linux-kernel - Re: [RFC PATCH] KVM: arm64: Add prejudgement for relaxing permissions only case in stage2 translation fault handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201211100026.GA11352@willie-the-truck>
Date:   Fri, 11 Dec 2020 10:00:27 +0000
From:   Will Deacon <will@...nel.org>
To:     Marc Zyngier <maz@...nel.org>
Cc:     Yanan Wang <wangyanan55@...wei.com>, linux-kernel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        Catalin Marinas <catalin.marinas@....com>,
        James Morse <james.morse@....com>,
        Julien Thierry <julien.thierry.kdev@...il.com>,
        Suzuki K Poulose <suzuki.poulose@....com>,
        Gavin Shan <gshan@...hat.com>,
        Quentin Perret <qperret@...gle.com>,
        wanghaibin.wang@...wei.com, yezengruan@...wei.com,
        zhukeqian1@...wei.com, yuzenghui@...wei.com,
        jiangkunkun@...wei.com, wangjingyi11@...wei.com,
        lushenming@...wei.com
Subject: Re: [RFC PATCH] KVM: arm64: Add prejudgement for relaxing
 permissions only case in stage2 translation fault handler

On Fri, Dec 11, 2020 at 09:49:28AM +0000, Marc Zyngier wrote:
> On 2020-12-11 08:01, Yanan Wang wrote:
> > @@ -461,25 +462,56 @@ static int stage2_map_set_prot_attr(enum
> > kvm_pgtable_prot prot,
> >  	return 0;
> >  }
> > 
> > +static bool stage2_set_valid_leaf_pte_pre(u64 addr, u32 level,
> > +					  kvm_pte_t *ptep, kvm_pte_t new,
> > +					  struct stage2_map_data *data)
> > +{
> > +	kvm_pte_t old = *ptep, old_attr, new_attr;
> > +
> > +	if ((old ^ new) & (~KVM_PTE_LEAF_ATTR_PERMS))
> > +		return false;
> > +
> > +	/*
> > +	 * Skip updating if we are trying to recreate exactly the same mapping
> > +	 * or to reduce the access permissions only. And update the valid leaf
> > +	 * PTE without break-before-make if we are trying to add more access
> > +	 * permissions only.
> > +	 */
> > +	old_attr = (old & KVM_PTE_LEAF_ATTR_PERMS) ^
> > KVM_PTE_LEAF_ATTR_HI_S2_XN;
> > +	new_attr = (new & KVM_PTE_LEAF_ATTR_PERMS) ^
> > KVM_PTE_LEAF_ATTR_HI_S2_XN;
> > +	if (new_attr <= old_attr)
> > +		return true;
> > +
> > +	WRITE_ONCE(*ptep, new);
> > +	kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, data->mmu, addr, level);
> 
> I think what bothers me the most here is that we are turning a mapping into
> a permission update, which makes the code really hard to read, and mixes
> two things that were so far separate.
> 
> I wonder whether we should instead abort the update and simply take the
> fault
> again, if we ever need to do it.

That's a nice idea. If we could enforce that we don't alter permissions on
the map path, and instead just return e.g. -EAGAIN then that would be a
very neat solution and would cement the permission vs translation fault
division.

Will