From patchwork Mon Sep 2 16:33:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Fares Mehanna X-Patchwork-Id: 13787484 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E428ECA0ED3 for ; Mon, 2 Sep 2024 16:35:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=5jFUTRcDwsdgM2AQVIAoOZ1Pjqai13CYe6ZSY5fIPKs=; b=wyYBDYV4bsgSXfkU/RT5HGWtvo q6H7S7FKW11mcHV2V6Fh/gJj2+0igBtZlAhogPgoXzMVgtZ+0dn4aE3wD1WDsJlLta0OvffJWzbBE 5Xcv1byA13MMyfhELVk2wEOlmoGN6P1CHGf5GFQaeZRBGczMDPeoE2fev7oSAiT761v+xhAmEmwsY sVzhasHPSeLLJQMC+Z5dmVEaSwf8ymzy4dBTW8eivWZ+NiZfNlhH+WEt4KCbN7QxkvfXtvdA+/goz +sqyKjh+UBFpWg7w9FGQnIPGm8ADMLWdPA9HJ24CBcyUdFM/vQJB14lsGSTYccP7n6CoeG/FQ19SG f8u9f+Qg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1slA1W-0000000F2JW-1bwx; Mon, 02 Sep 2024 16:35:26 +0000 Received: from smtp-fw-9106.amazon.com ([207.171.188.206]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1slA0c-0000000F2Cw-2wew for linux-arm-kernel@lists.infradead.org; Mon, 02 Sep 2024 16:34:32 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazon201209; t=1725294871; x=1756830871; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=5jFUTRcDwsdgM2AQVIAoOZ1Pjqai13CYe6ZSY5fIPKs=; b=e0oRRaO86cTMdvxQo8FxzLlX2Z24Tsf/uwKWnCTDkxVbGx7WC42SCjbq LRv6/3GiKmKDzQQrjpQgzi9H8EShhcBxfqhSueukb0AqJGh87r1AK4bv0 rCs3GiPrEzhTXlHZBAI+Rbc6neatve7ctCyod0cCEpLO3VRcvtd7v7mMc Q=; X-IronPort-AV: E=Sophos;i="6.10,196,1719878400"; d="scan'208";a="755830880" Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO smtpout.prod.us-east-1.prod.farcaster.email.amazon.dev) ([10.25.36.210]) by smtp-border-fw-9106.sea19.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Sep 2024 16:34:21 +0000 Received: from EX19MTAEUC002.ant.amazon.com [10.0.17.79:34199] by smtpin.naws.eu-west-1.prod.farcaster.email.amazon.dev [10.0.37.143:2525] with esmtp (Farcaster) id baa764ee-730a-4b0a-8c81-82279a5d2898; Mon, 2 Sep 2024 16:34:19 +0000 (UTC) X-Farcaster-Flow-ID: baa764ee-730a-4b0a-8c81-82279a5d2898 Received: from EX19D007EUA001.ant.amazon.com (10.252.50.133) by EX19MTAEUC002.ant.amazon.com (10.252.51.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.34; Mon, 2 Sep 2024 16:34:19 +0000 Received: from EX19MTAUEA001.ant.amazon.com (10.252.134.203) by EX19D007EUA001.ant.amazon.com (10.252.50.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.35; Mon, 2 Sep 2024 16:34:18 +0000 Received: from dev-dsk-faresx-1b-27755bf1.eu-west-1.amazon.com (10.253.79.181) by mail-relay.amazon.com (10.252.134.102) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.34 via Frontend Transport; Mon, 2 Sep 2024 16:34:17 +0000 From: Fares Mehanna To: CC: , Fares Mehanna , =?utf-8?q?Jan_H_=2E_Sch=C3=B6nherr?= , "Catalin Marinas" , Will Deacon , "Andrew Morton" , Ryan Roberts , Mark Rutland , , Subject: [PATCH] arm64: trans_pgd: mark PTEs entries as valid to avoid dead kexec() Date: Mon, 2 Sep 2024 16:33:08 +0000 Message-ID: <20240902163309.97113-1-faresx@amazon.de> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240902_093430_850383_CA52FEAB X-CRM114-Status: GOOD ( 16.90 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The reasons for PTEs in the kernel direct map to be marked invalid are not limited to kfence / debug pagealloc machinery. In particular, memfd_secret() also steals pages with set_direct_map_invalid_noflush(). When building the transitional page tables for kexec from the current kernel's page tables, those pages need to become regular writable pages, otherwise, if the relocation places kexec segments over such pages, a fault will occur during kexec, leading to host going dark during kexec. This patch addresses the kexec issue by marking any PTE as valid if it is not none. While this fixes the kexec crash, it does not address the security concern that if processes owning secret memory are not terminated before kexec, the secret content will be mapped in the new kernel without being scrubbed. Suggested-by: Jan H. Schönherr Signed-off-by: Fares Mehanna --- arch/arm64/mm/trans_pgd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index 5139a28130c0..0f7b484cb2ff 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -42,14 +42,16 @@ static void _copy_pte(pte_t *dst_ptep, pte_t *src_ptep, unsigned long addr) * the temporary mappings we use during restore. */ __set_pte(dst_ptep, pte_mkwrite_novma(pte)); - } else if ((debug_pagealloc_enabled() || - is_kfence_address((void *)addr)) && !pte_none(pte)) { + } else if (!pte_none(pte)) { /* * debug_pagealloc will removed the PTE_VALID bit if * the page isn't in use by the resume kernel. It may have * been in use by the original kernel, in which case we need * to put it back in our copy to do the restore. * + * Other cases include kfence / vmalloc / memfd_secret which + * may call `set_direct_map_invalid_noflush()`. + * * Before marking this entry valid, check the pfn should * be mapped. */