From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1532C433DB for ; Mon, 15 Feb 2021 16:49:20 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 25B8364E37 for ; Mon, 15 Feb 2021 16:49:20 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 25B8364E37 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 7C9168D0130; Mon, 15 Feb 2021 11:49:19 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 779DF8D012C; Mon, 15 Feb 2021 11:49:19 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6693C8D0130; Mon, 15 Feb 2021 11:49:19 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0145.hostedemail.com [216.40.44.145]) by kanga.kvack.org (Postfix) with ESMTP id 4E15B8D012C for ; Mon, 15 Feb 2021 11:49:19 -0500 (EST) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 0C172180F9826 for ; Mon, 15 Feb 2021 16:49:19 +0000 (UTC) X-FDA: 77821087638.15.bells28_270428a2763c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin15.hostedemail.com (Postfix) with ESMTP id D8433181CAC68 for ; Mon, 15 Feb 2021 16:49:18 +0000 (UTC) X-HE-Tag: bells28_270428a2763c X-Filterd-Recvd-Size: 15373 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Mon, 15 Feb 2021 16:49:17 +0000 (UTC) IronPort-SDR: i7Nif/GJmzFxk6eKXiJ3qxx9q6pd7furfgEI2bT54/1s5zNcUx6IXZq+6dUmyo6T5OHxXol/Lq D+d1vWArQO+g== X-IronPort-AV: E=McAfee;i="6000,8403,9896"; a="170381140" X-IronPort-AV: E=Sophos;i="5.81,181,1610438400"; d="scan'208";a="170381140" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Feb 2021 08:49:15 -0800 IronPort-SDR: qrnNDKcuiVv1NLGj4QSyRfIFTrNz7/dFpMkynYX/nWO0kmiebauSV2ScArn+9Pz1AwPGn7XHeo P83p4ANuFnSw== X-IronPort-AV: E=Sophos;i="5.81,181,1610438400"; d="scan'208";a="383439501" Received: from gbravo-mobl.amr.corp.intel.com (HELO [10.212.239.42]) ([10.212.239.42]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Feb 2021 08:49:06 -0800 Subject: Re: [PATCH v20 08/25] x86/mm: Introduce _PAGE_COW From: "Yu, Yu-cheng" To: Kees Cook Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu , haitao.huang@intel.com References: <20210210175703.12492-1-yu-cheng.yu@intel.com> <20210210175703.12492-9-yu-cheng.yu@intel.com> <202102101137.E109C9FE6@keescook> <819b6d6a-64ea-d908-76ad-0a6366ed0d53@intel.com> Message-ID: <66b7f5ef-2554-0b2d-13d3-a3f3467d968c@intel.com> Date: Mon, 15 Feb 2021 08:49:05 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.7.1 MIME-Version: 1.0 In-Reply-To: <819b6d6a-64ea-d908-76ad-0a6366ed0d53@intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2/10/2021 12:28 PM, Yu, Yu-cheng wrote: > On 2/10/2021 11:42 AM, Kees Cook wrote: >> On Wed, Feb 10, 2021 at 09:56:46AM -0800, Yu-cheng Yu wrote: >>> There is essentially no room left in the x86 hardware PTEs on some OS= es >>> (not Linux).=C2=A0 That left the hardware architects looking for a wa= y to >>> represent a new memory type (shadow stack) within the existing bits. >>> They chose to repurpose a lightly-used state: Write=3D0, Dirty=3D1. >>> >>> The reason it's lightly used is that Dirty=3D1 is normally set by har= dware >>> and cannot normally be set by hardware on a Write=3D0 PTE.=C2=A0 Soft= ware must >>> normally be involved to create one of these PTEs, so software can sim= ply >>> opt to not create them. >>> >>> In places where Linux normally creates Write=3D0, Dirty=3D1, it can u= se the >>> software-defined _PAGE_COW in place of the hardware _PAGE_DIRTY.=C2=A0= In=20 >>> other >>> words, whenever Linux needs to create Write=3D0, Dirty=3D1, it instea= d=20 >>> creates >>> Write=3D0, Cow=3D1, except for shadow stack, which is Write=3D0, Dirt= y=3D1. =20 >>> This >>> clearly separates shadow stack from other data, and results in the >>> following: >>> >>> (a) A modified, copy-on-write (COW) page: (Write=3D0, Cow=3D1) >>> (b) A R/O page that has been COW'ed: (Write=3D0, Cow=3D1) >>> =C2=A0=C2=A0=C2=A0=C2=A0 The user page is in a R/O VMA, and get_user_= pages() needs a=20 >>> writable >>> =C2=A0=C2=A0=C2=A0=C2=A0 copy.