License cleanup: add SPDX GPL-2.0 license identifier to files with no license
Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.
By default all files without license information are under the default
license of the kernel, which is GPL version 2.
Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier. The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.
This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.
How this work was done:
Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
- file had no licensing information it it.
- file was a */uapi/* one with no licensing information in it,
- file was a */uapi/* one with existing licensing information,
Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.
The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne. Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.
The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed. Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.
Criteria used to select files for SPDX license identifier tagging was:
- Files considered eligible had to be source code files.
- Make and config files were included as candidates if they contained >5
lines of source
- File already had some variant of a license header in it (even if <5
lines).
All documentation files were explicitly excluded.
The following heuristics were used to determine which SPDX license
identifiers to apply.
- when both scanners couldn't find any license traces, file was
considered to have no license information in it, and the top level
COPYING file license applied.
For non */uapi/* files that summary was:
SPDX license identifier # files
---------------------------------------------------|-------
GPL-2.0 11139
and resulted in the first patch in this series.
If that file was a */uapi/* path one, it was "GPL-2.0 WITH
Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was:
SPDX license identifier # files
---------------------------------------------------|-------
GPL-2.0 WITH Linux-syscall-note 930
and resulted in the second patch in this series.
- if a file had some form of licensing information in it, and was one
of the */uapi/* ones, it was denoted with the Linux-syscall-note if
any GPL family license was found in the file or had no licensing in
it (per prior point). Results summary:
SPDX license identifier # files
---------------------------------------------------|------
GPL-2.0 WITH Linux-syscall-note 270
GPL-2.0+ WITH Linux-syscall-note 169
((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21
((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17
LGPL-2.1+ WITH Linux-syscall-note 15
GPL-1.0+ WITH Linux-syscall-note 14
((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5
LGPL-2.0+ WITH Linux-syscall-note 4
LGPL-2.1 WITH Linux-syscall-note 3
((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3
((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1
and that resulted in the third patch in this series.
- when the two scanners agreed on the detected license(s), that became
the concluded license(s).
- when there was disagreement between the two scanners (one detected a
license but the other didn't, or they both detected different
licenses) a manual inspection of the file occurred.
- In most cases a manual inspection of the information in the file
resulted in a clear resolution of the license that should apply (and
which scanner probably needed to revisit its heuristics).
- When it was not immediately clear, the license identifier was
confirmed with lawyers working with the Linux Foundation.
- If there was any question as to the appropriate license identifier,
the file was flagged for further research and to be revisited later
in time.
In total, over 70 hours of logged manual review was done on the
spreadsheet to determine the SPDX license identifiers to apply to the
source files by Kate, Philippe, Thomas and, in some cases, confirmation
by lawyers working with the Linux Foundation.
Kate also obtained a third independent scan of the 4.13 code base from
FOSSology, and compared selected files where the other two scanners
disagreed against that SPDX file, to see if there was new insights. The
Windriver scanner is based on an older version of FOSSology in part, so
they are related.
Thomas did random spot checks in about 500 files from the spreadsheets
for the uapi headers and agreed with SPDX license identifier in the
files he inspected. For the non-uapi files Thomas did random spot checks
in about 15000 files.
In initial set of patches against 4.14-rc6, 3 files were found to have
copy/paste license identifier errors, and have been fixed to reflect the
correct identifier.
Additionally Philippe spent 10 hours this week doing a detailed manual
inspection and review of the 12,461 patched files from the initial patch
version early this week with:
- a full scancode scan run, collecting the matched texts, detected
license ids and scores
- reviewing anything where there was a license detected (about 500+
files) to ensure that the applied SPDX license was correct
- reviewing anything where there was no detection but the patch license
was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
SPDX license was correct
This produced a worksheet with 20 files needing minor correction. This
worksheet was then exported into 3 different .csv files for the
different types of files to be modified.
These .csv files were then reviewed by Greg. Thomas wrote a script to
parse the csv files and add the proper SPDX tag to the file, in the
format that the file expected. This script was further refined by Greg
based on the output to detect more types of files automatically and to
distinguish between header and source .c files (which need different
comment types.) Finally Greg ran the script using the .csv files to
generate the patches.
