From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAF25C48260 for ; Tue, 13 Feb 2024 17:48:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 61CC26B0083; Tue, 13 Feb 2024 12:48:39 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 5CC926B0087; Tue, 13 Feb 2024 12:48:39 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4BB516B0088; Tue, 13 Feb 2024 12:48:39 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 39E8B6B0083 for ; Tue, 13 Feb 2024 12:48:39 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id EA2FD120A6F for ; Tue, 13 Feb 2024 17:48:38 +0000 (UTC) X-FDA: 81787515516.05.A24C746 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by imf11.hostedemail.com (Postfix) with ESMTP id 3A5BC40012 for ; Tue, 13 Feb 2024 17:48:36 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=none; spf=pass (imf11.hostedemail.com: domain of mark.rutland@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=mark.rutland@arm.com; dmarc=pass (policy=none) header.from=arm.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1707846517; a=rsa-sha256; cv=none; b=oUb39iGzTftSHcemihm+AUAWwFusJpvnaqn8VPMO3cp68cd96l4VFrsjtNb8r7AAJjKDHo M4d/gQkw5puuCPbVZQL2ZXWT65Gouo1RIITqDG/Eirw+K8qVL9ID10lWUHYVPqFU+0nS1I qk7VjrtO0Qh2QRP3U7S2t/EwjscYrRE= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=none; spf=pass (imf11.hostedemail.com: domain of mark.rutland@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=mark.rutland@arm.com; dmarc=pass (policy=none) header.from=arm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1707846517; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=A3LC1AqB2nJ8kTAfn2mxXVvZgOpfUl1S0Nlvuh0HZGc=; b=Q2Y/aHk/OVuxwIC1EnINfbc7BrMaB+meNxGSVXldyOhCb144YFkUOE+6bZttwqHFS53OrN mdMQSQ2Ewr1oAMBR1yRMg/SNs+XPhsaOfnj4FyxVQryLQrCEAAt0hxSNWwnZr0aKW/hwxZ 7GEhw/DSbFojAfsiM0RTMT2dOnuOtsA= Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 8E3311FB; Tue, 13 Feb 2024 09:49:17 -0800 (PST) Received: from FVFF77S0Q05N.cambridge.arm.com (FVFF77S0Q05N.cambridge.arm.com [10.1.36.130]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id E06323F766; Tue, 13 Feb 2024 09:48:32 -0800 (PST) Date: Tue, 13 Feb 2024 17:48:30 +0000 From: Mark Rutland To: Maxwell Bland Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, catalin.marinas@arm.com, will@kernel.org, dennis@kernel.org, tj@kernel.org, cl@linux.com, akpm@linux-foundation.org, shikemeng@huaweicloud.com, david@redhat.com, rppt@kernel.org, anshuman.khandual@arm.com, willy@infradead.org, ryan.roberts@arm.com, rick.p.edgecombe@intel.com, pcc@google.com, rmk+kernel@armlinux.org.uk, tglx@linutronix.de, gshan@redhat.com, gregkh@linuxfoundation.org, Jonathan.Cameron@huawei.com, james.morse@arm.com, awheeler@motorola.com Subject: Re: [PATCH] arm64: allow post-init vmalloc PXNTable Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 3A5BC40012 X-Stat-Signature: qgenrum5au73sp4bs9aztwx6fgts1b1w X-HE-Tag: 1707846516-930783 X-HE-Meta: U2FsdGVkX1+0amNx0jT8cMlw3/V7d17o2xSAFx8nH4AYtmTR4NtmVXvVbFCnB1Vl19pcLVjsTTrNLSFpACOmIILjvngUQL3cdWqUHwUa6IBnLf+eYmQNmZB5OViW55ou4khuxq6z7cMdtoyOlSLkh6S3IRK/eh0vBXL6g5nMRVrY2U9liINYr7JtcykWlQ2zhrAvQYQ4HGtMglBbBmQBOs43cDG5Lvy5k3UcTwsBCs+dnBcHoIOl7aUqV8NuKqUhczaNKaWxd4e6uFxV0sPnu8EmOWcI+qErw5IDNs87uMmSe8Gb/Vpo3hwzs4EzzLDDBszbrrhZAme2fR+p0GjTDtFIeA95gGTq8Em8Ct61pOcYcvdtFjbNmsI7iJrGcAAtk/jy0KREFxX46o6GmPNPcvwuFcsBrLYXhtG3UDMz3fk75BpQEGB6N/AqJTGfnWFhJxnHPQvlCza7Fs95M3LDACed/slEjHgUSRhofN24a8O7QTHZ7FbAkEY5MesSXibTPnjZ/0seohI6QtCF/CxhYxw1xgQkxdiQzLqhOsuDtIx0tsQhoJX5CNrBVbg3hO/kV0gSFJ7ooMZWNI/m6hNYNQutFliWk+xyJr3F7mAMtwtBIcDfny8wO6X3e3My58yK4aWQrU1UTHd4Ghu3XxS6I26I5nms+oAr+GnucNpkNwiELdj8nf6UCiuC0l4BSP74NYUm5UiL/rEvQRs9goCBEAq08cjO1a+ME0o28Ic+n4e5VvTlrh33YxaquzZjrwKdBQ6X7aUCH34xmFUyTqDxg5XPRPLDE62GF+j0LX8frMCSyJXu4ynZPT1H5Qs7CJ6X/QK17YMPpr1nJu7ZEPtCZaXCkMxFYn1SISphGmSGOKWjrZLIhE/LssZwRGGEi7Pw3ud14CcxJcC5ecH8sC63HkzonARGngaTy+F7o6F41LIt9qTqHVXvgpgTb/Sx103ECQfBtp4IvBZn69cl8cj 