=C2=A0 The page fault handler creates a= copy of the page and sets >>> =C2=A0=C2=A0=C2=A0=C2=A0 the new copy's PTE as Write=3D0 and Cow=3D1. >>> (c) A shadow stack PTE: (Write=3D0, Dirty=3D1) >>> (d) A shared shadow stack PTE: (Write=3D0, Cow=3D1) >>> =C2=A0=C2=A0=C2=A0=C2=A0 When a shadow stack page is being shared amo= ng processes (this=20 >>> happens >>> =C2=A0=C2=A0=C2=A0=C2=A0 at fork()), its PTE is made Dirty=3D0, so th= e next shadow stack=20 >>> access >>> =C2=A0=C2=A0=C2=A0=C2=A0 causes a fault, and the page is duplicated a= nd Dirty=3D1 is set=20 >>> again. >>> =C2=A0=C2=A0=C2=A0=C2=A0 This is the COW equivalent for shadow stack = pages, even though it's >>> =C2=A0=C2=A0=C2=A0=C2=A0 copy-on-access rather than copy-on-write. >>> (e) A page where the processor observed a Write=3D1 PTE, started a=20 >>> write, set >>> =C2=A0=C2=A0=C2=A0=C2=A0 Dirty=3D1, but then observed a Write=3D0 PTE= .=C2=A0 That's possible=20 >>> today, but >>> =C2=A0=C2=A0=C2=A0=C2=A0 will not happen on processors that support s= hadow stack. >>> >>> Define _PAGE_COW and update pte_*() helpers and apply the same=20 >>> changes to >>> pmd and pud. >> >> I still find this commit confusing mostly due to _PAGE_COW being 0 >> without CET enabled. Shouldn't this just get changed universally? Why >> should this change depend on CET? >> >=20 > For example, in... >=20 > static inline int pte_write(pte_t pte) > { > =C2=A0=C2=A0=C2=A0=C2=A0if (cpu_feature_enabled(X86_FEATURE_SHSTK)) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return pte_flags(pte) & (_P= AGE_RW | _PAGE_DIRTY); > =C2=A0=C2=A0=C2=A0=C2=A0else > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return pte_flags(pte) & _PA= GE_RW; > } >=20 > There are four cases: >=20 > (a) RW=3D1, Dirty=3D1 -> writable > (b) RW=3D1, Dirty=3D0 -> writable > (c) RW=3D0, Dirty=3D0 -> not writable > (d) RW=3D0, Dirty=3D1 -> shadow stack, or not-writable if !X86_FEATURE_= SHSTK >=20 > Case (d) is ture only when shadow stack is enabled, otherwise it is not= =20 > writable.=C2=A0 With shadow stack feature, the usual dirty, copy-on-wri= te PTE=20 > becomes RW=3D0, Cow=3D1. >=20 > We can get this changed universally, but all usual dirty, copy-on-write= =20 > PTEs need the Dirty/Cow swapping, always.=C2=A0 Is that desirable? >=20 Instead of working on _PAGE_COW directly, create three helpers:=20 pte_make_cow(), pte_clear_cow(), pte_shstk(). The decision of swapping=20 _PAGE_DIRTY/_PAGE_COW is now in the helpers. For example,=20 pte_wrprotect() is now: static inline pte_t pte_wrprotect(pte_t pte) { pte =3D pte_clear_flags(pte, _PAGE_RW); if (pte_dirty(pte)) pte =3D pte_make_cow(pte); return pte; } How is that? The revise patch is the following. Yu-cheng diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtabl= e.h index a02c67291cfc..1a6c0784af0a 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -121,11 +121,21 @@ extern pmdval_t early_pmd_flags; * The following only work if pte_present() is true. * Undefined behaviour if not.. */ -static inline int pte_dirty(pte_t pte) +static inline bool pte_dirty(pte_t pte) { - return pte_flags(pte) & _PAGE_DIRTY; + /* + * A dirty PTE has Dirty=3D1 or Cow=3D1. + */ + return pte_flags(pte) & _PAGE_DIRTY_BITS; } +static inline bool pte_shstk(pte_t pte) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return false; + + return (pte_flags(pte) & (_PAGE_RW | _PAGE_DIRTY)) =3D=3D _PAGE_DIRTY; +} static inline u32 read_pkru(void) { @@ -160,9 +170,20 @@ static inline int pte_young(pte_t pte) return