From patchwork Mon Feb 3 10:18:33 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kevin Brodsky X-Patchwork-Id: 13957189 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 024C3C02193 for ; Mon, 3 Feb 2025 10:20:32 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9013F28000E; Mon, 3 Feb 2025 05:20:32 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 88ACC280002; Mon, 3 Feb 2025 05:20:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7041A28000E; Mon, 3 Feb 2025 05:20:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 4F6D7280002 for ; Mon, 3 Feb 2025 05:20:32 -0500 (EST) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id B9B82142854 for ; Mon, 3 Feb 2025 10:20:18 +0000 (UTC) X-FDA: 83078238558.15.E08D300 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by imf09.hostedemail.com (Postfix) with ESMTP id 2002514000F for ; Mon, 3 Feb 2025 10:20:16 +0000 (UTC) Authentication-Results: imf09.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf09.hostedemail.com: domain of kevin.brodsky@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=kevin.brodsky@arm.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1738578017; a=rsa-sha256; cv=none; b=0U3AF5idvDz5cvnaUPZoeLUeGirDjsfGoYYmnU/cv8sJy2BxCF24qPGxGggznro9NxK8RY 6HrT1ydSCgK1MWc+8HHjq3JBibCB+oPG3rjMSGawxCi1ZOxwvJuYs+6eu+LSnCBTZCyI+U 9SCNB3ZOlPUZCtiemyqkqsTq8rpAhAU= ARC-Authentication-Results: i=1; imf09.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf09.hostedemail.com: domain of kevin.brodsky@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=kevin.brodsky@arm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1738578017; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oM5qEeuq9WxuNGRz1OckJ8gXPrP/PTm/sS7h9Gbd7jY=; b=AO2IHJBjGQf/kBuQKV6DeMpEF6XdmO3XB5RjeKxbbjtttkpP8aE8Sut9RsscLfMQ2frH20 ZPSBicyBD2mZJPhSSooKQURETW7lp0twCRE/13xXSvAfUkLKfduk0Uhw/lTpjH1+VAN59Q 1GkdAEnuQlTccDnuw6ro88Rt+hTRMaQ= Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D770F1476; Mon, 3 Feb 2025 02:20:40 -0800 (PST) Received: from e123572-lin.arm.com (e123572-lin.cambridge.arm.com [10.1.194.54]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id E587F3F63F; Mon, 3 Feb 2025 02:20:12 -0800 (PST) From: Kevin Brodsky To: linux-hardening@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Kevin Brodsky , Andrew Morton , Mark Brown , Catalin Marinas , Dave Hansen , Jann Horn , Jeff Xu , Joey Gouly , Kees Cook , Linus Walleij , Andy Lutomirski , Marc Zyngier , Peter Zijlstra , Pierre Langlois , Quentin Perret , "Mike Rapoport (IBM)" , Ryan Roberts , Thomas Gleixner , Will Deacon , Matthew Wilcox , Qi Zheng , linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, x86@kernel.org Subject: [RFC PATCH v3 09/15] mm: Introduce kpkeys_hardened_pgtables Date: Mon, 3 Feb 2025 10:18:33 +0000 Message-ID: <20250203101839.1223008-10-kevin.brodsky@arm.com> X-Mailer: git-send-email 2.47.0 In-Reply-To: <20250203101839.1223008-1-kevin.brodsky@arm.com> References: <20250203101839.1223008-1-kevin.brodsky@arm.com> MIME-Version: 1.0 X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 2002514000F X-Stat-Signature: 1aomjjeuowc7mzj7zpqhuprc34a6rw93 X-Rspam-User: X-HE-Tag: 1738578016-566040 X-HE-Meta: U2FsdGVkX18bryrNwxxtTdUppHqQ8HmIirWJouAFBQFg42npG6Ybd0oRElQABvtJjYCSJeqb9LA0+zTwn29ahrYrNCg5tKwlMKROGg/cbIL6mMVNG/+H/eTAi9CKJHuLDR1bi7bMojAfA/yKIKoq5vtmxTLJ7HWwb94JBgzOIQRJQD0Q0MMTewYLQJz+qIwlpHS9rA2ZVsxzmIt+1HKx/iCIVTDS/73jNxKtY1BrkAXxV22f0Px9qa4UErrUnXmev3ATlrHLPSGKubYK7notyqotSkiEXu0WDgp0uh9lK31OZXLPG9QyjYHoMH/sifmiZdczS0k2NHrjwgW3XkW3sA0O/4XSMO+QV3EibQGD6MK6OaMHo1I5WG+X2815NaNCA+1qgXC1Md0R0s9i816C0rXCd1p1PIn87E2I7u3cr6utTHFMTcfAvKAjz4GGjHAQCMiirbGPvE7wCK5xb+VvfjSam0iON7FesvI7HoLGy42RrK+EOfh2wjwyEWfx0MzIbjzetSynMYwZXe4xD2FwhSQA2GgHV+FRIcKfuWYEITSStqUD98JfupR77gbxzhvJY2yyFBC3c/tjNUup+xflme4170SXe3zTL+ULBbsCZaC64WckWhzOs5yh/GzhAkmNla8zYZDkdY8eVxk9zPPU4cxFiYK9Ez0qpCe7wmKXCdJKsA34fLtMWGEQ3b/dYkAJvQhcp8oXzbqTeK9o9hLAdZmUNoYPbCpSbEv9MQK97FnuYo8fGsuKGSRyMwqiYKyPxjGgoCw3Jf9RogtrsEAQgfRkgAQtunN3kBVcM5AmTxHszo7J5ZgY2p27LGCDHP7f3YXbmWjC9rkJiRqnfum2uuR648C4B4Jr2XdEc/U+MToSr+b74QIL87bgAQINCvJPSEXl5Z853xo3pZY7iAzDtMbL/Et6EKOyDQi6MsA4/B68r8nFR60EfJtIjCCx4q3wd9EqpZ+UEOOYdJ4I24b