From: Ard Biesheuvel <ardb@kernel.org>
To: linux-arm-kernel@lists.infradead.org
Cc: kvmarm@lists.cs.columbia.edu, linux-hardening@vger.kernel.org,
Ard Biesheuvel <ardb@kernel.org>, Will Deacon <will@kernel.org>,
Marc Zyngier <maz@kernel.org>, Fuad Tabba <tabba@google.com>,
Quentin Perret <qperret@google.com>,
Mark Rutland <mark.rutland@arm.com>,
James Morse <james.morse@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>
Subject: [RFC PATCH 00/12] arm64: implement read-only page tables
Date: Wed, 26 Jan 2022 18:29:59 +0100 [thread overview]
Message-ID: <20220126173011.3476262-1-ardb@kernel.org> (raw)
This RFC series implements support for mapping all user and kernel page
tables read-only in the linear map, and using a special fixmap slot to
make any modifications.
The purpose is to prevent page tables from being manipulated
inadvertently, which is becoming more and more important on arm64, as
many new hardening features such as BTI and MTE are controlled via
attributes in the page tables.
This series is only half of the work that is underway to implement this
in terms of hypervisor services rather than fixmap pokes, as this will
allow the hypervisor to remove all write permissions from pages used as
page tables. This work is being done in the context of the pKVM project,
which defines a clear boundary between the hypervisor executing at EL2,
and the [untrusted] host running at EL1. In this context, managing the
host's page tables at HYP level should increase the robustness of the
entire system substantially.
This series is posted separately for discussion, as it introduces the
changes that are necessary to route all page table updates via a small
set of helpers, allowing us to choose between unprotected, fixmap or HYP
protection straight-forwardly.
The pKVM specific changes will be posted as a followup series.
Cc: Will Deacon <will@kernel.org>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Fuad Tabba <tabba@google.com>
Cc: Quentin Perret <qperret@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Ard Biesheuvel (12):
asm-generic/pgalloc: allow arch to override PMD alloc/free routines
arm64: mm: add helpers to remap page tables read-only/read-write
arm64: mm: use a fixmap slot for user page table modifications
arm64: mm: remap PGD pages r/o in the linear region after allocation
arm64: mm: remap PUD pages r/o in linear region
arm64: mm: remap PMD pages r/o in linear region
arm64: mm: remap PTE level user page tables r/o in the linear region
arm64: mm: remap kernel PTE level page tables r/o in the linear region
arm64: mm: remap kernel page tables read-only at end of init
mm: add default definition of p4d_index()
arm64: efi: use set_pte_at() not set_pte() in order to pass mm pointer
arm64: hugetlb: use set_pte_at() not set_pte() to provide mm pointer
arch/arm64/Kconfig | 11 ++
arch/arm64/include/asm/fixmap.h | 1 +
arch/arm64/include/asm/pgalloc.h | 49 ++++++++-
arch/arm64/include/asm/pgtable.h | 82 +++++++++++---
arch/arm64/include/asm/tlb.h | 6 +
arch/arm64/kernel/efi.c | 2 +-
arch/arm64/mm/Makefile | 2 +
arch/arm64/mm/fault.c | 8 +-
arch/arm64/mm/hugetlbpage.c | 4 +-
arch/arm64/mm/mmu.c | 115 +++++++++++++++++++-
arch/arm64/mm/pageattr.c | 14 +++
arch/arm64/mm/pgd.c | 25 +++--
arch/arm64/mm/ro_page_tables.c | 100 +++++++++++++++++
include/asm-generic/pgalloc.h | 13 ++-
include/linux/pgtable.h | 8 ++
15 files changed, 405 insertions(+), 35 deletions(-)
create mode 100644 arch/arm64/mm/ro_page_tables.c
base-commit: e783362eb54cd99b2cac8b3a9aeac942e6f6ac07
--
2.30.2
next reply other threads:[~2022-01-26 17:30 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-26 17:29 Ard Biesheuvel [this message]
2022-01-26 17:30 ` [RFC PATCH 01/12] asm-generic/pgalloc: allow arch to override PMD alloc/free routines Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 02/12] arm64: mm: add helpers to remap page tables read-only/read-write Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 03/12] arm64: mm: use a fixmap slot for user page table modifications Ard Biesheuvel
2022-01-28 16:08 ` Steven Price
2022-01-26 17:30 ` [RFC PATCH 04/12] arm64: mm: remap PGD pages r/o in the linear region after allocation Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 05/12] arm64: mm: remap PUD pages r/o in linear region Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 06/12] arm64: mm: remap PMD " Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 07/12] arm64: mm: remap PTE level user page tables r/o in the " Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 08/12] arm64: mm: remap kernel PTE level " Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 09/12] arm64: mm: remap kernel page tables read-only at end of init Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 10/12] mm: add default definition of p4d_index() Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 11/12] arm64: efi: use set_pte_at() not set_pte() in order to pass mm pointer Ard Biesheuvel
2022-01-26 17:30 ` [RFC PATCH 12/12] arm64: hugetlb: use set_pte_at() not set_pte() to provide " Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220126173011.3476262-1-ardb@kernel.org \
--to=ardb@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=james.morse@arm.com \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-hardening@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=qperret@google.com \
--cc=tabba@google.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).