All of lore.kernel.org
 help / color / mirror / Atom feed
From: mark.rutland@arm.com (Mark Rutland)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCHv2 00/18] arm64: mm: rework page table creation
Date: Tue, 5 Jan 2016 18:58:18 +0000	[thread overview]
Message-ID: <20160105185818.GA31781@leverpostej> (raw)
In-Reply-To: <568C0D40.4040204@redhat.com>

> >>This series points out that my attempt to allow set_memory_* to
> >>work on regular kernel memory[1] is broken right now because it breaks down
> >>the larger block sizes.
> >
> >What's the rationale for set_memory_* on kernel mappings? I see
> >"security", but I couldn't figure out a concrete use-case. Is there any
> >example of a subsystem that wants to use this?
> 
> From the description, it sounded like this was possibly new work but
> the eBPF interpreter currently supports setting a page read only via
> set_memory_ro (see 60a3b2253c413cf601783b070507d7dd6620c954
> "net: bpf: make eBPF interpreter images read-only") so it's not
> unheard of.

Oh. For some reason I thought that used the vmalloc area, but evidently
I was mistaken.

That is unfortunate, it would be good to protect the JITed code.

> >For statically-allocated data, an alternative approach would be for such
> >memory to be mapped with minimal permissions from the outset (e.g. being
> >placed in .rodata), and when elevated permissions are required a
> >(temporary) memremap'd alias could be used, like what patch_map does to
> >modify ROX kernel/module text.
> >
> >For dynamically-allocated data, we could create (minimal permission)
> >mappings in the vmalloc region and pass those around. The linear map
> >alias would still be writeable, but as the offset between the two isn't
> >linear (and the owner of that allocation doesn't have to know/care about
> >the linear map address), it would be much harder to find the linear map
> >address to attack. An alias with elevated permissions could be used as
> >required, or if it's a one-time RW->RO switch, the mapping could me
> >modified in-place as the granularity wouldn't change.
> 
> This would work for new features but probably not for existing features
> such as the eBPF interpreter.

Sure.

For eBPF it might be possible to rework the code to support using
separate aliases, but that's probably not going to be easy and that
probably works against some performance requirement. :/

Thanks,
Mark.

  reply	other threads:[~2016-01-05 18:58 UTC|newest]

Thread overview: 40+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-04 17:56 [PATCHv2 00/18] arm64: mm: rework page table creation Mark Rutland
2016-01-04 17:56 ` [PATCHv2 01/18] asm-generic: make __set_fixmap_offset a static inline Mark Rutland
2016-01-19 11:55   ` Mark Rutland
2016-01-19 14:11     ` Arnd Bergmann
2016-01-19 14:18       ` Mark Rutland
2016-01-28 15:10   ` Will Deacon
2016-01-04 17:56 ` [PATCHv2 02/18] arm64: mm: specialise pagetable allocators Mark Rutland
2016-01-04 17:56 ` [PATCHv2 03/18] arm64: mm: place empty_zero_page in bss Mark Rutland
2016-01-04 17:56 ` [PATCHv2 04/18] arm64: unify idmap removal Mark Rutland
2016-01-04 17:56 ` [PATCHv2 05/18] arm64: unmap idmap earlier Mark Rutland
2016-01-04 17:56 ` [PATCHv2 06/18] arm64: add function to install the idmap Mark Rutland
2016-01-04 17:56 ` [PATCHv2 07/18] arm64: mm: add code to safely replace TTBR1_EL1 Mark Rutland
2016-01-05 15:22   ` Catalin Marinas
2016-01-05 15:45     ` Mark Rutland
2016-01-04 17:56 ` [PATCHv2 08/18] arm64: kasan: avoid TLB conflicts Mark Rutland
2016-01-04 17:56 ` [PATCHv2 09/18] arm64: mm: move pte_* macros Mark Rutland
2016-01-04 17:56 ` [PATCHv2 10/18] arm64: mm: add functions to walk page tables by PA Mark Rutland
2016-01-04 17:56 ` [PATCHv2 11/18] arm64: mm: avoid redundant __pa(__va(x)) Mark Rutland
2016-01-04 17:56 ` [PATCHv2 12/18] arm64: mm: add __{pud,pgd}_populate Mark Rutland
2016-01-04 17:56 ` [PATCHv2 13/18] arm64: mm: add functions to walk tables in fixmap Mark Rutland
2016-01-04 22:49   ` Laura Abbott
2016-01-05 11:08     ` Mark Rutland
2016-01-04 17:56 ` [PATCHv2 14/18] arm64: mm: use fixmap when creating page tables Mark Rutland
2016-01-04 22:38   ` Laura Abbott
2016-01-05 10:40     ` Mark Rutland
2016-01-04 17:56 ` [PATCHv2 15/18] arm64: mm: allocate pagetables anywhere Mark Rutland
2016-01-04 17:56 ` [PATCHv2 16/18] arm64: mm: allow passing a pgdir to alloc_init_* Mark Rutland
2016-01-04 17:56 ` [PATCHv2 17/18] arm64: ensure _stext and _etext are page-aligned Mark Rutland
2016-01-04 17:56 ` [PATCHv2 18/18] arm64: mm: create new fine-grained mappings at boot Mark Rutland
2016-01-05  1:08 ` [PATCHv2 00/18] arm64: mm: rework page table creation Laura Abbott
2016-01-05 11:54   ` Mark Rutland
2016-01-05 18:36     ` Laura Abbott
2016-01-05 18:58       ` Mark Rutland [this message]
2016-01-05 19:17         ` Laura Abbott
2016-01-06 11:10           ` Mark Rutland
2016-01-08 19:15     ` Mark Rutland
2016-01-06 10:24 ` Catalin Marinas
2016-01-06 11:36   ` Mark Rutland
2016-01-06 14:23     ` Ard Biesheuvel
2016-01-18 14:47 ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160105185818.GA31781@leverpostej \
    --to=mark.rutland@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.