From: Russell King - ARM Linux <linux@armlinux.org.uk>
To: Kees Cook <keescook@chromium.org>
Cc: kernel-hardening@lists.openwall.com,
Mark Rutland <mark.rutland@arm.com>,
Andy Lutomirski <luto@kernel.org>,
Hoeun Ryu <hoeun.ryu@gmail.com>, PaX Team <pageexec@freemail.hu>,
Emese Revfy <re.emese@gmail.com>,
x86@kernel.org
Subject: [kernel-hardening] Re: [RFC][PATCH 5/8] ARM: Implement __arch_rare_write_map/unmap()
Date: Wed, 1 Mar 2017 01:04:08 +0000 [thread overview]
Message-ID: <20170301010408.GH21222@n2100.armlinux.org.uk> (raw)
In-Reply-To: <1488228186-110679-6-git-send-email-keescook@chromium.org>
On Mon, Feb 27, 2017 at 12:43:03PM -0800, Kees Cook wrote:
> Based on grsecurity's ARM pax_{open,close}_kernel() implementation, this
> allows HAVE_ARCH_RARE_WRITE to work on ARM.
This has the effect that any memory mapped with DOMAIN_KERNEL will
loose it's NX status, and may end up being read into the I-cache.
We used to do exactly this to support set_fs(KERNEL_DS) but it was
deemed to be way too problematical (for speculative prefetching)
to use it on ARMv6+.
As vmalloc space ends up with a random mixture of DOMAIN_KERNEL and
DOMAIN_IO mappings (due to the order of ioremap() vs vmalloc()), this
means DOMAIN_KERNEL can cover devices... which with switching
DOMAIN_KERNEL to manager mode result in the NX being removed for
device mappings, which (iirc) is unpredictable.
--
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.
next prev parent reply other threads:[~2017-03-01 1:04 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-27 20:42 [kernel-hardening] [RFC] Introduce rare_write() infrastructure Kees Cook
2017-02-27 20:42 ` [kernel-hardening] [RFC][PATCH 1/8] " Kees Cook
2017-02-28 8:22 ` [kernel-hardening] " Hoeun Ryu
2017-02-28 15:05 ` Kees Cook
2017-03-01 10:43 ` Mark Rutland
2017-03-01 20:13 ` Kees Cook
2017-03-01 20:31 ` Kees Cook
2017-03-01 21:00 ` Andy Lutomirski
2017-03-01 23:14 ` Kees Cook
2017-03-02 11:19 ` Mark Rutland
2017-03-02 16:33 ` Andy Lutomirski
2017-03-02 19:48 ` Kees Cook
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 2/8] lkdtm: add test for " Kees Cook
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 3/8] net: switch sock_diag handlers to rare_write() Kees Cook
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 4/8] x86: Implement __arch_rare_write_map/unmap() Kees Cook
2017-02-28 19:33 ` [kernel-hardening] " Andy Lutomirski
2017-02-28 21:35 ` Kees Cook
2017-02-28 22:54 ` Andy Lutomirski
2017-02-28 23:52 ` Kees Cook
2017-03-01 11:24 ` Mark Rutland
2017-03-01 20:25 ` Kees Cook
2017-03-02 11:20 ` Mark Rutland
2017-03-03 0:59 ` Hoeun Ryu
2017-03-01 10:59 ` Mark Rutland
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 5/8] ARM: " Kees Cook
2017-03-01 1:04 ` Russell King - ARM Linux [this message]
2017-03-01 5:41 ` [kernel-hardening] " Kees Cook
2017-03-01 11:30 ` Russell King - ARM Linux
2017-03-02 0:08 ` Kees Cook
2017-03-01 11:50 ` Mark Rutland
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 6/8] list: add rare_write() list helpers Kees Cook
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 7/8] gcc-plugins: Add constify plugin Kees Cook
2017-02-27 20:43 ` [kernel-hardening] [RFC][PATCH 8/8] cgroups: force all struct cftype const Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170301010408.GH21222@n2100.armlinux.org.uk \
--to=linux@armlinux.org.uk \
--cc=hoeun.ryu@gmail.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=luto@kernel.org \
--cc=mark.rutland@arm.com \
--cc=pageexec@freemail.hu \
--cc=re.emese@gmail.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox