From patchwork Sun Mar 19 00:15:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 71693 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:604a:0:0:0:0:0 with SMTP id j10csp532475wrt; Sat, 18 Mar 2023 18:36:02 -0700 (PDT) X-Google-Smtp-Source: AK7set+M/q0/R87cTJ34sjXBh5WMby4U6rDTG2fnU4GXDbRfUcUE3fIH7/Gc6gQRbbtW9XIRhb43 X-Received: by 2002:a17:90b:314d:b0:23f:618a:6bec with SMTP id ip13-20020a17090b314d00b0023f618a6becmr6733144pjb.49.1679189761833; Sat, 18 Mar 2023 18:36:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1679189761; cv=none; d=google.com; s=arc-20160816; b=bFy7suXsrW6oL29ZFnIWXHFhfU17SgpKDR72o3uK0zrMgl2b4MSnPDQPoHTiV00w4m yYRBfnuiv8bm+AGLTFvgv2CQbdl2IGANIvcfwo/DvH76ukUi6rsi0vSHPeCAG5tZ/0CU 1hO8v0manu30oMzlhAetJQocQ/FQjBuoAUY5swIytBUh3uF++JWA6+tJ+eiIIoW675tq YeBDB/OdCSvaM3Jcxce0BokcnG8I1TcuqioaJCEHXBQo+HvNaUm9wjKggBGKgjCMgNSX 9gxh2ljutBZbSSUeF/+2/n8DmJGu7GbqBqclj8utYOjq1JxxNFmZa6J/+3jn6C98tMrN w9yQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:in-reply-to:message-id:date:subject :cc:to:from:dkim-signature; bh=+6GvvYu5yHulXslGrW9yeLU+ZeVo4mtLKdyIMGCutuA=; b=P9SfiAjn8hdBCd6R8VkVBzIrUmtot8OOUU7dbLH2OtWtJAPL7P9CSB4RFOrhwnSzgw QTW+IVcXyQlauqaIzW8aDJsPk35OjE/R215Buk6sxtD+sErG/WDPeHjzyGN29vBUjpwQ xBpPZEQgxhCBk08beLBFK52TneiQ4+/GssRfilpfOZbOqfGZ8yiagku/U7VDHxRt7klr tBNmEhfcVC8mWJ6/1LTiPOONwP82/W+6YXSsaUWD8zGg1OjzB1M7nZmiST82OD8qpHrG EeIUbgzqdq0WVWKJg0at1UFzA2ysldZ2ENHgaYGcCqwyysELTQ1A2ZbhjtlO/PHQ4vma 1H7w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Rph1UHcd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id fs3-20020a17090af28300b0023d53736026si6386775pjb.125.2023.03.18.18.35.49; Sat, 18 Mar 2023 18:36:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Rph1UHcd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230176AbjCSAS3 (ORCPT + 99 others); Sat, 18 Mar 2023 20:18:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229971AbjCSARy (ORCPT ); Sat, 18 Mar 2023 20:17:54 -0400 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9DFB528D2B; Sat, 18 Mar 2023 17:16:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1679185013; x=1710721013; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=bCew3mJcfQObTYD8BfRHQ7rk2S0psN/tr65S9eiRcMg=; b=Rph1UHcdY1SmqGbeMuGQQcaQuEZwG9pSmrL6KHICpg5jFrjF7/imRahT Ri0pwEXfu8LGp/cY7VOKMCBoikLJ5toT4zn0aZKJyGxNWpLIsN+SW7DTi s2oW+oVi2Y8QuQuMS7D1HeNWIW43fCrEoHEIKP9SU1LRissalx7fhAn8l DgVNGopLcVzPTbzx4HJJ3s9e7x6JcRHMnDSLBUExjfWA6bWsdHzio+VrG Wy7uLw8zJF6VDQMJw3xUJLywZqKo4kw/VVwmobN+o08oJzug7FFSB/Vj/ wOZLsu9j9Wd0tqtTfHjalQWGgdALqF6cx1kaMKLGWVb1MtJf1IxvRThUw Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10653"; a="338491050" X-IronPort-AV: E=Sophos;i="5.98,272,1673942400"; d="scan'208";a="338491050" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Mar 2023 17:16:20 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10653"; a="749672841" X-IronPort-AV: E=Sophos;i="5.98,272,1673942400"; d="scan'208";a="749672841" Received: from bmahatwo-mobl1.gar.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.135.34.5]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Mar 2023 17:16:18 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com, szabolcs.nagy@arm.com Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu Subject: [PATCH v8 15/40] x86/mm: Update ptep/pmdp_set_wrprotect() for _PAGE_SAVED_DIRTY Date: Sat, 18 Mar 2023 17:15:10 -0700 Message-Id: <20230319001535.23210-16-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230319001535.23210-1-rick.p.edgecombe@intel.com> References: <20230319001535.23210-1-rick.p.edgecombe@intel.com> X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1760758083690678527?