From: YaoJun <yaojun8558363@gmail.com> To: kernel-hardening@lists.openwall.com Cc: catalin.marinas@arm.com, will.deacon@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, mark.rutland@arm.com Subject: [PATCH 0/4] arm64/mm: migrate swapper_pg_dir Date: Wed, 30 May 2018 17:12:55 +0800 [thread overview] Message-ID: <20180530091259.9386-1-yaojun8558363@gmail.com> (raw) Currently, The offset between swapper_pg_dir and _text is fixed. When attackers know the address of _text(no KASLR or breaking KASLR), they can caculate the address of swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can be applied. The principle of KSMA is to insert a carefully constructed PGD entry into the translation table. The type of this entry is block, which maps the kernel text and its access permissions bits are 01. The user process can then modify kernel text directly through this mapping. To protect against KSMA, these patches migrate swapper_pg_dir to new place, which is dynamically allocated. Since it is allocated during the kernel boot process and the address is relatively fixed, further randomization may be required. YaoJun (4): arm64/mm: Introduce __pa_swapper_pg_dir to save physical address of swapper_pg_dir. And pass it as an argument to __enable_mmu(). arm64/mm: Introduce new_swapper_pg_dir to save virtual address of new swapper_pg_dir. arm64/mm: Make tramp_pg_dir and swapper_pg_dir adjacent. arm64/mm: Migrate swapper_pg_dir and tramp_pg_dir. arch/arm64/include/asm/mmu_context.h | 6 +-- arch/arm64/include/asm/pgtable.h | 2 + arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/entry.S | 4 +- arch/arm64/kernel/head.S | 10 ++-- arch/arm64/kernel/hibernate.c | 2 +- arch/arm64/kernel/sleep.S | 2 + arch/arm64/kernel/vmlinux.lds.S | 10 ++-- arch/arm64/mm/kasan_init.c | 6 +-- arch/arm64/mm/mmu.c | 72 ++++++++++++++++++++-------- 10 files changed, 75 insertions(+), 41 deletions(-) -- 2.17.0
WARNING: multiple messages have this Message-ID (diff)
From: yaojun8558363@gmail.com (YaoJun) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH 0/4] arm64/mm: migrate swapper_pg_dir Date: Wed, 30 May 2018 17:12:55 +0800 [thread overview] Message-ID: <20180530091259.9386-1-yaojun8558363@gmail.com> (raw) Currently, The offset between swapper_pg_dir and _text is fixed. When attackers know the address of _text(no KASLR or breaking KASLR), they can caculate the address of swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can be applied. The principle of KSMA is to insert a carefully constructed PGD entry into the translation table. The type of this entry is block, which maps the kernel text and its access permissions bits are 01. The user process can then modify kernel text directly through this mapping. To protect against KSMA, these patches migrate swapper_pg_dir to new place, which is dynamically allocated. Since it is allocated during the kernel boot process and the address is relatively fixed, further randomization may be required. YaoJun (4): arm64/mm: Introduce __pa_swapper_pg_dir to save physical address of swapper_pg_dir. And pass it as an argument to __enable_mmu(). arm64/mm: Introduce new_swapper_pg_dir to save virtual address of new swapper_pg_dir. arm64/mm: Make tramp_pg_dir and swapper_pg_dir adjacent. arm64/mm: Migrate swapper_pg_dir and tramp_pg_dir. arch/arm64/include/asm/mmu_context.h | 6 +-- arch/arm64/include/asm/pgtable.h | 2 + arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/entry.S | 4 +- arch/arm64/kernel/head.S | 10 ++-- arch/arm64/kernel/hibernate.c | 2 +- arch/arm64/kernel/sleep.S | 2 + arch/arm64/kernel/vmlinux.lds.S | 10 ++-- arch/arm64/mm/kasan_init.c | 6 +-- arch/arm64/mm/mmu.c | 72 ++++++++++++++++++++-------- 10 files changed, 75 insertions(+), 41 deletions(-) -- 2.17.0
next reply other threads:[~2018-05-30 9:13 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-05-30 9:12 YaoJun [this message] 2018-05-30 9:12 ` [PATCH 0/4] arm64/mm: migrate swapper_pg_dir YaoJun 2018-05-30 9:12 ` [PATCH 1/4] " YaoJun 2018-05-30 9:12 ` YaoJun 2018-05-30 9:46 ` Greg KH 2018-05-30 9:46 ` Greg KH 2018-05-30 9:12 ` [PATCH 2/4] " YaoJun 2018-05-30 9:12 ` YaoJun 2018-05-30 9:12 ` [PATCH 3/4] " YaoJun 2018-05-30 9:12 ` YaoJun 2018-05-30 9:12 ` [PATCH 4/4] " YaoJun 2018-05-30 9:12 ` YaoJun 2018-06-01 8:08 [PATCH 0/4] " Jun Yao 2018-06-01 8:08 ` Jun Yao 2018-06-01 9:42 ` Robin Murphy 2018-06-01 9:42 ` Robin Murphy 2018-06-04 11:45 ` Jun Yao 2018-06-04 9:13 Jun Yao
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180530091259.9386-1-yaojun8558363@gmail.com \ --to=yaojun8558363@gmail.com \ --cc=catalin.marinas@arm.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mark.rutland@arm.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.