[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1531868435.3541.18.camel@intel.com>
Date: Tue, 17 Jul 2018 16:00:35 -0700
From: Yu-cheng Yu <yu-cheng.yu@...el.com>
To: Peter Zijlstra <peterz@...radead.org>
Cc: x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
linux-doc@...r.kernel.org, linux-mm@...ck.org,
linux-arch@...r.kernel.org, linux-api@...r.kernel.org,
Arnd Bergmann <arnd@...db.de>,
Andy Lutomirski <luto@...capital.net>,
Balbir Singh <bsingharora@...il.com>,
Cyrill Gorcunov <gorcunov@...il.com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Florian Weimer <fweimer@...hat.com>,
"H.J. Lu" <hjl.tools@...il.com>, Jann Horn <jannh@...gle.com>,
Jonathan Corbet <corbet@....net>,
Kees Cook <keescook@...omiun.org>,
Mike Kravetz <mike.kravetz@...cle.com>,
Nadav Amit <nadav.amit@...il.com>,
Oleg Nesterov <oleg@...hat.com>, Pavel Machek <pavel@....cz>,
"Ravi V. Shankar" <ravi.v.shankar@...el.com>,
Vedvyas Shanbhogue <vedvyas.shanbhogue@...el.com>
Subject: Re: [RFC PATCH v2 16/27] mm: Modify can_follow_write_pte/pmd for
shadow stack
On Wed, 2018-07-11 at 11:29 +0200, Peter Zijlstra wrote:
> On Tue, Jul 10, 2018 at 03:26:28PM -0700, Yu-cheng Yu wrote:
> >
> > There are three possible shadow stack PTE settings:
> >
> > Normal SHSTK PTE: (R/O + DIRTY_HW)
> > SHSTK PTE COW'ed: (R/O + DIRTY_HW)
> > SHSTK PTE shared as R/O data: (R/O + DIRTY_SW)
> I count _2_ distinct states there.
>
> >
> > Update can_follow_write_pte/pmd for the shadow stack.
> So the below disallows can_follow_write when shstk && _PAGE_DIRTY_SW,
> but this here Changelog doesn't explain why. Doesn't even get close.
Can we add the following to the log:
When a SHSTK PTE is shared, it is (R/O + DIRTY_SW); otherwise it is
(R/O + DIRTY_HW).
When we (FOLL_WRITE | FOLL_FORCE) on a SHSTK PTE, the following
must be true:
- It has been COW'ed at least once (FOLL_COW is set);
- It still is not shared, i.e. PTE is (R/O + DIRTY_HW);
>
> Also, the code is a right mess :/ Can't we try harder to not let this
> shadow stack stuff escape arch code.
We either check here if the VMA is SHSTK mapping or move the logic
to pte_dirty(). The latter would be less obvious. Or can we
create a can_follow_write_shstk_pte()?
Yu-cheng
Powered by blists - more mailing lists