From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-vk0-f70.google.com (mail-vk0-f70.google.com [209.85.213.70]) by kanga.kvack.org (Postfix) with ESMTP id 600286B0009 for ; Wed, 14 Feb 2018 14:29:23 -0500 (EST) Received: by mail-vk0-f70.google.com with SMTP id z207so13563695vkd.17 for ; Wed, 14 Feb 2018 11:29:23 -0800 (PST) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id w44sor1095689uaw.165.2018.02.14.11.29.22 for (Google Transport Security); Wed, 14 Feb 2018 11:29:22 -0800 (PST) MIME-Version: 1.0 In-Reply-To: <2f23544a-bd24-1e71-967b-e8d1cf5a20a3@redhat.com> References: <20180124175631.22925-1-igor.stoppa@huawei.com> <20180124175631.22925-5-igor.stoppa@huawei.com> <20180126053542.GA30189@bombadil.infradead.org> <8818bfd4-dd9f-f279-0432-69b59531bd41@huawei.com> <17e5b515-84c8-dca2-1695-cdf819834ea2@huawei.com> <414027d3-dd73-cf11-dc2a-e8c124591646@redhat.com> <2f23544a-bd24-1e71-967b-e8d1cf5a20a3@redhat.com> From: Kees Cook Date: Wed, 14 Feb 2018 11:29:21 -0800 Message-ID: Subject: Re: arm64 physmap (was Re: [kernel-hardening] [PATCH 4/6] Protectable Memory) Content-Type: text/plain; charset="UTF-8" Sender: owner-linux-mm@kvack.org List-ID: To: Laura Abbott Cc: Jann Horn , Igor Stoppa , Boris Lukashev , Christopher Lameter , Matthew Wilcox , Jerome Glisse , Michal Hocko , Christoph Hellwig , linux-security-module , Linux-MM , kernel list , Kernel Hardening , linux-arm-kernel On Wed, Feb 14, 2018 at 11:06 AM, Laura Abbott wrote: > On 02/13/2018 01:43 PM, Kees Cook wrote: >> >> On Tue, Feb 13, 2018 at 8:09 AM, Laura Abbott wrote: >>> >>> No, arm64 doesn't fixup the aliases, mostly because arm64 uses larger >>> page sizes which can't be broken down at runtime. CONFIG_PAGE_POISONING >>> does use 4K pages which could be adjusted at runtime. So yes, you are >>> right we would have physmap exposure on arm64 as well. >> >> >> Errr, so that means even modules and kernel code are writable via the >> arm64 physmap? That seems extraordinarily bad. :( >> >> -Kees >> > > (adding linux-arm-kernel and changing the subject) > > Kernel code should be fine, if it isn't that is a bug that should be > fixed. Modules yes are not fully protected. The conclusion from past I think that's a pretty serious problem: we can't have aliases with mismatched permissions; this degrades a deterministic protection (read-only) to a probabilistic protection (knowing where the alias of a target is mapped). Having an attack be "needs some info leaks" instead of "need execution control to change perms" is a much lower bar, IMO. > experience has been that we cannot safely break down larger page sizes > at runtime like x86 does. We could theoretically > add support for fixing up the alias if PAGE_POISONING is enabled but > I don't know who would actually use that in production. Performance > is very poor at that point. Why does using finer granularity on the physmap degrade performance? I assume TLB pressure, but what is heavily using that area? (I must not be understanding what physmap actually gets used for -- I thought it was just a convenience to have a 1:1 virt/phys map for some lookups?) -Kees -- Kees Cook Pixel Security -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org