lkml.org 
[lkml]   [2020]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH v2 00/20] kasan: boot parameters for hardware tag-based mode
    On Tue, Nov 10, 2020 at 11:20 PM Andrey Konovalov <andreyknvl@google.com> wrote:
    >
    > === Overview
    >
    > Hardware tag-based KASAN mode [1] is intended to eventually be used in
    > production as a security mitigation. Therefore there's a need for finer
    > control over KASAN features and for an existence of a kill switch.
    >
    > This patchset adds a few boot parameters for hardware tag-based KASAN that
    > allow to disable or otherwise control particular KASAN features, as well
    > as provides some initial optimizations for running KASAN in production.
    >
    > There's another planned patchset what will further optimize hardware
    > tag-based KASAN, provide proper benchmarking and tests, and will fully
    > enable tag-based KASAN for production use.
    >
    > Hardware tag-based KASAN relies on arm64 Memory Tagging Extension (MTE)
    > [2] to perform memory and pointer tagging. Please see [3] and [4] for
    > detailed analysis of how MTE helps to fight memory safety problems.
    >
    > The features that can be controlled are:
    >
    > 1. Whether KASAN is enabled at all.
    > 2. Whether KASAN collects and saves alloc/free stacks.
    > 3. Whether KASAN panics on a detected bug or not.
    >
    > The patch titled "kasan: add and integrate kasan boot parameters" of this
    > series adds a few new boot parameters.
    >
    > kasan.mode allows to choose one of three main modes:
    >
    > - kasan.mode=off - KASAN is disabled, no tag checks are performed
    > - kasan.mode=prod - only essential production features are enabled
    > - kasan.mode=full - all KASAN features are enabled
    >
    > The chosen mode provides default control values for the features mentioned
    > above. However it's also possible to override the default values by
    > providing:
    >
    > - kasan.stacktrace=off/on - enable stacks collection
    > (default: on for mode=full, otherwise off)
    > - kasan.fault=report/panic - only report tag fault or also panic
    > (default: report)
    >
    > If kasan.mode parameter is not provided, it defaults to full when
    > CONFIG_DEBUG_KERNEL is enabled, and to prod otherwise.

    Can I get everyone's Ack on these boot parameters?