N4YxUkaA fkg1NixJkPxbNFqVY46neUM7S8wxgvE600TnoAVwx1tI40MA1qadR8einrbsLYzEYMKXpMlgNFRE+FqSy92S5xl4eLbNHdKR7Gdg164cChZiDx4/KX3BN0F5ZQWxitm9+8MFaokv4Zz6I74Y3F+SDyqEtvXdTwk2YUlXh8l6DEZB8qWREsSVA5Xq3dazBAewHeUsgfA7pQVXl5ag= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: kpkeys_hardened_pgtables is a hardening feature based on kpkeys. It aims to prevent the corruption of page tables by: 1. mapping all page table pages, both kernel and user, with a privileged pkey (KPKEYS_PKEY_PGTABLES), and 2. granting write access to that pkey only when running at a higher kpkeys level (KPKEYS_LVL_PGTABLES). The feature is exposed as CONFIG_KPKEYS_HARDENED_PGTABLES; it requires explicit architecture opt-in by selecting ARCH_HAS_KPKEYS_HARDENED_PGTABLES, since much of the page table handling is arch-specific. This patch introduces an API to modify the PTPs' pkey and switch kpkeys level using a guard object. Because this API is going to be called from low-level pgtable helpers (setters, allocators), it must be inactive on boot and explicitly switched on if and when kpkeys become available. A static key is used for that purpose; it is the responsibility of each architecture supporting kpkeys_hardened_pgtables to call kpkeys_hardened_pgtables_enable() as early as possible to switch on that static key. The initial kernel page tables are also walked to set their pkey, since they have already been allocated at that point. The definition of the kpkeys_hardened_pgtables guard class does not use the static key on the restore path to avoid mismatched set/restore pairs. Indeed, enabling the static key itself involves modifying page tables, and it is thus possible that the guard object is created when the static key appears as false, and destroyed when it appears as true. To avoid this situation, we reserve an invalid value for the pkey register and use it to disable the restore path. Signed-off-by: Kevin Brodsky --- include/asm-generic/kpkeys.h | 4 ++++ include/linux/kpkeys.h | 45 ++++++++++++++++++++++++++++++++++- mm/Kconfig | 3 +++ mm/Makefile | 1 + mm/kpkeys_hardened_pgtables.c | 44 ++++++++++++++++++++++++++++++++++ security/Kconfig.hardening | 12 ++++++++++ 6 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 mm/kpkeys_hardened_pgtables.c diff --git a/include/asm-generic/kpkeys.h b/include/asm-generic/kpkeys.h index ab819f157d6a..cec92334a9f3 100644 --- a/include/asm-generic/kpkeys.h +++ b/include/asm-generic/kpkeys.h @@ -2,6 +2,10 @@ #ifndef __ASM_GENERIC_KPKEYS_H #define __ASM_GENERIC_KPKEYS_H +#ifndef KPKEYS_PKEY_PGTABLES +#define KPKEYS_PKEY_PGTABLES 1 +#endif + #ifndef KPKEYS_PKEY_DEFAULT #define KPKEYS_PKEY_DEFAULT 0 #endif diff --git a/include/linux/kpkeys.h b/include/linux/kpkeys.h index 62f897c65658..645eaf00096c 100644 --- a/include/linux/kpkeys.h +++ b/include/linux/kpkeys.h @@ -4,11 +4,15 @@ #include #include +#include + +struct folio; #define KPKEYS_LVL_DEFAULT 0 +#define KPKEYS_LVL_PGTABLES 1 #define KPKEYS_LVL_MIN KPKEYS_LVL_DEFAULT -#define KPKEYS_LVL_MAX KPKEYS_LVL_DEFAULT +#define KPKEYS_LVL_MAX KPKEYS_LVL_PGTABLES #define __KPKEYS_GUARD(name, set_level, restore_pkey_reg, set_arg, ...) \ __DEFINE_CLASS_IS_CONDITIONAL(name, false); \ @@ -110,4 +114,43 @@ static inline bool arch_kpkeys_enabled(void) #endif /* CONFIG_ARCH_HAS_KPKEYS */ +#ifdef CONFIG_KPKEYS_HARDENED_PGTABLES + +DECLARE_STATIC_KEY_FALSE(kpkeys_hardened_pgtables_enabled); + +/* + * Use