From patchwork Mon Feb 27 22:29:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 62156 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp2682509wrd; Mon, 27 Feb 2023 14:34:02 -0800 (PST) X-Google-Smtp-Source: AK7set+FreVDhk56cbIo8qDsZqYrWNkw8pAGxUTiLcJja2dCraN3SwnZBFFdzLC5qlgIUXyryGBm X-Received: by 2002:a17:906:58c5:b0:8f6:ad32:cd51 with SMTP id e5-20020a17090658c500b008f6ad32cd51mr463570ejs.62.1677537241856; Mon, 27 Feb 2023 14:34:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677537241; cv=none; d=google.com; s=arc-20160816; b=w132nLqjnrTeqiScZGvpi/1ArB0iQpPxfTTCKHmU3YwF3pTP6Sxso/kYh6ONS7c0kb v60K5pNemStXko3NCGQ0OAHAiFJ94V4DGvVwU8xfRBrulGCDCY1DtbGZFjdYNc/OqGyl pnsUCLWdwdPo99bfNRi5GADbZrMvJl1YVo9Ll6YqA4xim7q3DjrBIXQ3mcN9exfPkz4R 6mQOyM2+zK0ov9cMNW6e37KPddVZCSwabT8eBSytjN25798I0x7hVzx3yjmdsIvf70F+ R7lxONgLoXZXoau1CUzcqnne7jO8xGgBWX+5BnpD4s13HgliizmQARHhPrbe2yd5MfnH xrIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:in-reply-to:message-id:date:subject :cc:to:from:dkim-signature; bh=BsGO9+iSszn3nu39GKw6/CO3iDfwWfjJ8YMO59zeTxU=; b=wsyDSUbqK0kMXt2u5wNYKlnqr8rymX+tLIA1GQUbi4u9XAwVOPuuYEomDYrS2FO69q naNbC7KDjKY3Z3byYhW9PCK9QQiiAQwlkyGkX+8uNNRkeWIs2bbKHUmBmaMBj0/Gq05L izpFUusXuI4FThyEKibmHHF9vt4pMYvEtV/ZiINM4+9KbEuRjJ3I3hgWCwblMRSzpYg4 yQe5GKssCZlc0pOUyuXClYNMaaUWXrc/v958rM6M1kW7nQKKyDcNgQUng1aY3gIek4ht oz4JY4wkZC5WgByvhlbdUESfRPBLcIrYXvjm6A2Lv+/YPqoMjZ59EKUxJPmzo9scnDhx OOHQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Ke4ZilER; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q14-20020a056402040e00b004ab250bcee6si9052198edv.648.2023.02.27.14.33.37; Mon, 27 Feb 2023 14:34:01 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Ke4ZilER; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230381AbjB0WcR (ORCPT + 99 others); Mon, 27 Feb 2023 17:32:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37582 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230224AbjB0Wbp (ORCPT ); Mon, 27 Feb 2023 17:31:45 -0500 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A70D928D38; Mon, 27 Feb 2023 14:31:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1677537094; x=1709073094; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=A4W74hb/mIAsetG4DQoyU98QDtxo6WTGpJJK3DMv6sU=; b=Ke4ZilERCfs7OeQQ4tEy1DmXxKxtQo6f0vgkRPv+qXFxqmhbnJGN5Kdr kLnMEDzIMivyX2OGIsAEFJJ4ZA2KulBdCU1I8jE1xWaKL+tWeZovav6Hi qrk5ZP1Rb0zJTkgRyA796e5jLGXLC/x566d8B2w1tMhCOhw8DeOcyWqo4 j6Wb7e5Ur004wpO64UNKYNCtk5YB9UI0Duzr6gjIw9QMQAi5Yz4x4sfo4 XsRcVuRwb8EwCoXedwew4MYQgBS45sMpAl6Bp9bGNjh50fo81p8KGRET9 P6phnbJkU/RIBUJt10ZPi/R5zo+vgyxwmYVYexqSOn7PTHSd7PrLJv0/p A==; X-IronPort-AV: E=McAfee;i="6500,9779,10634"; a="313657200" X-IronPort-AV: E=Sophos;i="5.98,220,1673942400"; d="scan'208";a="313657200" Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Feb 2023 14:31:14 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10634"; a="848024424" X-IronPort-AV: E=Sophos;i="5.98,220,1673942400"; d="scan'208";a="848024424" Received: from leonqu-mobl1.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.209.72.19]) by orsmga005-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Feb 2023 14:31:13 -0800 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu , Christoph Hellwig Subject: [PATCH v7 09/41] x86/mm: Remove _PAGE_DIRTY from kernel RO pages Date: Mon, 27 Feb 2023 14:29:25 -0800 Message-Id: <20230227222957.24501-10-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230227222957.24501-1-rick.p.edgecombe@intel.com> References: <20230227222957.24501-1-rick.p.edgecombe@intel.com> X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759025290747236871?