[v5,0/9] Support strict kernel memory permissions for security

Message ID	cover.1586332296.git.zong.li@sifive.com (mailing list archive)
Headers	show Return-Path: <SRS0=HX4e=5Y=lists.infradead.org=linux-riscv-bounces+patchwork-linux-riscv=patchwork.kernel.org@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A71AE20771 From: Zong Li <zong.li@sifive.com> To: palmer@dabbelt.com, paul.walmsley@sifive.com, aou@eecs.berkeley.edu, mhiramat@kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v5 0/9] Support strict kernel memory permissions for security Date: Wed, 8 Apr 2020 15:56:55 +0800 Message-Id: <cover.1586332296.git.zong.li@sifive.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit summary: Content analysis details: (-0.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2607:f8b0:4864:20:0:0:0:644 listed in] [list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Precedence: list Cc: Zong Li <zong.li@sifive.com> Sender: "linux-riscv" <linux-riscv-bounces@lists.infradead.org> Errors-To: linux-riscv-bounces+patchwork-linux-riscv=patchwork.kernel.org@lists.infradead.org
Series	Support strict kernel memory permissions for security \| expand [v5,0/9] Support strict kernel memory permissions for security [v5,1/9] riscv: add macro to get instruction length [v5,2/9] riscv: introduce interfaces to patch kernel code [v5,3/9] riscv: patch code by fixmap mapping [v5,4/9] riscv: add ARCH_HAS_SET_MEMORY support [v5,5/9] riscv: add ARCH_HAS_SET_DIRECT_MAP support [v5,6/9] riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support [v5,7/9] riscv: move exception table immediately after RO_DATA [v5,8/9] riscv: add alignment for text, rodata and data sections [v5,9/9] riscv: add STRICT_KERNEL_RWX support

Message ID

cover.1586332296.git.zong.li@sifive.com (mailing list archive)

Headers

DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A71AE20771
From: Zong Li <zong.li@sifive.com>
To: palmer@dabbelt.com, paul.walmsley@sifive.com, aou@eecs.berkeley.edu,
 mhiramat@kernel.org, linux-riscv@lists.infradead.org,
 linux-kernel@vger.kernel.org
Subject: [PATCH v5 0/9] Support strict kernel memory permissions for security
Date: Wed,  8 Apr 2020 15:56:55 +0800
Message-Id: <cover.1586332296.git.zong.li@sifive.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: list
Cc: Zong Li <zong.li@sifive.com>
Sender: "linux-riscv" <linux-riscv-bounces@lists.infradead.org>
Errors-To: 
 linux-riscv-bounces+patchwork-linux-riscv=patchwork.kernel.org@lists.infradead.org

Series

Support strict kernel memory permissions for security | expand

Message

Zong Li April 8, 2020, 7:56 a.m. UTC

The main purpose of this patch series is changing the kernel mapping permission
, make sure that code is not writeable, data is not executable, and read-only
data is neither writable nor executable.

This patch series also supports the relevant implementations such as
ARCH_HAS_SET_MEMORY, ARCH_HAS_SET_DIRECT_MAP,
ARCH_SUPPORTS_DEBUG_PAGEALLOC and DEBUG_WX.

Changes in v5:
 - Add lockdep_assert_held and more comments for text_mutex.

Changes in v4:
 - Use NOKPROBE_SYMBOL instead of __kprobe annotation
 - Use text_mutex instead of patch_lock
 - Remove 'riscv_' prefix of function name

Changes in v3:
 - Fix build error on nommu configuration. We already support nommu on
   RISC-V, so we should consider nommu case and test not only rv32/64,
   but also nommu.

Changes in v2:
 - Use _data to specify the start of data section with write permission.
 - Change ftrace patch text implementaion.
 - Separate DEBUG_WX patch to another patchset.

