linux-kernel - Re: [PATCH 1/5] glibc: Perform rseq(2) registration at C startup and thread creation (v8)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 Apr 2019 17:37:23 +0000
From:   Szabolcs Nagy <Szabolcs.Nagy@....com>
To:     Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
CC:     nd <nd@....com>, Joseph Myers <joseph@...esourcery.com>,
        Will Deacon <Will.Deacon@....com>, carlos <carlos@...hat.com>,
        Florian Weimer <fweimer@...hat.com>,
        libc-alpha <libc-alpha@...rceware.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ben Maurer <bmaurer@...com>,
        Peter Zijlstra <peterz@...radead.org>,
        "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
        Boqun Feng <boqun.feng@...il.com>,
        Dave Watson <davejwatson@...com>, Paul Turner <pjt@...gle.com>,
        Rich Felker <dalias@...c.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        linux-api <linux-api@...r.kernel.org>
Subject: Re: [PATCH 1/5] glibc: Perform rseq(2) registration at C startup and
 thread creation (v8)

On 18/04/2019 18:10, Mathieu Desnoyers wrote:
> 
> ----- On Apr 18, 2019, at 12:07 PM, Szabolcs Nagy Szabolcs.Nagy@....com wrote:
> 
>> On 18/04/2019 16:41, Mathieu Desnoyers wrote:
>>> ----- On Apr 18, 2019, at 11:33 AM, Szabolcs Nagy Szabolcs.Nagy@....com wrote:
>>>
>>>> On 18/04/2019 14:17, Mathieu Desnoyers wrote:
>>>>> ----- On Apr 17, 2019, at 3:56 PM, Mathieu Desnoyers
>>>>> mathieu.desnoyers@...icios.com wrote:
>>>>>> ----- On Apr 17, 2019, at 12:17 PM, Joseph Myers joseph@...esourcery.com wrote:
>>>>>>> On Wed, 17 Apr 2019, Mathieu Desnoyers wrote:
>>>>>>>
>>>>>>>>> +/* RSEQ_SIG is a signature required before each abort handler code.
>>>>>>>>> +
>>>>>>>>> +   It is a 32-bit value that maps to actual architecture code compiled
>>>>>>>>> +   into applications and libraries. It needs to be defined for each
>>>>>>>>> +   architecture. When choosing this value, it needs to be taken into
>>>>>>>>> +   account that generating invalid instructions may have ill effects on
>>>>>>>>> +   tools like objdump, and may also have impact on the CPU speculative
>>>>>>>>> +   execution efficiency in some cases.  */
>>>>>>>>> +
>>>>>>>>> +#define RSEQ_SIG 0xd428bc00	/* BRK #0x45E0.  */
>>>>>>>>
>>>>>>>> After further investigation, we should probably do the following
>>>>>>>> to handle compiling with -mbig-endian on aarch64, which generates
>>>>>>>> binaries with mixed code vs data endianness (little endian code,
>>>>>>>> big endian data):
>>>>>>>
>>>>>>> First, the comment on RSEQ_SIG should specify whether it is to be
>>>>>>> interpreted in the code or the data endianness.
>>>>>>
>>>>>> Right. The signature passed as argument to the rseq registration
>>>>>> system call needs to be in data endianness (currently exposed kernel
>>>>>> ABI).
>>>>>>
>>>>>> Ideally for userspace, we want to define a signature in code endianness
>>>>>> that happens to nicely match specific code patterns.
>>>> ...
>>>>> For aarch64, I think we can simply do:
>>>>>
>>>>> /*
>>>>>  * aarch64 -mbig-endian generates mixed endianness code vs data:
>>>>>  * little-endian code and big-endian data. Ensure the RSEQ_SIG signature
>>>>>  * matches code endianness.
>>>>>  */
>>>>> #define RSEQ_SIG_CODE   0xd428bc00      /* BRK #0x45E0.  */
>>>>>
>>>>> #ifdef __ARM_BIG_ENDIAN
>>>>> #define RSEQ_SIG_DATA   0x00bc28d4      /* BRK #0x45E0.  */
>>>>> #else
>>>>> #define RSEQ_SIG_DATA   RSEQ_SIG_CODE
>>>>> #endif
>>>>>
>>>>> #define RSEQ_SIG        RSEQ_SIG_DATA
>>>>>
>>>>> Feedback is most welcome,
>>>>
>>>> so the RSEQ_SIG value is supposed to be used with .word
>>>> in asm instead of .inst?
>>>
>>> We want a .inst so it translates into a valid trap instruction.
>>> It's better to trap in case program execution reaches this
>>> by mistake (makes debugging easier).
>>
>> that does not make sense to me.
>>
>> ".inst" is an asm directive that requires a the value to
>> be the same on BE and LE (normal insn encoding).
>>
>> ".word" is an asm directive that requires the value to
>> use swapped encoding on BE (if it's used in the instruction
>> stream it will create a data mapping symbol and disasm to
>> .word value instead of the instruction mnemonics).
>>
>> so which one is it?
> 
> We declare the signature with ".inst" in assembler.
> 
> However, we also need to pass that 32-bit signature value as
> argument to the rseq system call when registering rseq.
> 
> The signature comparison is performed by the kernel before
> moving the instruction pointer to the abort handler. It compares
> the signature received as parameter by sys_rseq (data) to the
> 4-byte signature preceding the abort IP.
> 
> On aarch64 big endian, AFAIU the signature in the code is in
> little endian, and the signature value passed as argument to
> the rseq system call is in big endian. One way to handle this
> is to swap the byte order of the signature "data" representation
> passed as argument to sys_rseq.

you have to add a documentation comment somewhere
explaining if RSEQ_SIG is the value that's passed to
the kernel and then aarch64 asm code has to use

 .inst endianfixup(RSEQ_SIG) // or
 .word RSEQ_SIG

or if RSEQ_SIG is used as

 .inst RSEQ_SIG

in aarch64 asm and then endianfixup(RSEQ_SIG) should
be passed to the syscall.

either way it can be a brk 0x45e0 on both LE and BE,
but in the latter case you have to document this in
arch independent way, since the syscall api must be
portable (i assume "RSEQ_SIG" is part of the api).