    >
    > It is essential that switching between these modes doesn't require
    > rebuilding the kernel with different configs, as this is required by
    > the Android GKI (Generic Kernel Image) initiative.
    >
    > === Benchmarks
    >
    > For now I've only performed a few simple benchmarks such as measuring
    > kernel boot time and slab memory usage after boot. There's an upcoming
    > patchset which will optimize KASAN further and include more detailed
    > benchmarking results.
    >
    > The benchmarks were performed in QEMU and the results below exclude the
    > slowdown caused by QEMU memory tagging emulation (as it's different from
    > the slowdown that will be introduced by hardware and is therefore
    > irrelevant).
    >
    > KASAN_HW_TAGS=y + kasan.mode=off introduces no performance or memory
    > impact compared to KASAN_HW_TAGS=n.
    >
    > kasan.mode=prod (manually excluding tagging) introduces 3% of performance
    > and no memory impact (except memory used by hardware to store tags)
    > compared to kasan.mode=off.
    >
    > kasan.mode=full has about 40% performance and 30% memory impact over
    > kasan.mode=prod. Both come from alloc/free stack collection.
    >
    > === Notes
    >
    > This patchset is available here:
    >
    > https://github.com/xairy/linux/tree/up-boot-mte-v2
    >
    > and on Gerrit here:
    >
    > https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/3707
    >
    > This patchset is based on v9 of "kasan: add hardware tag-based mode for
    > arm64" patchset [1].
    >
    > For testing in QEMU hardware tag-based KASAN requires:
    >
    > 1. QEMU built from master [6] (use "-machine virt,mte=on -cpu max" arguments
    > to run).
    > 2. GCC version 10.
    >
    > [1] https://lkml.org/lkml/2020/11/10/1187
    > [2] https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safety
    > [3] https://arxiv.org/pdf/1802.09517.pdf
    > [4] https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Security%20analysis%20of%20memory%20tagging.pdf
    > [5] https://source.android.com/devices/architecture/kernel/generic-kernel-image
    > [6] https://github.com/qemu/qemu
    >
    > === History
    >
    > Changes v1 -> v2:
    > - Rebased onto v9 of the HW_TAGS patchset.
    > - Don't initialize static branches in kasan_init_hw_tags_cpu(), as
    > cpu_enable_mte() can't sleep; do in in kasan_init_hw_tags() instead.
    > - Rename kasan.stacks to kasan.stacktrace.
    >
    > Changes RFC v2 -> v1:
    > - Rebrand the patchset from fully enabling production use to partially
    > addressing that; another optimization and testing patchset will be
    > required.
    > - Rebase onto v8 of KASAN_HW_TAGS series.
    > - Fix "ASYNC" -> "async" typo.
    > - Rework depends condition for VMAP_STACK and update config text.
    > - Remove unneeded reset_tag() macro, use kasan_reset_tag() instead.
    > - Rename kasan.stack to kasan.stacks to avoid confusion with stack
    > instrumentation.
    > - Introduce kasan_stack_collection_enabled() and kasan_is_enabled()
    > helpers.
    > - Simplify kasan_stack_collection_enabled() usage.
    > - Rework SLAB_KASAN flag and metadata allocation (see the corresponding
    > patch for details).
    > - Allow cache merging with KASAN_HW_TAGS when kasan.stacks is off.
    > - Use sync mode dy default for both prod and full KASAN modes.
    > - Drop kasan.trap=sync/async boot parameter, as async mode isn't supported
    > yet.
    > - Choose prod or full mode depending on CONFIG_DEBUG_KERNEL when no
    > kasan.mode boot parameter is provided.
    > - Drop krealloc optimization changes, those will be included in a separate
    > patchset.
    > - Update KASAN documentation to mention boot parameters.
    >
    > Changes RFC v1 -> RFC v2:
    > - Rework boot parameters.
    > - Drop __init from empty kasan_init_tags() definition.
    > - Add cpu_supports_mte() helper that can be used during early boot and use
    > it in kasan_init_tags()
    > - Lots of new KASAN optimization commits.
    >
    > Andrey Konovalov (20):
    > kasan: simplify quarantine_put call site
    > kasan: rename get_alloc/free_info
    > kasan: introduce set_alloc_info
    > kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK
    > kasan: allow VMAP_STACK for HW_TAGS mode
    > kasan: remove __kasan_unpoison_stack
    > kasan: inline kasan_reset_tag for tag-based modes
    > kasan: inline random_tag for HW_TAGS
    > kasan: inline kasan_poison_memory and check_invalid_free
    > kasan: inline and rename kasan_unpoison_memory
    > kasan: add and integrate kasan boot parameters
    > kasan, mm: check kasan_enabled in annotations
    > kasan: simplify kasan_poison_kfree
    > kasan, mm: rename kasan_poison_kfree
    > kasan: don't round_up too much
    > kasan: simplify assign_tag and set_tag calls
    > kasan: clarify comment in __kasan_kfree_large
    > kasan: clean up metadata allocation and usage
    > kasan, mm: allow cache merging with no metadata
    > kasan: update documentation
    >
    > Documentation/dev-tools/kasan.rst | 180 ++++++++++++--------
    > arch/Kconfig | 8 +-
    > arch/arm64/kernel/sleep.S | 2 +-
    > arch/x86/kernel/acpi/wakeup_64.S | 2 +-
    > include/linux/kasan.h | 253 +++++++++++++++++++++------
    > include/linux/mm.h | 22 ++-
    > kernel/fork.c | 2 +-
    > mm/kasan/common.c | 274 ++++++++++++++++++------------
    > mm/kasan/generic.c | 27 +--
    > mm/kasan/hw_tags.c | 183 ++++++++++++++++----
    > mm/kasan/kasan.h | 113 ++++++++----
    > mm/kasan/quarantine.c | 13 +-
    > mm/kasan/report.c | 61 ++++---
    > mm/kasan/report_hw_tags.c | 2 +-
    > mm/kasan/report_sw_tags.c | 13 +-
    > mm/kasan/shadow.c | 5 +-
    > mm/kasan/sw_tags.c | 17 +-
    > mm/mempool.c | 2 +-
    > mm/slab_common.c | 13 +-
    > 19 files changed, 826 insertions(+), 366 deletions(-)
    >
    > --
    > 2.29.2.222.g5d2a92d10f8-goog
    >

    \
     
     \ /
      Last update: 2020-11-10 23:25    [W:4.681 / U:0.336 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site