From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D07E6C678D5 for ; Wed, 8 Mar 2023 09:23:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3EA146B0072; Wed, 8 Mar 2023 04:23:41 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3C12A6B0078; Wed, 8 Mar 2023 04:23:41 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2AFD6280001; Wed, 8 Mar 2023 04:23:41 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 0DFE36B0072 for ; Wed, 8 Mar 2023 04:23:41 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id CEEB11A0C0C for ; Wed, 8 Mar 2023 09:23:40 +0000 (UTC) X-FDA: 80545193400.11.19C353E Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by imf07.hostedemail.com (Postfix) with ESMTP id 5037340018 for ; Wed, 8 Mar 2023 09:23:31 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=temperror ("DNS error when getting key") header.d=alien8.de header.s=dkim header.b=f40c4cP7; spf=temperror (imf07.hostedemail.com: error in processing during lookup of bp@alien8.de: DNS error) smtp.mailfrom=bp@alien8.de; dmarc=temperror reason="query timed out" header.from=alien8.de (policy=temperror) Received: from zn.tnic (p5de8e9fe.dip0.t-ipconnect.de [93.232.233.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id 9637E1EC0691; Wed, 8 Mar 2023 10:23:29 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1678267409; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references; bh=802coS+HxbpOP0Cayz2V/ZmNxZUObxQN5WW++zeQd1k=; b=f40c4cP7e6n+tchcjwucO7lAQuNx4scQ0Zxa/wJFrusM2kjP65DJOobsS+A4fZx0N2tqxn ObA+C7n+KvQLDyHulxod5y6RaUSxFzNqDULV2cTjsGGYH7I89sVhiHA1K0LqN/vi8BjDpO fvfErsztx6I36Hkn7IcRdGEz1ePE1Bk= Date: Wed, 8 Mar 2023 10:23:24 +0100 From: Borislav Petkov To: Rick Edgecombe Cc: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Subject: Re: [PATCH v7 27/41] x86/mm: Warn if create Write=0,Dirty=1 with raw prot Message-ID: References: <20230227222957.24501-1-rick.p.edgecombe@intel.com> <20230227222957.24501-28-rick.p.edgecombe@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20230227222957.24501-28-rick.p.edgecombe@intel.com> X-Rspam-User: X-Rspamd-Queue-Id: 5037340018 X-Rspamd-Server: rspam01 X-Stat-Signature: y5ufed5f3xz36zmkcdpm65yx34pap6sw X-HE-Tag: 1678267411-833611 X-HE-Meta: U2FsdGVkX1+ePUoNdBq3qcwWKZ8yW/W4wGMI2T5IICjcT+ROr7CG0Zx3uFdZdjXZPUCqjnYtyR7oO30QJucEnntjcNFk6Vt87BX4nXdmCMQnjLo0V08nd3zuPBE5VnLDeICuQGoZAQJJWSknDB9ry/7p5x9jst65gu+rXCme5BWhBTrDWMx5u1sJI7C7D4HdAkdDSVuzEe4RCnPjpAMM1FqH3lJXzo9uoN+DiTkcvoi2VizLgIdw0pBT23Th6iFhHrcYuKPHucYYXoussv/zMKh3ZVMi03f6Irn9m4quH2nEFJhOvgwyTsIDCqpAfgkMTtla8DdA9zlbxhlzeX4UJMxEedbykCy56zyMLsSp1JBm97H6owVJQ0D+1fXDC8R+DdJpG0+A9qt1LwDDaSkDNYgyNlbNw4mEnyx0j9YfeB07GhrINtaNscBeQlCNTrI7Iujf2+r1phjgpRg0mbyN0XVnsrd9y+qeSLlXXyVzuibidns8/vfMETv3A0jAlADJ5fZHikFKY/W+sEl/bbWusH1lB/C0rOxHw6SZhWBVqmhuO5t1lxDxl7ruu/p/fI+h07cN9eNlztirZhXPO6lEe61hkMV7K3CRpWSLDtyuEai9pdJmiI1FvD0Vm+piYr578P5614sWsznMpcI3O+g0dluV113UbZl43mVsImyxmfjgwSM6FZ0JVGoLS8HrYEMoTMT17RUO7H3/yGoeGyEU+iT13mQoEdbmpfS1n7CijAw9EEIapz/9NcRYyOJSecY4kcm4sLbPVQfaxIAMryMRWIy/RhpdURDBH9SuIyz3ATNkvBEgv7Rg4iX/7qZU8skiK8bwhEcZh90ziPr2AWYB5r99o0GtVtJn84EMEcdFZC7ovW1LimuVtK3dizxl4TK3Gnxj8DS07I+Aoz2mbEWmtryvt0W5dvq9whAbOeXbZbZZ4DjFk5Dh5RNuopvJAvNSglTTnRY53ENlchNUGvj 5C2uWDjF XxUbnNQud10OgehaZOQd4VJRJiQpJgU/id6+fMDxK4kJagLhShRTr/PYLo40lz9lDvchVX4p/QP8GszR+pyASJ0U5AGucMUbbxJ/SoVLx9kldLLctv2JKVr3ruhfYHPtWuXBFgVzyxFQf+1E/7C9E4j63Wl6Lp4Kb+glFvY/19kWvwq10JfGSVMtB2P3hTgzZRu7ecnhIvFkL6e9dr9PFhbG2eHgMRgMj3ZK0PUYi9dfIRFEv25AKNIvFmlOipH//7SI0j0sg/wAAo0wSCF/YnVDQ6Tse1hRawB+ojeJq9sk+UPgKeOg9Oay9XL5BRhSFDY3XLir4JTSHQXoo87x3+clE6jXIj5Gv7fGUPZA63xlKfLHtTnpTtHAIDGR6Fr5rZIBJ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Feb 27, 2023 at 02:29:43PM -0800, Rick Edgecombe wrote: > When user shadow stack is use, Write=0,Dirty=1 is treated by the CPU as ^ in > shadow stack memory. So for shadow stack memory this bit combination is > valid, but when Dirty=1,Write=1 (conventionally writable) memory is being > write protected, the kernel has been taught to transition the Dirty=1 > bit to SavedDirty=1, to avoid inadvertently creating shadow stack > memory. It does this inside pte_wrprotect() because it knows the PTE is > not intended to be a writable shadow stack entry, it is supposed to be > write protected. > > However, when a PTE is created by a raw prot using mk_pte(), mk_pte() > can't know whether to adjust Dirty=1 to SavedDirty=1. It can't > distinguish between the caller intending to create a shadow stack PTE or > needing the SavedDirty shift. > > The kernel has been updated to not do this, and so Write=0,Dirty=1 > memory should only be created by the pte_mkfoo() helpers. Add a warning > to make sure no new mk_pte() start doing this. Might wanna add the note from below here: "... start doing this, like, for example, set_memory_rox() did." > Tested-by: Pengfei Xu > Tested-by: John Allen > Tested-by: Kees Cook > Acked-by: Mike Rapoport (IBM) > Signed-off-by: Rick Edgecombe > > --- > v6: > - New patch (Note, this has already been a useful warning, it caught the > newly added set_memory_rox() doing this) Thx. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette