lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 30 Aug 2018 09:02:04 -0700 From: Yu-cheng Yu <yu-cheng.yu@...el.com> To: Jann Horn <jannh@...gle.com> Cc: the arch/x86 maintainers <x86@...nel.org>, "H . Peter Anvin" <hpa@...or.com>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, kernel list <linux-kernel@...r.kernel.org>, linux-doc@...r.kernel.org, Linux-MM <linux-mm@...ck.org>, linux-arch <linux-arch@...r.kernel.org>, Linux API <linux-api@...r.kernel.org>, Arnd Bergmann <arnd@...db.de>, Andy Lutomirski <luto@...capital.net>, Balbir Singh <bsingharora@...il.com>, Cyrill Gorcunov <gorcunov@...il.com>, Dave Hansen <dave.hansen@...ux.intel.com>, Florian Weimer <fweimer@...hat.com>, hjl.tools@...il.com, Jonathan Corbet <corbet@....net>, keescook@...omiun.org, Mike Kravetz <mike.kravetz@...cle.com>, Nadav Amit <nadav.amit@...il.com>, Oleg Nesterov <oleg@...hat.com>, Pavel Machek <pavel@....cz>, Peter Zijlstra <peterz@...radead.org>, ravi.v.shankar@...el.com, vedvyas.shanbhogue@...el.com Subject: Re: [RFC PATCH v3 12/24] x86/mm: Modify ptep_set_wrprotect and pmdp_set_wrprotect for _PAGE_DIRTY_SW On Thu, 2018-08-30 at 17:49 +0200, Jann Horn wrote: > On Thu, Aug 30, 2018 at 4:43 PM Yu-cheng Yu <yu-cheng.yu@...el.com> > wrote: > > > > > > When Shadow Stack is enabled, the read-only and PAGE_DIRTY_HW PTE > > setting is reserved only for the Shadow Stack. To track dirty of > > non-Shadow Stack read-only PTEs, we use PAGE_DIRTY_SW. > > > > Update ptep_set_wrprotect() and pmdp_set_wrprotect(). > > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@...el.com> > > --- > > arch/x86/include/asm/pgtable.h | 42 > > ++++++++++++++++++++++++++++++++++ > > 1 file changed, 42 insertions(+) > > > > diff --git a/arch/x86/include/asm/pgtable.h > > b/arch/x86/include/asm/pgtable.h > > index 4d50de77ea96..556ef258eeff 100644 > > --- a/arch/x86/include/asm/pgtable.h > > +++ b/arch/x86/include/asm/pgtable.h > > @@ -1203,7 +1203,28 @@ static inline pte_t > > ptep_get_and_clear_full(struct mm_struct *mm, > > static inline void ptep_set_wrprotect(struct mm_struct *mm, > > unsigned long addr, pte_t > > *ptep) > > { > > + pte_t pte; > > + > > clear_bit(_PAGE_BIT_RW, (unsigned long *)&ptep->pte); > > + pte = *ptep; > > + > > + /* > > + * Some processors can start a write, but ending up seeing > > + * a read-only PTE by the time they get to the Dirty bit. > > + * In this case, they will set the Dirty bit, leaving a > > + * read-only, Dirty PTE which looks like a Shadow Stack > > PTE. > > + * > > + * However, this behavior has been improved and will not > > occur > > + * on processors supporting Shadow Stacks. Without this > > + * guarantee, a transition to a non-present PTE and flush > > the > > + * TLB would be needed. > > + * > > + * When change a writable PTE to read-only and if the PTE > > has > > + * _PAGE_DIRTY_HW set, we move that bit to _PAGE_DIRTY_SW > > so > > + * that the PTE is not a valid Shadow Stack PTE. > > + */ > > + pte = pte_move_flags(pte, _PAGE_DIRTY_HW, _PAGE_DIRTY_SW); > > + set_pte_at(mm, addr, ptep, pte); > > } > I don't understand why it's okay that you first atomically clear the > RW bit, then atomically switch from DIRTY_HW to DIRTY_SW. Doesn't > that > mean that between the two atomic writes, another core can > incorrectly > see a shadow stack? Yes, we had that concern earlier and checked. On processors supporting Shadow Stacks, that will not happen. Yu-cheng
Powered by blists - more mailing lists