= X-GMAIL-MSGID: =?utf-8?q?1760758083690678527?= When shadow stack is in use, Write=0,Dirty=1 PTE are preserved for shadow stack. Copy-on-write PTEs then have Write=0,SavedDirty=1. When a PTE goes from Write=1,Dirty=1 to Write=0,SavedDirty=1, it could become a transient shadow stack PTE in two cases: 1. Some processors can start a write but end up seeing a Write=0 PTE by the time they get to the Dirty bit, creating a transient shadow stack PTE. However, this will not occur on processors supporting shadow stack, and a TLB flush is not necessary. 2. When _PAGE_DIRTY is replaced with _PAGE_SAVED_DIRTY non-atomically, a transient shadow stack PTE can be created as a result. Thus, prevent that with cmpxchg. In the case of pmdp_set_wrprotect(), for nopmd configs the ->pmd operated on does not exist and the logic would need to be different. Although the extra functionality will normally be optimized out when user shadow stacks are not configured, also exclude it in the preprocessor stage so that it will still compile. User shadow stack is not supported there by Linux anyway. Leave the cpu_feature_enabled() check so that the functionality also gets disabled based on runtime detection of the feature. Similarly, compile it out in ptep_set_wrprotect() due to a clang warning on i386. Like above, the code path should get optimized out on i386 since shadow stack is not supported on 32 bit kernels, but this makes the compiler happy. Dave Hansen, Jann Horn, Andy Lutomirski, and Peter Zijlstra provided many insights to the issue. Jann Horn provided the cmpxchg solution. Co-developed-by: Yu-cheng Yu Signed-off-by: Yu-cheng Yu Signed-off-by: Rick Edgecombe Reviewed-by: Kees Cook Acked-by: Mike Rapoport (IBM) Tested-by: Pengfei Xu Tested-by: John Allen Tested-by: Kees Cook --- v6: - Fix comment and log to update for _PAGE_COW being replaced with _PAGE_SAVED_DIRTY. v5: - Commit log verbiage and formatting (Boris) - Remove capitalization on shadow stack (Boris) - Fix i386 warning on recent clang v3: - Remove unnecessary #ifdef (Dave Hansen) v2: - Compile out some code due to clang build error - Clarify commit log (dhansen) - Normalize PTE bit descriptions between patches (dhansen) - Update comment with text from (dhansen) --- arch/x86/include/asm/pgtable.h | 35 ++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 7360783f2140..349fcab0405a 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -1192,6 +1192,23 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep) { +#ifdef CONFIG_X86_USER_SHADOW_STACK + /* + * Avoid accidentally creating shadow stack PTEs + * (Write=0,Dirty=1). Use cmpxchg() to prevent races with + * the hardware setting Dirty=1. + */ + if (cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) { + pte_t old_pte, new_pte; + + old_pte = READ_ONCE(*ptep); + do { + new_pte = pte_wrprotect(old_pte); + } while (!try_cmpxchg(&ptep->pte, &old_pte.pte, new_pte.pte)); + + return; + } +#endif clear_bit(_PAGE_BIT_RW, (unsigned long *)&ptep->pte); } @@ -1244,6 +1261,24 @@ static inline pud_t pudp_huge_get_and_clear(struct mm_struct *mm, static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr, pmd_t *pmdp) { +#ifdef CONFIG_X86_USER_SHADOW_STACK + /* + * Avoid accidentally creating shadow stack PTEs + * (Write=0,Dirty=1). Use cmpxchg() to prevent races with + * the hardware setting Dirty=1. + */ + if (cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) { + pmd_t old_pmd, new_pmd; + + old_pmd = READ_ONCE(*pmdp); + do { + new_pmd = pmd_wrprotect(old_pmd); + } while (!try_cmpxchg(&pmdp->pmd, &old_pmd.pmd, new_pmd.pmd)); + + return; + } +#endif + clear_bit(_PAGE_BIT_RW, (unsigned long *)pmdp); }