0) + pr_err("kstack: failed to register rng callbacks.\n"); + return 0; +} + +arch_initcall(kstack_init); +#else +static u16 kstack_rng(void) { return 0; } +#endif /* CONFIG_RANDOMIZE_KSTACK_OFFSET */ + static void invoke_syscall(struct pt_regs *regs, unsigned int scno, unsigned int sc_nr, const syscall_fn_t syscall_table[]) @@ -66,7 +119,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, * * The resulting 5 bits of entropy is seen in SP[8:4]. */ - choose_random_kstack_offset(get_random_u16() & 0x1FF); + choose_random_kstack_offset(kstack_rng()); } static inline bool has_syscall_work(unsigned long flags)