lkml.org 
[lkml]   [2018]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] arm64: mm: mark tramp_pg_dir read-only
    On 19 June 2018 at 17:55, Will Deacon <will.deacon@arm.com> wrote:
    > On Tue, Jun 19, 2018 at 05:51:46PM +0200, Ard Biesheuvel wrote:
    >> On 19 June 2018 at 17:50, Will Deacon <will.deacon@arm.com> wrote:
    >> > On Tue, Jun 19, 2018 at 05:40:26PM +0200, Ard Biesheuvel wrote:
    >> >> On 19 June 2018 at 17:37, Will Deacon <will.deacon@arm.com> wrote:
    >> >> > On Tue, Jun 19, 2018 at 05:29:03PM +0200, Ard Biesheuvel wrote:
    >> >> >> On 19 June 2018 at 17:28, Will Deacon <will.deacon@arm.com> wrote:
    >> >> >> > On Tue, Jun 19, 2018 at 05:23:41PM +0200, Ard Biesheuvel wrote:
    >> >> >> >> On 19 June 2018 at 17:20, Will Deacon <will.deacon@arm.com> wrote:
    >> >> >> >> > On Wed, May 30, 2018 at 11:53:20AM +0200, Ard Biesheuvel wrote:
    >> >> >> >> >> On 30 May 2018 at 11:14, Will Deacon <will.deacon@arm.com> wrote:
    >> >> >> >> >> > On Wed, May 30, 2018 at 12:48:06PM +0800, YaoJun wrote:
    >> >> >> >> >> >> diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
    >> >> >> >> >> >> index 2dbb2c9f1ec1..ac4b22c7e435 100644
    >> >> >> >> >> >> --- a/arch/arm64/mm/mmu.c
    >> >> >> >> >> >> +++ b/arch/arm64/mm/mmu.c
    >> >> >> >> >> >> @@ -551,6 +551,10 @@ static int __init map_entry_trampoline(void)
    >> >> >> >> >> >> __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,
    >> >> >> >> >> >> prot, pgd_pgtable_alloc, 0);
    >> >> >> >> >> >>
    >> >> >> >> >> >> + update_mapping_prot(__pa_symbol(tramp_pg_dir),
    >> >> >> >> >> >> + (unsigned long)tramp_pg_dir,
    >> >> >> >> >> >> + PGD_SIZE, PAGE_KERNEL_RO);
    >> >> >> >> >> >
    >> >> >> >> >> > Hmm, I like the idea but is there a risk that the page table has been mapped
    >> >> >> >> >> > as part of a block entry, which we can't safely split at this point (i.e.
    >> >> >> >> >> > we'll run into one of the BUG_ONs in the mapping code)?
    >> >> >> >> >> >
    >> >> >> >> >>
    >> >> >> >> >> We'd need to create a separate segment for it initially so the mapping
    >> >> >> >> >> is already at the right granularity.
    >> >> >> >> >
    >> >> >> >> > Why do you think that's the case? I can't see anything that guarantees this
    >> >> >> >> > for the page table itself.
    >> >> >> >> >
    >> >> >> >>
    >> >> >> >> We'd need to pass NO_BLOCK_MAPPINGS to map_kernel_segment(),
    >> >> >> >> obviously, but that shouldn't hurt since that segment is relatively
    >> >> >> >> tiny anyway.
    >> >> >> >
    >> >> >> > Ah right, with NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS, I agree that we're good.
    >> >> >> > Ideally, we'd move {idmap,swapper,tramp}_pg_dir into .rodata...
    >> >> >> >
    >> >> >>
    >> >> >> idmap and tramp yes, but swapper needs to be modifiable at runtime, no?
    >> >> >
    >> >> > Right, but couldn't we swizzle the permissions in e.g. set_pmd? We could
    >> >> > even predicate that on a sanity check of the prot.
    >> >> >
    >> >>
    >> >> Swizzle the permissions of the entire .rodata segment? That sounds
    >> >> doable, but there is a whole class of data that belongs in this
    >> >> category, and I think PaX/grsecurity had an API for that (but I don't
    >> >> think anyone is upstreaming that yet). So let's not reinvent that
    >> >> wheel for swapper_pg_dir only.
    >> >
    >> > I wasn't thinking of the whole .rodata segment -- just the page containing
    >> > the entry being modified, but ok.
    >>
    >> That means we will need to map .rodata down to pages as well, or at
    >> least avoid contiguous mappings.
    >
    > Doesn't it already avoid those?
    >

    You are right, it does.

    \
     
     \ /
      Last update: 2018-06-19 18:01    [W:3.124 / U:1.656 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site