pte_flags(pte) & _PAGE_ACCESSED; } -static inline int pmd_dirty(pmd_t pmd) +static inline bool pmd_dirty(pmd_t pmd) { - return pmd_flags(pmd) & _PAGE_DIRTY; + /* + * A dirty PMD has Dirty=3D1 or Cow=3D1. + */ + return pmd_flags(pmd) & _PAGE_DIRTY_BITS; +} + +static inline bool pmd_shstk(pmd_t pmd) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return false; + + return (pmd_flags(pmd) & (_PAGE_RW | _PAGE_DIRTY)) =3D=3D _PAGE_DIRTY; } static inline int pmd_young(pmd_t pmd) @@ -170,9 +191,12 @@ static inline int pmd_young(pmd_t pmd) return pmd_flags(pmd) & _PAGE_ACCESSED; } -static inline int pud_dirty(pud_t pud) +static inline bool pud_dirty(pud_t pud) { - return pud_flags(pud) & _PAGE_DIRTY; + /* + * A dirty PUD has Dirty=3D1 or Cow=3D1. + */ + return pud_flags(pud) & _PAGE_DIRTY_BITS; } static inline int pud_young(pud_t pud) @@ -182,7 +206,7 @@ static inline int pud_young(pud_t pud) static inline int pte_write(pte_t pte) { - return pte_flags(pte) & _PAGE_RW; + return (pte_flags(pte) & _PAGE_RW) || pte_shstk(pte); } static inline int pte_huge(pte_t pte) @@ -314,6 +338,24 @@ static inline pte_t pte_clear_flags(pte_t pte,=20 pteval_t clear) return native_make_pte(v & ~clear); } +static inline pte_t pte_make_cow(pte_t pte) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return pte; + + pte =3D pte_clear_flags(pte, _PAGE_DIRTY); + return pte_set_flags(pte, _PAGE_COW); +} + +static inline pte_t pte_clear_cow(pte_t pte) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return pte; + + pte =3D pte_set_flags(pte, _PAGE_DIRTY); + return pte_clear_flags(pte, _PAGE_COW); +} + #ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP static inline int pte_uffd_wp(pte_t pte) { @@ -333,7 +375,7 @@ static inline pte_t pte_clear_uffd_wp(pte_t pte) static inline pte_t pte_mkclean(pte_t pte) { - return pte_clear_flags(pte, _PAGE_DIRTY); + return pte_clear_flags(pte, _PAGE_DIRTY_BITS); } static inline pte_t pte_mkold(pte_t pte) @@ -343,7 +385,16 @@ static inline pte_t pte_mkold(pte_t pte) static inline pte_t pte_wrprotect(pte_t pte) { - return pte_clear_flags(pte, _PAGE_RW); + pte =3D pte_clear_flags(pte, _PAGE_RW); + + /* + * Blindly clearing _PAGE_RW might accidentally create + * a shadow stack PTE (RW=3D0, Dirty=3D1). Move the hardware + * dirty value to the software bit. + */ + if (pte_dirty(pte)) + pte =3D pte_make_cow(pte); + return pte; } static inline pte_t pte_mkexec(pte_t pte) @@ -353,7 +404,18 @@ static inline pte_t pte_mkexec(pte_t pte) static inline pte_t pte_mkdirty(pte_t pte) { - return pte_set_flags(pte, _PAGE_DIRTY | _PAGE_SOFT_DIRTY); + pteval_t dirty =3D _PAGE_DIRTY; + + /* Avoid creating (HW)Dirty=3D1, Write=3D0 PTEs */ + if (cpu_feature_enabled(X86_FEATURE_SHSTK) && !pte_write(pte)) + dirty =3D _PAGE_COW; + + return pte_set_flags(pte, dirty | _PAGE_SOFT_DIRTY); +} + +static inline pte_t pte_mkwrite_shstk(pte_t pte) +{ + return pte_clear_cow(pte); } static inline pte_t pte_mkyoung(pte_t pte) @@ -363,7 +425,12 @@ static inline pte_t pte_mkyoung(pte_t pte) static inline pte_t pte_mkwrite(pte_t pte) { - return pte_set_flags(pte, _PAGE_RW); + pte =3D pte_set_flags(pte, _PAGE_RW); + + if (pte_dirty(pte)) + pte =3D pte_clear_cow(pte); + + return pte; } static inline pte_t pte_mkhuge(pte_t pte) @@ -410,6 +477,24 @@ static inline pmd_t pmd_clear_flags(pmd_t pmd,=20 pmdval_t clear) return native_make_pmd(v & ~clear); } +static inline pmd_t pmd_make_cow(pmd_t pmd) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return pmd; + + pmd =3D pmd_clear_flags(pmd, _PAGE_DIRTY); + return pmd_set_flags(pmd, _PAGE_COW); +} + +static inline pmd_t pmd_clear_cow(pmd_t pmd) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return pmd; + + pmd =3D