From: Andrew Cooper <andrew.cooper3@citrix.com>
To: Xen-devel <xen-devel@lists.xenproject.org>
Cc: "Andrew Cooper" <andrew.cooper3@citrix.com>,
"Jan Beulich" <JBeulich@suse.com>,
"Roger Pau Monné" <roger.pau@citrix.com>, "Wei Liu" <wl@xen.org>
Subject: [PATCH] x86/boot: Restrict directmap permissions for .text/.rodata
Date: Mon, 6 Dec 2021 13:08:55 +0000 [thread overview]
Message-ID: <20211206130855.15372-1-andrew.cooper3@citrix.com> (raw)
While we've been diligent to ensure that the main text/data/rodata mappings
have suitable restrictions, their aliases via the directmap were left fully
RW. Worse, we even had pieces of code making use of this as a feature.
Restrict the permissions, as we have no legitimate need for writeability of
these areas via the directmap alias.
Note that the pagetables and cpu0_stack do get written through their directmap
alias, so we can't just read-only the whole image.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Wei Liu <wl@xen.org>
Ever so slightly RFC, as it has only had light testing.
Notes:
* The stubs are still have RX via one alias, RW via another, and these need
to stay. Hardening options include splitting the stubs so the SYSCALL ones
can be read-only after setup, and/or expanding the stub size to 4k per CPU
so we really can keep the writeable alias as not present when the stub
isn't in active use.
* Future CPUs with Protection Key Supervisor (Sapphire Rapids and later)
would be able to inhibit writeability outside of a permitted region, and
because the protection key is per logical thread, we woulnd't need to
expand the stubs to 4k per CPU.
* At the time of writing, PV Shim still makes use of .rodata's read/write
alias in the directmap to patch the hypercall table, but that runs earlier
on boot. Also, there are patches out to address this.
* For backporting, this patch depends on c/s e7f147bf4ac7 ("x86/crash: Drop
manual hooking of exception_table[]"), and nothing would break at compile
time if the dependency was missing.
---
xen/arch/x86/setup.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index f40a9fe5d351..c8641c227d9a 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -1566,6 +1566,14 @@ void __init noreturn __start_xen(unsigned long mbi_p)
destroy_xen_mappings((unsigned long)&__2M_rwdata_end,
ROUNDUP((unsigned long)&__2M_rwdata_end, MB(2)));
+ /*
+ * Mark all of .text and .rodata as RO in the directmap - we don't want
+ * these sections writeable via any alias.
+ */
+ modify_xen_mappings((unsigned long)__va(__pa(_start)),
+ (unsigned long)__va(__pa(__2M_rodata_end)),
+ PAGE_HYPERVISOR_RO);
+
nr_pages = 0;
for ( i = 0; i < e820.nr_map; i++ )
if ( e820.map[i].type == E820_RAM )
--
2.11.0
next reply other threads:[~2021-12-06 13:09 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-06 13:08 Andrew Cooper [this message]
2021-12-06 13:58 ` [PATCH] x86/boot: Restrict directmap permissions for .text/.rodata Jan Beulich
2021-12-06 15:11 ` Andrew Cooper
2021-12-06 15:21 ` Jan Beulich
2023-03-24 14:40 ` Andrew Cooper
2023-03-24 22:08 Andrew Cooper
2023-03-27 15:43 ` Jan Beulich
2023-03-28 10:27 ` Andrew Cooper
2023-03-28 12:03 ` Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211206130855.15372-1-andrew.cooper3@citrix.com \
--to=andrew.cooper3@citrix.com \
--cc=JBeulich@suse.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.