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-01 15:07:57 +01:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0 */
|
2008-10-22 22:26:29 -07:00
|
|
|
#ifndef _ASM_X86_PGTABLE_H
|
|
|
|
#define _ASM_X86_PGTABLE_H
|
2008-01-30 13:32:55 +01:00
|
|
|
|
2017-07-17 16:10:07 -05:00
|
|
|
#include <linux/mem_encrypt.h>
|
2009-02-09 11:57:45 +01:00
|
|
|
#include <asm/page.h>
|
2009-02-08 18:46:18 -08:00
|
|
|
#include <asm/pgtable_types.h>
|
2008-09-23 14:00:36 -07:00
|
|
|
|
2008-12-18 11:41:31 -08:00
|
|
|
/*
|
|
|
|
* Macro to mark a page protection value as UC-
|
|
|
|
*/
|
2014-11-03 14:01:53 +01:00
|
|
|
#define pgprot_noncached(prot) \
|
|
|
|
((boot_cpu_data.x86 > 3) \
|
|
|
|
? (__pgprot(pgprot_val(prot) | \
|
|
|
|
cachemode2protval(_PAGE_CACHE_MODE_UC_MINUS))) \
|
2008-12-18 11:41:31 -08:00
|
|
|
: (prot))
|
|
|
|
|
2008-01-30 13:32:56 +01:00
|
|
|
#ifndef __ASSEMBLY__
|
2021-11-02 17:52:24 +01:00
|
|
|
#include <linux/spinlock.h>
|
2009-11-23 15:12:07 -08:00
|
|
|
#include <asm/x86_init.h>
|
2021-06-23 14:02:05 +02:00
|
|
|
#include <asm/pkru.h>
|
2019-04-03 18:41:48 +02:00
|
|
|
#include <asm/fpu/api.h>
|
2022-02-22 21:57:40 +03:00
|
|
|
#include <asm/coco.h>
|
2020-04-06 20:05:33 -07:00
|
|
|
#include <asm-generic/pgtable_uffd.h>
|
2022-01-14 14:06:41 -08:00
|
|
|
#include <linux/page_table_check.h>
|
2009-11-23 15:12:07 -08:00
|
|
|
|
2017-07-17 16:10:11 -05:00
|
|
|
extern pgd_t early_top_pgt[PTRS_PER_PGD];
|
2020-09-07 15:15:36 +02:00
|
|
|
bool __init __early_make_pgtable(unsigned long address, pmdval_t pmd);
|
2017-07-17 16:10:11 -05:00
|
|
|
|
2023-05-16 21:57:29 +02:00
|
|
|
struct seq_file;
|
2020-02-03 17:36:11 -08:00
|
|
|
void ptdump_walk_pgd_level(struct seq_file *m, struct mm_struct *mm);
|
2020-02-03 17:36:16 -08:00
|
|
|
void ptdump_walk_pgd_level_debugfs(struct seq_file *m, struct mm_struct *mm,
|
|
|
|
bool user);
|
2024-01-30 11:34:35 +01:00
|
|
|
bool ptdump_walk_pgd_level_checkwx(void);
|
2024-01-30 11:34:33 +01:00
|
|
|
#define ptdump_check_wx ptdump_walk_pgd_level_checkwx
|
2018-08-08 13:16:40 +02:00
|
|
|
void ptdump_walk_user_pgd_level_checkwx(void);
|
2015-10-05 12:55:20 -04:00
|
|
|
|
2022-02-22 21:57:40 +03:00
|
|
|
/*
|
|
|
|
* Macros to add or remove encryption attribute
|
|
|
|
*/
|
|
|
|
#define pgprot_encrypted(prot) __pgprot(cc_mkenc(pgprot_val(prot)))
|
|
|
|
#define pgprot_decrypted(prot) __pgprot(cc_mkdec(pgprot_val(prot)))
|
|
|
|
|
2015-10-05 12:55:20 -04:00
|
|
|
#ifdef CONFIG_DEBUG_WX
|
2018-08-08 13:16:40 +02:00
|
|
|
#define debug_checkwx_user() ptdump_walk_user_pgd_level_checkwx()
|
2015-10-05 12:55:20 -04:00
|
|
|
#else
|
2018-08-08 13:16:40 +02:00
|
|
|
#define debug_checkwx_user() do { } while (0)
|
2015-10-05 12:55:20 -04:00
|
|
|
#endif
|
2014-01-18 12:48:14 +01:00
|
|
|
|
2008-01-30 13:32:58 +01:00
|
|
|
/*
|
|
|
|
* ZERO_PAGE is a global shared page that is always zero: used
|
|
|
|
* for zero-mapped memory areas etc..