Zong Li (9):
  riscv: add macro to get instruction length
  riscv: introduce interfaces to patch kernel code
  riscv: patch code by fixmap mapping
  riscv: add ARCH_HAS_SET_MEMORY support
  riscv: add ARCH_HAS_SET_DIRECT_MAP support
  riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support
  riscv: move exception table immediately after RO_DATA
  riscv: add alignment for text, rodata and data sections
  riscv: add STRICT_KERNEL_RWX support

 arch/riscv/Kconfig                  |   6 +
 arch/riscv/include/asm/bug.h        |   8 ++
 arch/riscv/include/asm/fixmap.h     |   2 +
 arch/riscv/include/asm/patch.h      |  12 ++
 arch/riscv/include/asm/set_memory.h |  48 +++++++
 arch/riscv/kernel/Makefile          |   4 +-
 arch/riscv/kernel/ftrace.c          |  26 ++--
 arch/riscv/kernel/patch.c           | 128 +++++++++++++++++++
 arch/riscv/kernel/traps.c           |   3 +-
 arch/riscv/kernel/vmlinux.lds.S     |  11 +-
 arch/riscv/mm/Makefile              |   2 +-
 arch/riscv/mm/init.c                |  44 +++++++
 arch/riscv/mm/pageattr.c            | 187 ++++++++++++++++++++++++++++
 13 files changed, 466 insertions(+), 15 deletions(-)
 create mode 100644 arch/riscv/include/asm/patch.h
 create mode 100644 arch/riscv/include/asm/set_memory.h
 create mode 100644 arch/riscv/kernel/patch.c
 create mode 100644 arch/riscv/mm/pageattr.c

Comments

Palmer Dabbelt April 20, 2020, 6:27 p.m. UTC | #1

On Wed, 08 Apr 2020 00:56:55 PDT (-0700), zong.li@sifive.com wrote:
> The main purpose of this patch series is changing the kernel mapping permission
> , make sure that code is not writeable, data is not executable, and read-only
> data is neither writable nor executable.
>
> This patch series also supports the relevant implementations such as
> ARCH_HAS_SET_MEMORY, ARCH_HAS_SET_DIRECT_MAP,
> ARCH_SUPPORTS_DEBUG_PAGEALLOC and DEBUG_WX.
>
> Changes in v5:
>  - Add lockdep_assert_held and more comments for text_mutex.
>
> Changes in v4:
>  - Use NOKPROBE_SYMBOL instead of __kprobe annotation
>  - Use text_mutex instead of patch_lock
>  - Remove 'riscv_' prefix of function name
>
> Changes in v3:
>  - Fix build error on nommu configuration. We already support nommu on
>    RISC-V, so we should consider nommu case and test not only rv32/64,
>    but also nommu.
>
> Changes in v2:
>  - Use _data to specify the start of data section with write permission.
>  - Change ftrace patch text implementaion.
>  - Separate DEBUG_WX patch to another patchset.
>
> Zong Li (9):
>   riscv: add macro to get instruction length
>   riscv: introduce interfaces to patch kernel code
>   riscv: patch code by fixmap mapping
>   riscv: add ARCH_HAS_SET_MEMORY support
>   riscv: add ARCH_HAS_SET_DIRECT_MAP support
>   riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support
>   riscv: move exception table immediately after RO_DATA
>   riscv: add alignment for text, rodata and data sections
>   riscv: add STRICT_KERNEL_RWX support
>
>  arch/riscv/Kconfig                  |   6 +
>  arch/riscv/include/asm/bug.h        |   8 ++
>  arch/riscv/include/asm/fixmap.h     |   2 +
>  arch/riscv/include/asm/patch.h      |  12 ++
>  arch/riscv/include/asm/set_memory.h |  48 +++++++
>  arch/riscv/kernel/Makefile          |   4 +-
>  arch/riscv/kernel/ftrace.c          |  26 ++--
>  arch/riscv/kernel/patch.c           | 128 +++++++++++++++++++
>  arch/riscv/kernel/traps.c           |   3 +-
>  arch/riscv/kernel/vmlinux.lds.S     |  11 +-
>  arch/riscv/mm/Makefile              |   2 +-
>  arch/riscv/mm/init.c                |  44 +++++++
>  arch/riscv/mm/pageattr.c            | 187 ++++++++++++++++++++++++++++
>  13 files changed, 466 insertions(+), 15 deletions(-)
>  create mode 100644 arch/riscv/include/asm/patch.h
>  create mode 100644 arch/riscv/include/asm/set_memory.h
>  create mode 100644 arch/riscv/kernel/patch.c
>  create mode 100644 arch/riscv/mm/pageattr.c

Looks like there are quite a few conflicts here.  Do you mind re-spinning the
patch set for me?  It's a bit early to spin off for-next right now so there
might be some more conflicts, but hopefully not too many.