guard(kpkeys_hardened_pgtables)() to temporarily grant write access + * to page tables. + */ +KPKEYS_GUARD_COND(kpkeys_hardened_pgtables, KPKEYS_LVL_PGTABLES, + static_branch_unlikely(&kpkeys_hardened_pgtables_enabled)) + +int kpkeys_protect_pgtable_memory(struct folio *folio); +int kpkeys_unprotect_pgtable_memory(struct folio *folio); + +/* + * Enables kpkeys_hardened_pgtables and switches existing kernel page tables to + * a privileged pkey (KPKEYS_PKEY_PGTABLES). + * + * Should be called as early as possible by architecture code, after (k)pkeys + * are initialised and before any user task is spawned. + */ +void kpkeys_hardened_pgtables_enable(void); + +#else /* CONFIG_KPKEYS_HARDENED_PGTABLES */ + +KPKEYS_GUARD_NOOP(kpkeys_hardened_pgtables) + +static inline int kpkeys_protect_pgtable_memory(struct folio *folio) +{ + return 0; +} +static inline int kpkeys_unprotect_pgtable_memory(struct folio *folio) +{ + return 0; +} +static inline void kpkeys_hardened_pgtables_enable(void) {} + +#endif /* CONFIG_KPKEYS_HARDENED_PGTABLES */ + #endif /* _LINUX_KPKEYS_H */ diff --git a/mm/Kconfig b/mm/Kconfig index 71edc478f111..2a8ebe780e64 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1149,6 +1149,9 @@ config ARCH_HAS_PKEYS bool config ARCH_HAS_KPKEYS bool +# ARCH_HAS_KPKEYS must be selected when selecting this option +config ARCH_HAS_KPKEYS_HARDENED_PGTABLES + bool config ARCH_USES_PG_ARCH_2 bool diff --git a/mm/Makefile b/mm/Makefile index 850386a67b3e..130691364172 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -147,3 +147,4 @@ obj-$(CONFIG_SHRINKER_DEBUG) += shrinker_debug.o obj-$(CONFIG_EXECMEM) += execmem.o obj-$(CONFIG_TMPFS_QUOTA) += shmem_quota.o obj-$(CONFIG_PT_RECLAIM) += pt_reclaim.o +obj-$(CONFIG_KPKEYS_HARDENED_PGTABLES) += kpkeys_hardened_pgtables.o diff --git a/mm/kpkeys_hardened_pgtables.c b/mm/kpkeys_hardened_pgtables.c new file mode 100644 index 000000000000..c6eb7fb6ae56 --- /dev/null +++ b/mm/kpkeys_hardened_pgtables.c @@ -0,0 +1,44 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include +#include +#include + +DEFINE_STATIC_KEY_FALSE(kpkeys_hardened_pgtables_enabled); + +int kpkeys_protect_pgtable_memory(struct folio *folio) +{ + unsigned long addr = (unsigned long)folio_address(folio); + unsigned int order = folio_order(folio); + int ret = 0; + + if (static_branch_unlikely(&kpkeys_hardened_pgtables_enabled)) + ret = set_memory_pkey(addr, 1 << order, KPKEYS_PKEY_PGTABLES); + + WARN_ON(ret); + return ret; +} + +int kpkeys_unprotect_pgtable_memory(struct folio *folio) +{ + unsigned long addr = (unsigned long)folio_address(folio); + unsigned int order = folio_order(folio); + int ret = 0; + + if (static_branch_unlikely(&kpkeys_hardened_pgtables_enabled)) + ret = set_memory_pkey(addr, 1 << order, KPKEYS_PKEY_DEFAULT); + + WARN_ON(ret); + return ret; +} + +void __init kpkeys_hardened_pgtables_enable(void) +{ + int ret; + + if (!arch_kpkeys_enabled()) + return; + + static_branch_enable(&kpkeys_hardened_pgtables_enabled); + ret = kernel_pgtables_set_pkey(KPKEYS_PKEY_PGTABLES); + WARN_ON(ret); +} diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index b56e001e0c6a..f729488eac56 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -301,6 +301,18 @@ config BUG_ON_DATA_CORRUPTION If unsure, say N. +config KPKEYS_HARDENED_PGTABLES + bool "Harden page tables using kernel pkeys" + depends on ARCH_HAS_KPKEYS_HARDENED_PGTABLES + help + This option makes all page tables mostly read-only by + allocating them with a non-default protection key (pkey) and + only enabling write access to that pkey in routines that are + expected to write to page table entries. + + This option has no effect if the system does not support + kernel pkeys. + endmenu config CC_HAS_RANDSTRUCT