From patchwork Sat Feb 18 21:14:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13145654 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71C87C64EC4 for ; Sat, 18 Feb 2023 21:16:29 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C249228000B; Sat, 18 Feb 2023 16:16:14 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id BFDC928000D; Sat, 18 Feb 2023 16:16:14 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A33A328000B; Sat, 18 Feb 2023 16:16:14 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 91F4B28000D for ; Sat, 18 Feb 2023 16:16:14 -0500 (EST) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 65225A022D for ; Sat, 18 Feb 2023 21:16:14 +0000 (UTC) X-FDA: 80481670668.26.72A18A0 Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by imf16.hostedemail.com (Postfix) with ESMTP id 7A79A180013 for ; Sat, 18 Feb 2023 21:16:12 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=APyaY+hv; spf=pass (imf16.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.43 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1676754972; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:dkim-signature; bh=SpY8RNKvPEU8/scbKuOf3L3LO6d2Aql0f3gk0afkH+Q=; b=YYLxlUwPUL/LqgazsZRki87h+5VEYuaZhVWR5DIrRNA6I6cgKy+8xx3n7tYtQ48mRivklu Y2veUk3Sx4etQCrwEpYxKKYIB9YBSt9715TAZZYVX+v5ejueu1ZvoIeqr6eTUGmJX/zL96 5DMa2W+jg9l4IRWWKxr+9afaOxMH3iU= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=APyaY+hv; spf=pass (imf16.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.43 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1676754972; a=rsa-sha256; cv=none; b=5di4hhAd4Rend6FE/7+Gq+LWOJJ3hYnpFDjAWN2rbIXhvjlSz3Qy4UO+iPQCHMkyTkhoZw mxHP75XBDkGdSbwLf8zWN0yAHq5c/j8Vh3wqThV1aJdh8mz+u5H64TQ92NT2BbtygIeeIo sw4Nd4nTdGamMJXn/cSvC8Z8B8jA0O4= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1676754972; x=1708290972; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=64CpYc54+5BlAgu2DYKyZjSWnQK6dNYfq1G22ifMybk=; b=APyaY+hvX+mhXzXiGMIQ3/ebF/aOER7PGlWhPRGns8dmWUJNxq+fdw2+ 3Fo5DtwsQLA0GPDVAeVX28h7C2RWDfGFj9T2Rn+kXABc9DsJQYQ7GNGCO imLCl7zVYl1YU1KzALrddsulxBjL1qeu9gV0ulqWENR4d/kyntcMRUlcm INY6czPAFv3RG9D2BVV/AQ23PTqUmpj6qRVpsMqMit1o5UNebu5K9xZEQ ISrjCUE9V8zQddVdmhuvhbC4em3MkrebW9t/toWn10AAIjqdu50un7ECF HNTOkbx8HrOu+qnfzq39vBBVtzaWGIqpxdl+yh9UIOJ6oWrBPNreBohJA g==; X-IronPort-AV: E=McAfee;i="6500,9779,10625"; a="418427413" X-IronPort-AV: E=Sophos;i="5.97,309,1669104000"; d="scan'208";a="418427413" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Feb 2023 13:16:09 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10625"; a="664241643" X-IronPort-AV: E=Sophos;i="5.97,309,1669104000"; d="scan'208";a="664241643" Received: from adityava-mobl1.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.209.80.223]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Feb 2023 13:16:08 -0800 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu Subject: [PATCH v6 15/41] x86/mm: Update ptep/pmdp_set_wrprotect() for _PAGE_SAVED_DIRTY Date: Sat, 18 Feb 2023 13:14:07 -0800 Message-Id: <20230218211433.26859-16-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230218211433.26859-1-rick.p.edgecombe@intel.com> References: <20230218211433.26859-1-rick.p.edgecombe@intel.com> X-Rspamd-Queue-Id: 7A79A180013 X-Stat-Signature: nwbyj5a3ytky8ptxc7k7sd8t9f9rmfco X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1676754972-562217 X-HE-Meta: U2FsdGVkX1+zjeAs00qFnXQUCfxbL+NqYqKt/MSUMbk17SZ7VXvVjqA1mIrTjR31kbwMCk8YxSSUcgWlwzgW7zaDRiiW2jqO+6g87Cja4rr+5+XJebEJQ+QhFllwdY6oNICZGpmq0RaXgUz8J4kM6I+7a2WK9N1DFUMvdq4P2ZKC9lqFRbgRxswlZbiyUHgd+6PfBp3hfKMRD7hCpd0MB3PaVX7Bm8cdwnLr9fNfmdBtaNMJNyNqCXbJvmnf6tRcPoCWhHwpMX2BjNvQUnCpBqi0x4sMEj4B49Xnj0CL/i933S390gq8efNGjSmCjxguMlk1Si3LoZYncUbfm0C1M4QHyGfXxKI0mk/ivx18CfcMozXTiKLHb19n1CMgutKcMfjWozt1RX1oDvIITaKsL2/itTIWsWImgJJ8Pr/vDJIWXj7jvgGAHM/Ii7byVd5RpULal5BqDRVmlpo5qQYQFBkEEYZTcBUkqia5HaaV7jhYK9uHV305ipZCKTnBSKCvT6UtMgka4qP3ct5t8tTDx9iNUAotQiJ35Pe+rlxxPsR2nbkhsLDUAkkf10kQNqRlTU6upGU8vYSE669LEUlaNQM5ZFwOn7uuOR2eAep41Q5JsGHigVu2CnwTYhUYiPZsqmyyi2McFRPXnb95ZcZ84L68UjU5uqrIB8oKmwYTuwrNeLJ+dQ8uaa2vTQgjs9sZKfvgusJV079yOfy6fWMAKTswlmxrGGHGwiZ79bzcArUdQ26K4TmBLY4+mFs/PVW2DusEtknUxfv8Lsomwsfadv8N76vV8VoI+r3dnr3DLV8vYQH22jSzy3qLr4t4yg7m+i5Ta+nwJfB5EYJZsLU9sL6Rv/1cHA0l0+hwQXO5gqXmPOIWJecRVk9DqaMvvLppIXnQLaVglXj9Eb65aR+SGbpfgTPaZSu09IWjhItWeGgeuxaYqsMt06TiMK+M/aNMGHR4HQVLTgn2X3v77+A