Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-12-09 Thread AKASHI Takahiro
On Thu, Nov 24, 2016 at 07:56:30PM +0900, AKASHI Takahiro wrote: > Hi, > > I'm trying to give it a spin on arm64, but ... In my experiment on hikey, the kernel boot failed, catching a page fault around cache operations, (a) __clean_dcache_area_pou() on 4KB-page kernel, (b) __inval_cache_range()

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-28 Thread Juerg Haefliger
On 11/24/2016 11:56 AM, AKASHI Takahiro wrote: > Hi, > > I'm trying to give it a spin on arm64, but ... Thanks for trying this. >> +/* >> + * Update a single kernel page table entry >> + */ >> +static inline void set_kpte(struct page *page, unsigned long kaddr, >> +pgpro

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-24 Thread AKASHI Takahiro
Hi, I'm trying to give it a spin on arm64, but ... On Fri, Nov 04, 2016 at 03:45:33PM +0100, Juerg Haefliger wrote: > This patch adds support for XPFO which protects against 'ret2dir' kernel > attacks. The basic idea is to enforce exclusive ownership of page frames > by either the kernel or users

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-15 Thread Juerg Haefliger
On 11/10/2016 08:24 PM, Kees Cook wrote: > On Fri, Nov 4, 2016 at 7:45 AM, Juerg Haefliger > wrote: >> This patch adds support for XPFO which protects against 'ret2dir' kernel >> attacks. The basic idea is to enforce exclusive ownership of page frames >> by either the kernel or userspace, unless

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-15 Thread Juerg Haefliger
Sorry for the late reply, I just found your email in my cluttered inbox. On 11/10/2016 08:11 PM, Kees Cook wrote: > On Fri, Nov 4, 2016 at 7:45 AM, Juerg Haefliger > wrote: >> This patch adds support for XPFO which protects against 'ret2dir' kernel >> attacks. The basic idea is to enforce exclus

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-10 Thread Kees Cook
On Fri, Nov 4, 2016 at 7:45 AM, Juerg Haefliger wrote: > This patch adds support for XPFO which protects against 'ret2dir' kernel > attacks. The basic idea is to enforce exclusive ownership of page frames > by either the kernel or userspace, unless explicitly requested by the > kernel. Whenever a

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-10 Thread Kees Cook
On Fri, Nov 4, 2016 at 7:45 AM, Juerg Haefliger wrote: > This patch adds support for XPFO which protects against 'ret2dir' kernel > attacks. The basic idea is to enforce exclusive ownership of page frames > by either the kernel or userspace, unless explicitly requested by the > kernel. Whenever a

Re: [kernel-hardening] [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-09 Thread ZhaoJunmin Zhao(Junmin)
This patch adds support for XPFO which protects against 'ret2dir' kernel attacks. The basic idea is to enforce exclusive ownership of page frames by either the kernel or userspace, unless explicitly requested by the kernel. Whenever a page destined for userspace is allocated, it is unmapped from p

Re: [RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-04 Thread Christoph Hellwig
The libata parts here really need to be split out and the proper list and maintainer need to be Cc'ed. > diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c > index 051b6158d1b7..58af734be25d 100644 > --- a/drivers/ata/libata-sff.c > +++ b/drivers/ata/libata-sff.c > @@ -715,7 +715,7 @

[RFC PATCH v3 1/2] Add support for eXclusive Page Frame Ownership (XPFO)

2016-11-04 Thread Juerg Haefliger
This patch adds support for XPFO which protects against 'ret2dir' kernel attacks. The basic idea is to enforce exclusive ownership of page frames by either the kernel or userspace, unless explicitly requested by the kernel. Whenever a page destined for userspace is allocated, it is unmapped from ph