Thanks!

Zong Li April 21, 2020, 5:36 a.m. UTC | #2

Palmer Dabbelt <palmer@dabbelt.com> 於 2020年4月21日 週二 上午2:27寫道：
>
> On Wed, 08 Apr 2020 00:56:55 PDT (-0700), zong.li@sifive.com wrote:
> > The main purpose of this patch series is changing the kernel mapping permission
> > , make sure that code is not writeable, data is not executable, and read-only
> > data is neither writable nor executable.
> >
> > This patch series also supports the relevant implementations such as
> > ARCH_HAS_SET_MEMORY, ARCH_HAS_SET_DIRECT_MAP,
> > ARCH_SUPPORTS_DEBUG_PAGEALLOC and DEBUG_WX.
> >
> > Changes in v5:
> >  - Add lockdep_assert_held and more comments for text_mutex.
> >
> > Changes in v4:
> >  - Use NOKPROBE_SYMBOL instead of __kprobe annotation
> >  - Use text_mutex instead of patch_lock
> >  - Remove 'riscv_' prefix of function name
> >
> > Changes in v3:
> >  - Fix build error on nommu configuration. We already support nommu on
> >    RISC-V, so we should consider nommu case and test not only rv32/64,
> >    but also nommu.
> >
> > Changes in v2:
> >  - Use _data to specify the start of data section with write permission.
> >  - Change ftrace patch text implementaion.
> >  - Separate DEBUG_WX patch to another patchset.
> >
> > Zong Li (9):
> >   riscv: add macro to get instruction length
> >   riscv: introduce interfaces to patch kernel code
> >   riscv: patch code by fixmap mapping
> >   riscv: add ARCH_HAS_SET_MEMORY support
> >   riscv: add ARCH_HAS_SET_DIRECT_MAP support
> >   riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support
> >   riscv: move exception table immediately after RO_DATA
> >   riscv: add alignment for text, rodata and data sections
> >   riscv: add STRICT_KERNEL_RWX support
> >
> >  arch/riscv/Kconfig                  |   6 +
> >  arch/riscv/include/asm/bug.h        |   8 ++
> >  arch/riscv/include/asm/fixmap.h     |   2 +
> >  arch/riscv/include/asm/patch.h      |  12 ++
> >  arch/riscv/include/asm/set_memory.h |  48 +++++++
> >  arch/riscv/kernel/Makefile          |   4 +-
> >  arch/riscv/kernel/ftrace.c          |  26 ++--
> >  arch/riscv/kernel/patch.c           | 128 +++++++++++++++++++
> >  arch/riscv/kernel/traps.c           |   3 +-
> >  arch/riscv/kernel/vmlinux.lds.S     |  11 +-
> >  arch/riscv/mm/Makefile              |   2 +-
> >  arch/riscv/mm/init.c                |  44 +++++++
> >  arch/riscv/mm/pageattr.c            | 187 ++++++++++++++++++++++++++++
> >  13 files changed, 466 insertions(+), 15 deletions(-)
> >  create mode 100644 arch/riscv/include/asm/patch.h
> >  create mode 100644 arch/riscv/include/asm/set_memory.h
> >  create mode 100644 arch/riscv/kernel/patch.c
> >  create mode 100644 arch/riscv/mm/pageattr.c
>
> Looks like there are quite a few conflicts here.  Do you mind re-spinning the
> patch set for me?  It's a bit early to spin off for-next right now so there
> might be some more conflicts, but hopefully not too many.
>

Sure, let me rebase it and send the next version. Thanks.

