Hi Julius,
A lot of the rationale for the default initialization is not listed in the documentation and I do think perhaps we can do better as at the end of the day it’s decisions around platform ports and how they are going to be deployed in products that may influence
decisions here for changing the defaults.
Your thoughts around attacker control able crashes are a valid one. I don’t think any one setting is all pros with no cons and platform providers need to make decisions but I think the default code with the settings is more likely to flush out alignment bugs
and although I don’t have specific examples any bug could play a part in future vulnerability so best to flush them out rather than lie hidden.
It could be said that in the reference implementation a known crash may be better than a more nebulous unknown behaviour that could come with an undetected bug that could later be taken advantage of.
The use a DEBUG flag is an idea but we have all seen debug builds not operating like production builds so the value may be lost here.
It’s why on reviewing our documentation on seeing your post I think we could do better to explain the rationale for the settings in TF-A so platform owners can be better informed and override default settings if they really feel they have the need.
Cheers
Joanna
From: Julius Werner
Sent: Monday, November 9, 2020 10:42 PM
To: Joanna Farley
Cc: raghu.ncstate@icloud.com; tf-a@lists.trustedfirmware.org
Subject: Re: [TF-A] Alignment fault checking in EL3
Hi Joanna,
Thank you for your detailed response. I was mostly wondering if this
was a deliberate choice or just something someone wrote this way once
and nobody ever thought about again. Since it sounds like it is
intentional, I'll try to understand your rationale better.
> Maintaining these settings in production is also advised as best practice as it is known any such defects can possibly play a part in allowing an actor to take advantage of the defect as part of a vulnerability and memory related defects in particular can
be taken advantage of. So it seems prudent to guard against them.
I'm curious, can you elaborate on that? I can't really think of a
scenario where lack of alignment checking can really make code behave
in an unintentional way. (I don't think Raghu's scenario of accessing
MMIO registers works because those registers should be mapped with a
Device memory type anyway, and that memory type enforces aligned
accesses regardless of the SCTLR.A flag.) If there truly are security
concerns with this I can understand your approach much better.
> Saying all this for those few cases where unaligned accesses are correct and intentional we could look to define better ways to handle these and provide that in reference code as an option to try and get the best for robustness and debuggability which seemed
a big part of the concern in your post. Team members in Arm have ideas on how that could be provided but it needs broader discussion on the implications for security and performance before taking forward.
There are scenarios where unaligned accesses can be intentional, but I
am not too worried about those -- there are ways to work around that,
and if we make it policy that those accesses always need to be written
that way I'm okay with that. What I am worried about is mistakes and
oversights that slip through testing and then cause random or even
attacker-controllable crashes in production. If the main reason you're
enabling this flag is to help with early detection of coding mistakes,
I wonder if the best approach would be to enable it for DEBUG=1 and
disable it for DEBUG=0 (of course, if there are really security issues
associated with it like you mentioned above, that wouldn't make
sense).