Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make SCS and PAC selectable at runtime #168

Open
2 of 4 tasks
kees opened this issue Oct 19, 2021 · 3 comments
Open
2 of 4 tasks

Make SCS and PAC selectable at runtime #168

kees opened this issue Oct 19, 2021 · 3 comments
Assignees
Labels
[ARCH] arm64 Needed on the 64-bit ARM architecture (ARCH=arm64) enhancement New feature or request [Feature] CFI Involves Control Flow Integrity

Comments

@kees
Copy link

kees commented Oct 19, 2021

Not all arm64 devices support PAC, so for a distro or GKI kernel, there needs to be a way to dynamically select SCS or PAC at runtime so there is no redundant work happening in the PAC case.

objtool appears to be overkill for finding all the PAC/SCS instrumentation points, so a better approach is needed:
https://lore.kernel.org/lkml/CAMj1kXF31FxCTbo4M8MX0aaegaq7AQXMUdCtsm6xrKUFSpkzjA@mail.gmail.com/

  • gcc support
  • clang support: done
  • core kernel support
  • kernel module support
@kees
Copy link
Author

kees commented Oct 19, 2021

cc @ardbiesheuvel

@ardbiesheuvel
Copy link
Collaborator

https://lore.kernel.org/all/20211013152243.2216899-1-ardb@kernel.org/

@kees kees added enhancement New feature or request [ARCH] arm64 Needed on the 64-bit ARM architecture (ARCH=arm64) [Feature] CFI Involves Control Flow Integrity labels Apr 6, 2022
@ardbiesheuvel
Copy link
Collaborator

RFCv2 sent to the list

https://lore.kernel.org/linux-arm-kernel/20220505161011.1801596-1-ardb@kernel.org/

This version is Clang only for the moment, as GCC has a DWARF generation issue where the CFI annotation is emitted for the wrong instruction. Other than that, the implementation is mostly complete, in the sense that it applies to both the core kernel and loadable modules, and that it checks PAC/BTI h/w support first, and gives up if either is supported (PAC makes SCS redundant, and BTI conflicts with code patching, as the PACIASP instruction is also a landing pad, and therefore needs to be retained)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[ARCH] arm64 Needed on the 64-bit ARM architecture (ARCH=arm64) enhancement New feature or request [Feature] CFI Involves Control Flow Integrity
Projects
None yet
Development

No branches or pull requests

2 participants