pmd_set_flags(pmd, _PAGE_DIRTY); + return pmd_clear_flags(pmd, _PAGE_COW); +} + #ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP static inline int pmd_uffd_wp(pmd_t pmd) { @@ -434,17 +519,36 @@ static inline pmd_t pmd_mkold(pmd_t pmd) static inline pmd_t pmd_mkclean(pmd_t pmd) { - return pmd_clear_flags(pmd, _PAGE_DIRTY); + return pmd_clear_flags(pmd, _PAGE_DIRTY_BITS); } static inline pmd_t pmd_wrprotect(pmd_t pmd) { - return pmd_clear_flags(pmd, _PAGE_RW); + pmd =3D pmd_clear_flags(pmd, _PAGE_RW); + /* + * Blindly clearing _PAGE_RW might accidentally create + * a shadow stack PMD (RW=3D0, Dirty=3D1). Move the hardware + * dirty value to the software bit. + */ + if (pmd_dirty(pmd)) + pmd =3D pmd_make_cow(pmd); + return pmd; } static inline pmd_t pmd_mkdirty(pmd_t pmd) { - return pmd_set_flags(pmd, _PAGE_DIRTY | _PAGE_SOFT_DIRTY); + pmdval_t dirty =3D _PAGE_DIRTY; + + /* Avoid creating (HW)Dirty=3D1, Write=3D0 PMDs */ + if (cpu_feature_enabled(X86_FEATURE_SHSTK) && !(pmd_flags(pmd) &=20 _PAGE_RW)) + dirty =3D _PAGE_COW; + + return pmd_set_flags(pmd, dirty | _PAGE_SOFT_DIRTY); +} + +static inline pmd_t pmd_mkwrite_shstk(pmd_t pmd) +{ + return pmd_clear_cow(pmd); } static inline pmd_t pmd_mkdevmap(pmd_t pmd) @@ -464,7 +568,11 @@ static inline pmd_t pmd_mkyoung(pmd_t pmd) static inline pmd_t pmd_mkwrite(pmd_t pmd) { - return pmd_set_flags(pmd, _PAGE_RW); + pmd =3D pmd_set_flags(pmd, _PAGE_RW); + + if (pmd_dirty(pmd)) + pmd =3D pmd_clear_cow(pmd); + return pmd; } static inline pud_t pud_set_flags(pud_t pud, pudval_t set) @@ -481,6 +589,24 @@ static inline pud_t pud_clear_flags(pud_t pud,=20 pudval_t clear) return native_make_pud(v & ~clear); } +static inline pud_t pud_make_cow(pud_t pud) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return pud; + + pud =3D pud_clear_flags(pud, _PAGE_DIRTY); + return pud_set_flags(pud, _PAGE_COW); +} + +static inline pud_t pud_clear_cow(pud_t pud) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return pud; + + pud =3D pud_set_flags(pud, _PAGE_DIRTY); + return pud_clear_flags(pud, _PAGE_COW); +} + static inline pud_t pud_mkold(pud_t pud) { return pud_clear_flags(pud, _PAGE_ACCESSED); @@ -488,17 +614,32 @@ static inline pud_t pud_mkold(pud_t pud) static inline pud_t pud_mkclean(pud_t pud) { - return pud_clear_flags(pud, _PAGE_DIRTY); + return pud_clear_flags(pud, _PAGE_DIRTY_BITS); } static inline pud_t pud_wrprotect(pud_t pud) { - return pud_clear_flags(pud, _PAGE_RW); + pud =3D pud_clear_flags(pud, _PAGE_RW); + + /* + * Blindly clearing _PAGE_RW might accidentally create + * a shadow stack PUD (RW=3D0, Dirty=3D1). Move the hardware + * dirty value to the software bit. + */ + if (pud_dirty(pud)) + pud =3D pud_make_cow(pud); + return pud; } static inline pud_t pud_mkdirty(pud_t pud) { - return pud_set_flags(pud, _PAGE_DIRTY | _PAGE_SOFT_DIRTY); + pudval_t dirty =3D _PAGE_DIRTY; + + /* Avoid creating (HW)Dirty=3D1, Write=3D0 PUDs */ + if (cpu_feature_enabled(X86_FEATURE_SHSTK) && !(pud_flags(pud) &=20 _PAGE_RW)) + dirty =3D _PAGE_COW; + + return pud_set_flags(pud, dirty | _PAGE_SOFT_DIRTY); } static inline pud_t pud_mkdevmap(pud_t pud) @@ -518,7 +659,11 @@ static inline pud_t pud_mkyoung(pud_t pud) static inline pud_t pud_mkwrite(pud_t pud) { - return pud_set_flags(pud, _PAGE_RW); + pud =3D pud_set_flags(pud, _PAGE_RW); + + if (pud_dirty(pud)) + pud =3D pud_clear_cow(pud); + return pud; } #ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY @@ -1131,7 +1276,7 @@ extern int pmdp_clear_flush_young(struct=20 vm_area_struct *vma, #define pmd_write pmd_write static inline int pmd_write(pmd_t pmd) { - return pmd_flags(pmd) & _PAGE_RW; + return (pmd_flags(pmd) & _PAGE_RW) || pmd_shstk(pmd); } #define __HAVE_ARCH_PMDP_HUGE_GET_AND_CLEAR