On Thu, Oct 15, 2020 at 4:41 PM Marco Elver <elver@xxxxxxxxxx> wrote: > > On Wed, 14 Oct 2020 at 22:44, Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote: > > This patchset is not complete (see particular TODOs in the last patch), > > and I haven't performed any benchmarking yet, but I would like to start the > > discussion now and hear people's opinions regarding the questions mentioned > > below. > > > > === Overview > > > > This patchset adopts the existing hardware tag-based KASAN mode [1] for > > use in production as a memory corruption mitigation. Hardware tag-based > > KASAN relies on arm64 Memory Tagging Extension (MTE) [2] to perform memory > > and pointer tagging. Please see [3] and [4] for detailed analysis of how > > MTE helps to fight memory safety problems. > > > > The current plan is reuse CONFIG_KASAN_HW_TAGS for production, but add a > > boot time switch, that allows to choose between a debugging mode, that > > includes all KASAN features as they are, and a production mode, that only > > includes the essentials like tag checking. > > > > It is essential that switching between these modes doesn't require > > rebuilding the kernel with different configs, as this is required by the > > Android GKI initiative [5]. > > > > The last patch of this series adds a new boot time parameter called > > kasan_mode, which can have the following values: > > > > - "kasan_mode=on" - only production features > > - "kasan_mode=debug" - all debug features > > - "kasan_mode=off" - no checks at all (not implemented yet) > > > > Currently outlined differences between "on" and "debug": > > > > - "on" doesn't keep track of alloc/free stacks, and therefore doesn't > > require the additional memory to store those > > - "on" uses asyncronous tag checking (not implemented yet) > > > > === Questions > > > > The intention with this kind of a high level switch is to hide the > > implementation details. Arguably, we could add multiple switches that allow > > to separately control each KASAN or MTE feature, but I'm not sure there's > > much value in that. > > > > Does this make sense? Any preference regarding the name of the parameter > > and its values? > > KASAN itself used to be a debugging tool only. So introducing an "on" > mode which no longer follows this convention may be confusing. > Instead, maybe the following might be less confusing: > > "full" - current "debug", normal KASAN, all debugging help available. > "opt" - current "on", optimized mode for production. > "on" - automatic selection => chooses "full" if CONFIG_DEBUG_KERNEL, > "opt" otherwise. > "off" - as before. > > Also, if there is no other kernel boot parameter named "kasan" yet, > maybe it could just be "kasan=..." ? > > > What should be the default when the parameter is not specified? I would > > argue that it should be "debug" (for hardware that supports MTE, otherwise > > "off"), as it's the implied default for all other KASAN modes. > > Perhaps we could make this dependent on CONFIG_DEBUG_KERNEL as above. > I do not think that having the full/debug KASAN enabled on production > kernels adds any value because for it to be useful requires somebody > to actually look at the stacktraces; I think that choice should be > made explicitly if it's a production kernel. My guess is that we'll > save explaining performance differences and resulting headaches for > ourselves and others that way. > > > Should we somehow control whether to panic the kernel on a tag fault? > > Another boot time parameter perhaps? > > It already respects panic_on_warn, correct? > > > Any ideas as to how properly estimate the slowdown? As there's no > > MTE-enabled hardware yet, the only way to test these patches is use an > > emulator (like QEMU). The delay that is added by the emulator (for setting > > and checking the tags) is different from the hardware delay, and this skews > > the results. > > > > A question to KASAN maintainers: what would be the best way to support the > > "off" mode? I see two potential approaches: add a check into each kasan > > callback (easier to implement, but we still call kasan callbacks, even > > though they immediately return), or add inline header wrappers that do the > > same. > [...] CC Kostya and Serban.