= X-GMAIL-MSGID: =?utf-8?q?1759025290747236871?= From: Yu-cheng Yu New processors that support Shadow Stack regard Write=0,Dirty=1 PTEs as shadow stack pages. In normal cases, it can be helpful to create Write=1 PTEs as also Dirty=1 if HW dirty tracking is not needed, because if the Dirty bit is not already set the CPU has to set Dirty=1 when the memory gets written to. This creates additional work for the CPU. So traditional wisdom was to simply set the Dirty bit whenever you didn't care about it. However, it was never really very helpful for read-only kernel memory. When CR4.CET=1 and IA32_S_CET.SH_STK_EN=1, some instructions can write to such supervisor memory. The kernel does not set IA32_S_CET.SH_STK_EN, so avoiding kernel Write=0,Dirty=1 memory is not strictly needed for any functional reason. But having Write=0,Dirty=1 kernel memory doesn't have any functional benefit either, so to reduce ambiguity between shadow stack and regular Write=0 pages, remove Dirty=1 from any kernel Write=0 PTEs. Tested-by: Pengfei Xu Tested-by: John Allen Tested-by: Kees Cook Acked-by: Mike Rapoport (IBM) Reviewed-by: Kees Cook Signed-off-by: Yu-cheng Yu Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Cc: "H. Peter Anvin" Cc: Kees Cook Cc: Thomas Gleixner Cc: Dave Hansen Cc: Christoph Hellwig Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Borislav Petkov Cc: Peter Zijlstra --- v6: - Also remove dirty from newly added set_memory_rox() v5: - Spelling and grammar in commit log (Boris) v3: - Update commit log (Andrew Cooper, Peterz) v2: - Normalize PTE bit descriptions between patches --- arch/x86/include/asm/pgtable_types.h | 6 +++--- arch/x86/mm/pat/set_memory.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h index 447d4bee25c4..0646ad00178b 100644 --- a/arch/x86/include/asm/pgtable_types.h +++ b/arch/x86/include/asm/pgtable_types.h @@ -192,10 +192,10 @@ enum page_cache_mode { #define _KERNPG_TABLE (__PP|__RW| 0|___A| 0|___D| 0| 0| _ENC) #define _PAGE_TABLE_NOENC (__PP|__RW|_USR|___A| 0|___D| 0| 0) #define _PAGE_TABLE (__PP|__RW|_USR|___A| 0|___D| 0| 0| _ENC) -#define __PAGE_KERNEL_RO (__PP| 0| 0|___A|__NX|___D| 0|___G) -#define __PAGE_KERNEL_ROX (__PP| 0| 0|___A| 0|___D| 0|___G) +#define __PAGE_KERNEL_RO (__PP| 0| 0|___A|__NX| 0| 0|___G) +#define __PAGE_KERNEL_ROX (__PP| 0| 0|___A| 0| 0| 0|___G) #define __PAGE_KERNEL_NOCACHE (__PP|__RW| 0|___A|__NX|___D| 0|___G| __NC) -#define __PAGE_KERNEL_VVAR (__PP| 0|_USR|___A|__NX|___D| 0|___G) +#define __PAGE_KERNEL_VVAR (__PP| 0|_USR|___A|__NX| 0| 0|___G) #define __PAGE_KERNEL_LARGE (__PP|__RW| 0|___A|__NX|___D|_PSE|___G) #define __PAGE_KERNEL_LARGE_EXEC (__PP|__RW| 0|___A| 0|___D|_PSE|___G) #define __PAGE_KERNEL_WP (__PP|__RW| 0|___A|__NX|___D| 0|___G| __WP) diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c index 356758b7d4b4..1b5c0dc9f32b 100644 --- a/arch/x86/mm/pat/set_memory.c +++ b/arch/x86/mm/pat/set_memory.c @@ -2073,12 +2073,12 @@ int set_memory_nx(unsigned long addr, int numpages) int set_memory_ro(unsigned long addr, int numpages) { - return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW), 0); + return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW | _PAGE_DIRTY), 0); } int set_memory_rox(unsigned long addr, int numpages) { - pgprot_t clr = __pgprot(_PAGE_RW); + pgprot_t clr = __pgprot(_PAGE_RW | _PAGE_DIRTY); if (__supported_pte_mask & _PAGE_NX) clr.pgprot |= _PAGE_NX;