Re: [kernel-hardening] [PATCH v5 07/10] arm64/mm: Don't flush the data cache if the page is unmapped by XPFO

[Tycho Andersen]

Hi Mark,

First, thanks for taking a look!

On Sat, Aug 12, 2017 at 12:57:37PM +0100, Mark Rutland wrote:
> On Wed, Aug 09, 2017 at 02:07:52PM -0600, Tycho Andersen wrote:
> > From: Juerg Haefliger <juerg.haefliger@xxxxxxx>
> > 
> > If the page is unmapped by XPFO, a data cache flush results in a fatal
> > page fault. So don't flush in that case.
> 
> Do you have an example callchain where that happens? We might need to shuffle
> things around to cater for that case.

Here's one from the other branch (i.e. xpfo_page_is_unmapped() is true):

[   15.487293] CPU: 2 PID: 1633 Comm: plymouth Not tainted 4.13.0-rc4-c2+ #242
[   15.487295] Hardware name: Hardkernel ODROID-C2 (DT)
[   15.487297] Call trace:
[   15.487313] [<ffff0000080884f0>] dump_backtrace+0x0/0x248
[   15.487317] [<ffff00000808878c>] show_stack+0x14/0x20
[   15.487324] [<ffff000008b3e1b8>] dump_stack+0x98/0xb8
[   15.487329] [<ffff000008098bb4>] sync_icache_aliases+0x84/0x98
[   15.487332] [<ffff000008098c74>] __sync_icache_dcache+0x64/0x88
[   15.487337] [<ffff0000081d4814>] alloc_set_pte+0x4ec/0x6b8
[   15.487342] [<ffff00000819d920>] filemap_map_pages+0x350/0x360
[   15.487344] [<ffff0000081d4ccc>] do_fault+0x28c/0x568
[   15.487347] [<ffff0000081d67a0>] __handle_mm_fault+0x410/0xd08
[   15.487350] [<ffff0000081d7164>] handle_mm_fault+0xcc/0x1a8
[   15.487352] [<ffff000008098580>] do_page_fault+0x270/0x380
[   15.487355] [<ffff00000808128c>] do_mem_abort+0x3c/0x98
[   15.487358] Exception stack(0xffff800061dabe20 to 0xffff800061dabf50)
[   15.487362] be20: 0000000000000000 0000800062e19000 ffffffffffffffff 0000ffff8f64ddc8
[   15.487365] be40: ffff800061dabe80 ffff000008238810 ffff800061d80330 0000000000000018
[   15.487368] be60: ffffffffffffffff 0000ffff8f5ba958 ffff800061d803d0 ffff800067132e18
[   15.487370] be80: 0000000000000000 ffff800061d80d08 0000000000000000 0000000000000019
[   15.487373] bea0: 000000002bd3d0f0 0000000000000000 0000000000000019 ffff800067132e00
[   15.487376] bec0: 0000000000000000 0000ffff8f657220 0000000000000000 0000000000000000
[   15.487379] bee0: 8080808000000000 0000000000000000 0000000080808080 fefefeff6f6b6467
[   15.487381] bf00: 7f7f7f7f7f7f7f7f 000000002bd3fb40 0101010101010101 0000000000000020
[   15.487384] bf20: 00000000004072b0 00000000004072e0 0000000000000000 0000ffff8f6b2000
[   15.487386] bf40: 0000ffff8f66b190 0000ffff8f576380
[   15.487389] [<ffff000008082b74>] el0_da+0x20/0x24

> > @@ -30,7 +31,9 @@ void sync_icache_aliases(void *kaddr, unsigned long len)
> >  	unsigned long addr = (unsigned long)kaddr;
> >  
> >  	if (icache_is_aliasing()) {
> > -		__clean_dcache_area_pou(kaddr, len);
> > +		/* Don't flush if the page is unmapped by XPFO */
> > +		if (!xpfo_page_is_unmapped(virt_to_page(kaddr)))
> > +			__clean_dcache_area_pou(kaddr, len);
> >  		__flush_icache_all();
> >  	} else {
> >  		flush_icache_range(addr, addr + len);
> 
> I don't think this patch is correct. If data cache maintenance is required in
> the absence of XPFO, I don't see why it wouldn't be required in the presence of
> XPFO.

Ok. I suppose we could do re-map like we do for dma; or is there some
re-arrangement of things you can see that would help?

> I'm not immediately sure why the non-aliasing case misses data cache
> maintenance. I couldn't spot where that happens otherwise.
> 
> On a more general note, in future it would be good to Cc the arm64 maintainers
> and the linux-arm-kernel mailing list for patches affecting arm64.

Yes, I thought about doing that for the series, but since it has x86 patches
too, I didn't want to spam everyone :). I'll just add x86/arm lists to CC in
the patches in the future. If there's some better way, let me know.

Tycho