hbsu3HqD nJVszC4LyNdtAGdwzOxiJNbD2+83wmF0nCo2zuyz0XeguvVKIg4ojmZqdpqv1oNChRbi/dZHFgF5cGcKHWhkoV7qKhmWMzOG/4UHtuSrsxvG8qXBT45FdCgg2zIqi5G3SOw2OZz2ylwI+8ApiakweVr0J/uEZjgQciLES5zyVBmGUtedHGcV9xCmnwhnoIOiljNos/amZYuFd/CQz7pwUDKAhA2bytIqFyBI5VzHYjEOBuxXYh9ivmrGq+RE/Yg2ChgnKLzYeqxMrx7FdPKY89LUIS5R1eTk4laOIOBIltN7zUYwEH1fi0Rx0BlMKtKVSDwLEprECn0xa+/I= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Yu-cheng Yu When shadow stack is in use, Write=0,Dirty=1 PTE are preserved for shadow stack. Copy-on-write PTEs then have Write=0,SavedDirty=1. When a PTE goes from Write=1,Dirty=1 to Write=0,SavedDirty=1, it could become a transient shadow stack PTE in two cases: 1. Some processors can start a write but end up seeing a Write=0 PTE by the time they get to the Dirty bit, creating a transient shadow stack PTE. However, this will not occur on processors supporting shadow stack, and a TLB flush is not necessary. 2. When _PAGE_DIRTY is replaced with _PAGE_SAVED_DIRTY non-atomically, a transient shadow stack PTE can be created as a result. Thus, prevent that with cmpxchg. In the case of pmdp_set_wrprotect(), for nopmd configs the ->pmd operated on does not exist and the logic would need to be different. Although the extra functionality will normally be optimized out when user shadow stacks are not configured, also exclude it in the preprocessor stage so that it will still compile. User shadow stack is not supported there by Linux anyway. Leave the cpu_feature_enabled() check so that the functionality also gets disabled based on runtime detection of the feature. Similarly, compile it out in ptep_set_wrprotect() due to a clang warning on i386. Like above, the code path should get optimized out on i386 since shadow stack is not supported on 32 bit kernels, but this makes the compiler happy. Dave Hansen, Jann Horn, Andy Lutomirski, and Peter Zijlstra provided many insights to the issue. Jann Horn provided the cmpxchg solution. Tested-by: Pengfei Xu Tested-by: John Allen Reviewed-by: Kees Cook Signed-off-by: Yu-cheng Yu Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe --- v6: - Fix comment and log to update for _PAGE_COW being replaced with _PAGE_SAVED_DIRTY. v5: - Commit log verbiage and formatting (Boris) - Remove capitalization on shadow stack (Boris) - Fix i386 warning on recent clang v3: - Remove unnecessary #ifdef (Dave Hansen) v2: - Compile out some code due to clang build error - Clarify commit log (dhansen) - Normalize PTE bit descriptions between patches (dhansen) - Update comment with text from (dhansen) --- arch/x86/include/asm/pgtable.h | 35 ++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 110e552eb602..e5f00c077039 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -1192,6 +1192,23 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep) { +#ifdef CONFIG_X86_USER_SHADOW_STACK + /* + * Avoid accidentally creating shadow stack PTEs + * (Write=0,Dirty=1). Use cmpxchg() to prevent races with + * the hardware setting Dirty=1. + */ + if (cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) { + pte_t old_pte, new_pte; + + old_pte = READ_ONCE(*ptep); + do { + new_pte = pte_wrprotect(old_pte); + } while (!try_cmpxchg(&ptep->pte, &old_pte.pte, new_pte.pte)); + + return; + } +#endif clear_bit(_PAGE_BIT_RW, (unsigned long *)&ptep->pte); } @@ -1244,6 +1261,24 @@ static inline pud_t pudp_huge_get_and_clear(struct mm_struct *mm, static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr, pmd_t *pmdp) { +#ifdef CONFIG_X86_USER_SHADOW_STACK + /* + * Avoid accidentally creating shadow stack PTEs + * (Write=0,Dirty=1). Use cmpxchg() to prevent races with + * the hardware setting Dirty=1. + */ + if (cpu_feature_enabled(X86_FEATURE_USER_SHSTK)) { + pmd_t old_pmd, new_pmd; + + old_pmd = READ_ONCE(*pmdp); + do { + new_pmd = pmd_wrprotect(old_pmd); + } while (!try_cmpxchg(&pmdp->pmd, &old_pmd.pmd, new_pmd.pmd)); + + return; + } +#endif + clear_bit(_PAGE_BIT_RW, (unsigned long *)pmdp); }