> Thanks!
>

Anup Patel April 21, 2020, 6:20 a.m. UTC | #3

On Tue, Apr 21, 2020 at 11:06 AM Zong Li <zongbox@gmail.com> wrote:
>
> Palmer Dabbelt <palmer@dabbelt.com> 於 2020年4月21日 週二 上午2:27寫道：
> >
> > On Wed, 08 Apr 2020 00:56:55 PDT (-0700), zong.li@sifive.com wrote:
> > > The main purpose of this patch series is changing the kernel mapping permission
> > > , make sure that code is not writeable, data is not executable, and read-only
> > > data is neither writable nor executable.
> > >
> > > This patch series also supports the relevant implementations such as
> > > ARCH_HAS_SET_MEMORY, ARCH_HAS_SET_DIRECT_MAP,
> > > ARCH_SUPPORTS_DEBUG_PAGEALLOC and DEBUG_WX.
> > >
> > > Changes in v5:
> > >  - Add lockdep_assert_held and more comments for text_mutex.
> > >
> > > Changes in v4:
> > >  - Use NOKPROBE_SYMBOL instead of __kprobe annotation
> > >  - Use text_mutex instead of patch_lock
> > >  - Remove 'riscv_' prefix of function name
> > >
> > > Changes in v3:
> > >  - Fix build error on nommu configuration. We already support nommu on
> > >    RISC-V, so we should consider nommu case and test not only rv32/64,
> > >    but also nommu.
> > >
> > > Changes in v2:
> > >  - Use _data to specify the start of data section with write permission.
> > >  - Change ftrace patch text implementaion.
> > >  - Separate DEBUG_WX patch to another patchset.
> > >
> > > Zong Li (9):
> > >   riscv: add macro to get instruction length
> > >   riscv: introduce interfaces to patch kernel code
> > >   riscv: patch code by fixmap mapping
> > >   riscv: add ARCH_HAS_SET_MEMORY support
> > >   riscv: add ARCH_HAS_SET_DIRECT_MAP support
> > >   riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support
> > >   riscv: move exception table immediately after RO_DATA
> > >   riscv: add alignment for text, rodata and data sections
> > >   riscv: add STRICT_KERNEL_RWX support
> > >
> > >  arch/riscv/Kconfig                  |   6 +
> > >  arch/riscv/include/asm/bug.h        |   8 ++
> > >  arch/riscv/include/asm/fixmap.h     |   2 +
> > >  arch/riscv/include/asm/patch.h      |  12 ++
> > >  arch/riscv/include/asm/set_memory.h |  48 +++++++
> > >  arch/riscv/kernel/Makefile          |   4 +-
> > >  arch/riscv/kernel/ftrace.c          |  26 ++--
> > >  arch/riscv/kernel/patch.c           | 128 +++++++++++++++++++
> > >  arch/riscv/kernel/traps.c           |   3 +-
> > >  arch/riscv/kernel/vmlinux.lds.S     |  11 +-
> > >  arch/riscv/mm/Makefile              |   2 +-
> > >  arch/riscv/mm/init.c                |  44 +++++++
> > >  arch/riscv/mm/pageattr.c            | 187 ++++++++++++++++++++++++++++
> > >  13 files changed, 466 insertions(+), 15 deletions(-)
> > >  create mode 100644 arch/riscv/include/asm/patch.h
> > >  create mode 100644 arch/riscv/include/asm/set_memory.h
> > >  create mode 100644 arch/riscv/kernel/patch.c
> > >  create mode 100644 arch/riscv/mm/pageattr.c
> >
> > Looks like there are quite a few conflicts here.  Do you mind re-spinning the
> > patch set for me?  It's a bit early to spin off for-next right now so there
> > might be some more conflicts, but hopefully not too many.
> >
>
> Sure, let me rebase it and send the next version. Thanks.

This series is already merged in Linux kernel and it is available
in Linux-5.7-rc2.

I don't see the point in rebasing this series or commenting on
this series.

If you have fixes then send as separate patches based on
latest Linux-5.7-rcX release.