4An9ObaC FWbfaFna5bG6oAkIAXdf44ujQOrQM87u0lCTcGqWIlW3FOTCm2LbE6lcwbSbTCE4D7O1XkHLOf81NcpZF+M7KO3CMR69ATsdDqEk88nA1wqy737Xjo6QAVURmBfjQIwqu+H9u42IJY8z7F6JTbiXEl1d0BJChGxIOCcHEjPoJQsKqpQmuWaBxE5W43gWNblb1U8xV5Yn48Bv0PW/nMr4NLAGkzNd+3hikLl73ZRCZi10u6HhXN/8yvEv1ROzcMCp/mlXd2BwjMwRa8Wz3yPeqnJoZa2F5lVIaKgo+tuzKh0ujjgcxMZrIlMHf3tuomvXtjf2vR6mzuyAAZyXjR9+lCMBvkO/u8s1qkcevaGHEyTjfJYOm7FMFH4CrIITtOirc31TV X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Feb 13, 2024 at 10:05:45AM -0600, Maxwell Bland wrote: > Apologies if this is a duplicate mail, it will be the last one. Moto's SMTP > server sucks!! > > Ensures that PXNTable can be set on all table descriptors allocated > through vmalloc. Normally, PXNTable is set only during initial memory > mapping and does not apply thereafter, making it possible for attackers > to target post-init allocated writable PTEs as a staging region for > injection of their code into the kernel. Presently it is not possible to > efficiently prevent these attacks as VMALLOC_END overlaps with _text, > e.g.: > > VMALLOC_START ffff800080000000 VMALLOC_END fffffbfff0000000 > _text ffffb6c0c1400000 _end ffffb6c0c3e40000 > > Setting VMALLOC_END to _text in init would resolve this issue with the > caveat of a sizeable reduction in the size of available vmalloc memory > due to requirements on aslr randomness. However, there are circumstances > where this trade-off is necessary: in particular, hypervisor-level > security monitors where 1) the microarchitecture contains race > conditions on PTE level updates or 2) a per-PTE update verifier comes at > a significant hit to performance. Which "hypervisor-level security monitors" are you referring to? We don't support any of those upstream AFAIK. How much VA space are you potentially throwing away? How does this work with other allocations of executable memory? e.g. modules, BPF? I'm not keen on this as-is. Mark. > Because the address of _text is aslr-sensitive and this patch associates > this value with VMALLOC_END, we remove the use of VMALLOC_END in a print > statement in mm/percpu.c. However, only the format string is updated in > crash_core.c, since we are dead at that point regardless. VMALLOC_END is > updated in kernel/setup.c to associate the feature closely with aslr and > region allocation code. > > Signed-off-by: Maxwell Bland > --- > arch/arm64/Kconfig | 13 +++++++++++++ > arch/arm64/include/asm/pgtable.h | 6 ++++++ > arch/arm64/include/asm/vmalloc-pxn.h | 10 ++++++++++ > arch/arm64/kernel/crash_core.c | 2 +- > arch/arm64/kernel/setup.c | 9 +++++++++ > mm/percpu.c | 4 ++-- > 6 files changed, 41 insertions(+), 3 deletions(-) > create mode 100644 arch/arm64/include/asm/vmalloc-pxn.h > > diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > index aa7c1d435139..5f1e75d70e14 100644 > --- a/arch/arm64/Kconfig > +++ b/arch/arm64/Kconfig > @@ -2165,6 +2165,19 @@ config ARM64_DEBUG_PRIORITY_MASKING > If unsure, say N > endif # ARM64_PSEUDO_NMI > > +config ARM64_VMALLOC_PXN > + bool "Ensures table descriptors pointing to kernel data are PXNTable" > + help > + Reduces the range of the kernel data vmalloc region to remove any > + overlap with kernel code, making it possible to enable the PXNTable > + bit on table descriptors allocated after the kernel's initial memory > + mapping. > + > + This increases the performance of security monitors which protect > + against malicious updates to page table