Regards,
Anup

Zong Li April 21, 2020, 6:29 a.m. UTC | #4

On Tue, Apr 21, 2020 at 2:20 PM Anup Patel <anup@brainfault.org> wrote:
>
> On Tue, Apr 21, 2020 at 11:06 AM Zong Li <zongbox@gmail.com> wrote:
> >
> > Palmer Dabbelt <palmer@dabbelt.com> 於 2020年4月21日 週二 上午2:27寫道：
> > >
> > > On Wed, 08 Apr 2020 00:56:55 PDT (-0700), zong.li@sifive.com wrote:
> > > > The main purpose of this patch series is changing the kernel mapping permission
> > > > , make sure that code is not writeable, data is not executable, and read-only
> > > > data is neither writable nor executable.
> > > >
> > > > This patch series also supports the relevant implementations such as
> > > > ARCH_HAS_SET_MEMORY, ARCH_HAS_SET_DIRECT_MAP,
> > > > ARCH_SUPPORTS_DEBUG_PAGEALLOC and DEBUG_WX.
> > > >
> > > > Changes in v5:
> > > >  - Add lockdep_assert_held and more comments for text_mutex.
> > > >
> > > > Changes in v4:
> > > >  - Use NOKPROBE_SYMBOL instead of __kprobe annotation
> > > >  - Use text_mutex instead of patch_lock
> > > >  - Remove 'riscv_' prefix of function name
> > > >
> > > > Changes in v3:
> > > >  - Fix build error on nommu configuration. We already support nommu on
> > > >    RISC-V, so we should consider nommu case and test not only rv32/64,
> > > >    but also nommu.
> > > >
> > > > Changes in v2:
> > > >  - Use _data to specify the start of data section with write permission.
> > > >  - Change ftrace patch text implementaion.
> > > >  - Separate DEBUG_WX patch to another patchset.
> > > >
> > > > Zong Li (9):
> > > >   riscv: add macro to get instruction length
> > > >   riscv: introduce interfaces to patch kernel code
> > > >   riscv: patch code by fixmap mapping
> > > >   riscv: add ARCH_HAS_SET_MEMORY support
> > > >   riscv: add ARCH_HAS_SET_DIRECT_MAP support
> > > >   riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support
> > > >   riscv: move exception table immediately after RO_DATA
> > > >   riscv: add alignment for text, rodata and data sections
> > > >   riscv: add STRICT_KERNEL_RWX support
> > > >
> > > >  arch/riscv/Kconfig                  |   6 +
> > > >  arch/riscv/include/asm/bug.h        |   8 ++
> > > >  arch/riscv/include/asm/fixmap.h     |   2 +
> > > >  arch/riscv/include/asm/patch.h      |  12 ++
> > > >  arch/riscv/include/asm/set_memory.h |  48 +++++++
> > > >  arch/riscv/kernel/Makefile          |   4 +-
> > > >  arch/riscv/kernel/ftrace.c          |  26 ++--
> > > >  arch/riscv/kernel/patch.c           | 128 +++++++++++++++++++
> > > >  arch/riscv/kernel/traps.c           |   3 +-
> > > >  arch/riscv/kernel/vmlinux.lds.S     |  11 +-
> > > >  arch/riscv/mm/Makefile              |   2 +-
> > > >  arch/riscv/mm/init.c                |  44 +++++++
> > > >  arch/riscv/mm/pageattr.c            | 187 ++++++++++++++++++++++++++++
> > > >  13 files changed, 466 insertions(+), 15 deletions(-)
> > > >  create mode 100644 arch/riscv/include/asm/patch.h
> > > >  create mode 100644 arch/riscv/include/asm/set_memory.h
> > > >  create mode 100644 arch/riscv/kernel/patch.c
> > > >  create mode 100644 arch/riscv/mm/pageattr.c
> > >
> > > Looks like there are quite a few conflicts here.  Do you mind re-spinning the
> > > patch set for me?  It's a bit early to spin off for-next right now so there
> > > might be some more conflicts, but hopefully not too many.
> > >
> >
> > Sure, let me rebase it and send the next version. Thanks.
>
> This series is already merged in Linux kernel and it is available
> in Linux-5.7-rc2.
>
> I don't see the point in rebasing this series or commenting on
> this series.
>
> If you have fixes then send as separate patches based on
> latest Linux-5.7-rcX release.
>

Yes, I would send the separate patches for the difference from the
merged version. Thanks.

> Regards,
> Anup