entries. > + > + If unsure, say N. > + > config RELOCATABLE > bool "Build a relocatable kernel image" if EXPERT > select ARCH_HAS_RELR > diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h > index 79ce70fbb751..49f64ea77c81 100644 > --- a/arch/arm64/include/asm/pgtable.h > +++ b/arch/arm64/include/asm/pgtable.h > @@ -22,7 +22,9 @@ > * and fixed mappings > */ > #define VMALLOC_START (MODULES_END) > +#ifndef CONFIG_ARM64_VMALLOC_PXN > #define VMALLOC_END (VMEMMAP_START - SZ_256M) > +#endif > > #define vmemmap ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT)) > > @@ -35,6 +37,10 @@ > #include > #include > > +#ifdef CONFIG_ARM64_VMALLOC_PXN > +#include > +#endif > + > #ifdef CONFIG_TRANSPARENT_HUGEPAGE > #define __HAVE_ARCH_FLUSH_PMD_TLB_RANGE > > diff --git a/arch/arm64/include/asm/vmalloc-pxn.h > b/arch/arm64/include/asm/vmalloc-pxn.h > new file mode 100644 > index 000000000000..c8c4f878eb62 > --- /dev/null > +++ b/arch/arm64/include/asm/vmalloc-pxn.h > @@ -0,0 +1,10 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +#ifndef _ASM_ARM64_VMALLOC_PXN_H > +#define _ASM_ARM64_VMALLOC_PXN_H > + > +#ifdef CONFIG_ARM64_VMALLOC_PXN > +extern u64 __vmalloc_end __ro_after_init; > +#define VMALLOC_END (__vmalloc_end) > +#endif /* CONFIG_ARM64_VMALLOC_PXN */ > + > +#endif /* _ASM_ARM64_VMALLOC_PXN_H */ > diff --git a/arch/arm64/kernel/crash_core.c b/arch/arm64/kernel/crash_core.c > index 66cde752cd74..39dccae11a40 100644 > --- a/arch/arm64/kernel/crash_core.c > +++ b/arch/arm64/kernel/crash_core.c > @@ -24,7 +24,7 @@ void arch_crash_save_vmcoreinfo(void) > vmcoreinfo_append_str("NUMBER(MODULES_VADDR)=0x%lx\n", MODULES_VADDR); > vmcoreinfo_append_str("NUMBER(MODULES_END)=0x%lx\n", MODULES_END); > vmcoreinfo_append_str("NUMBER(VMALLOC_START)=0x%lx\n", VMALLOC_START); > - vmcoreinfo_append_str("NUMBER(VMALLOC_END)=0x%lx\n", VMALLOC_END); > + vmcoreinfo_append_str("NUMBER(VMALLOC_END)=0x%llx\n", VMALLOC_END); > vmcoreinfo_append_str("NUMBER(VMEMMAP_START)=0x%lx\n", VMEMMAP_START); > vmcoreinfo_append_str("NUMBER(VMEMMAP_END)=0x%lx\n", VMEMMAP_END); > vmcoreinfo_append_str("NUMBER(kimage_voffset)=0x%llx\n", > diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c > index 42c690bb2d60..b7ccee672743 100644 > --- a/arch/arm64/kernel/setup.c > +++ b/arch/arm64/kernel/setup.c > @@ -54,6 +54,11 @@ > #include > #include > > +#ifdef CONFIG_ARM64_VMALLOC_PXN > +u64 __vmalloc_end __ro_after_init = VMEMMAP_START - SZ_256M; > +EXPORT_SYMBOL(__vmalloc_end); > +#endif /* CONFIG_ARM64_VMALLOC_PXN */ > + > static int num_standard_resources; > static struct resource *standard_resources; > > @@ -298,6 +303,10 @@ void __init __no_sanitize_address setup_arch(char > **cmdline_p) > > kaslr_init(); > > +#ifdef CONFIG_ARM64_VMALLOC_PXN > + __vmalloc_end = ALIGN_DOWN((u64) _text, PMD_SIZE); > +#endif > + > /* > * If know now we are going to need KPTI then use non-global > * mappings from the start, avoiding the cost of rewriting > diff --git a/mm/percpu.c b/mm/percpu.c > index 4e11fc1e6def..a902500ebfa0 100644 > --- a/mm/percpu.c > +++ b/mm/percpu.c > @@ -3128,8 +3128,8 @@ int __init pcpu_embed_first_chunk(size_t > reserved_size, size_t dyn_size, > > /* warn if maximum distance is further than 75% of vmalloc space */ > if (max_distance > VMALLOC_TOTAL * 3 / 4) { > - pr_warn("max_distance=0x%lx too large for vmalloc space 0x%lx\n", > - max_distance, VMALLOC_TOTAL); > + pr_warn("max_distance=0x%lx too large for vmalloc space\n", > + max_distance); > #ifdef CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK > /* and fail if we have fallback */ > rc = -EINVAL; > > base-commit: 716f4aaa7b48a55c73d632d0657b35342b1fefd7 > -- > 2.39.0