|
|
|
|
*/
|
2013-08-05 15:02:43 -07:00
|
|
|
extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
|
|
|
|
__visible;
|
2019-04-29 09:51:29 -07:00
|
|
|
#define ZERO_PAGE(vaddr) ((void)(vaddr),virt_to_page(empty_zero_page))
|
2008-01-30 13:32:58 +01:00
|
|
|
|
2008-01-30 13:34:11 +01:00
|
|
|
extern spinlock_t pgd_lock;
|
|
|
|
extern struct list_head pgd_list;
|
2008-01-30 13:32:58 +01:00
|
|
|
|
2010-09-21 12:01:51 -07:00
|
|
|
extern struct mm_struct *pgd_page_get_mm(struct page *page);
|
|
|
|
|
2017-07-17 16:10:07 -05:00
|
|
|
extern pmdval_t early_pmd_flags;
|
|
|
|
|
2018-08-28 09:40:25 +02:00
|
|
|
#ifdef CONFIG_PARAVIRT_XXL
|
2009-02-11 10:20:05 -08:00
|
|
|
#include <asm/paravirt.h>
|
2018-08-28 09:40:25 +02:00
|
|
|
#else /* !CONFIG_PARAVIRT_XXL */
|
2009-02-11 10:20:05 -08:00
|
|
|
#define set_pte(ptep, pte) native_set_pte(ptep, pte)
|
|
|
|
|
|
|
|
#define set_pte_atomic(ptep, pte) \
|
|
|
|
native_set_pte_atomic(ptep, pte)
|
|
|
|
|
|
|
|
#define set_pmd(pmdp, pmd) native_set_pmd(pmdp, pmd)
|
|
|
|
|
2017-03-17 21:55:15 +03:00
|
|
|
#ifndef __PAGETABLE_P4D_FOLDED
|
2009-02-11 10:20:05 -08:00
|
|
|
#define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
|
2018-05-18 13:35:24 +03:00
|
|
|
#define pgd_clear(pgd) (pgtable_l5_enabled() ? native_pgd_clear(pgd) : 0)
|
2009-02-11 10:20:05 -08:00
|
|
|
#endif
|
|
|
|
|
2017-03-17 21:55:15 +03:00
|
|
|
#ifndef set_p4d
|
|
|
|
# define set_p4d(p4dp, p4d) native_set_p4d(p4dp, p4d)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifndef __PAGETABLE_PUD_FOLDED
|
|
|
|
#define p4d_clear(p4d) native_p4d_clear(p4d)
|
|
|
|
#endif
|
|
|
|
|
2009-02-11 10:20:05 -08:00
|
|
|
#ifndef set_pud
|
|
|
|
# define set_pud(pudp, pud) native_set_pud(pudp, pud)
|
|
|
|
#endif
|
|
|
|
|
2017-03-16 16:40:24 -07:00
|
|
|
#ifndef __PAGETABLE_PUD_FOLDED
|
2009-02-11 10:20:05 -08:00
|
|
|
#define pud_clear(pud) native_pud_clear(pud)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#define pte_clear(mm, addr, ptep) native_pte_clear(mm, addr, ptep)
|
|
|
|
#define pmd_clear(pmd) native_pmd_clear(pmd)
|
|
|
|
|
|
|
|
#define pgd_val(x) native_pgd_val(x)
|
|
|
|
#define __pgd(x) native_make_pgd(x)
|
|
|
|
|
2017-03-17 21:55:15 +03:00
|
|
|
#ifndef __PAGETABLE_P4D_FOLDED
|
|
|
|
#define p4d_val(x) native_p4d_val(x)
|
|
|
|
#define __p4d(x) native_make_p4d(x)
|
|
|
|
#endif
|
|
|
|
|
2009-02-11 10:20:05 -08:00
|
|
|
#ifndef __PAGETABLE_PUD_FOLDED
|
|
|
|
#define pud_val(x) native_pud_val(x)
|
|
|
|
#define __pud(x) native_make_pud(x)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifndef __PAGETABLE_PMD_FOLDED
|
|
|
|
#define pmd_val(x) native_pmd_val(x)
|
|
|
|
#define __pmd(x) native_make_pmd(x)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#define pte_val(x) native_pte_val(x)
|
|
|
|
#define __pte(x) native_make_pte(x)
|
|
|
|
|
2009-02-18 11:18:57 -08:00
|
|
|
#define arch_end_context_switch(prev) do {} while(0)
|
2018-08-28 09:40:23 +02:00
|
|
|
#endif /* CONFIG_PARAVIRT_XXL */
|
2009-02-11 10:20:05 -08:00
|
|
|
|
2008-01-30 13:32:56 +01:00
|
|
|
/*
|
|
|
|
* The following only work if pte_present() is true.
|
|
|
|
* Undefined behaviour if not..
|
|
|
|
*/
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
static inline bool pte_dirty(pte_t pte)
|
2008-03-23 01:03:12 -07:00
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
return pte_flags(pte) & _PAGE_DIRTY_BITS;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool pte_shstk(pte_t pte)
|
|
|
|
{
|
|
|
|
return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
|
|
|
|
(pte_flags(pte) & (_PAGE_RW | _PAGE_DIRTY)) == _PAGE_DIRTY;
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pte_young(pte_t pte)
|
|
|
|
{
|
2008-05-26 23:31:06 +01:00
|
|
|
return pte_flags(pte) & _PAGE_ACCESSED;
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
2023-12-27 14:12:04 +00:00
|
|
|
#define pmd_dirty pmd_dirty
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
static inline bool pmd_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_flags(pmd) & _PAGE_DIRTY_BITS;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool pmd_shstk(pmd_t pmd)
|
2014-12-10 15:44:36 -08:00
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
|
|
|
|
(pmd_flags(pmd) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
|
|
|
|
(_PAGE_DIRTY | _PAGE_PSE);
|
2014-12-10 15:44:36 -08:00
|
|
|
}
|
2008-03-23 01:03:12 -07:00
|
|
|
|
2022-11-30 14:49:41 -08:00
|
|
|
#define pmd_young pmd_young
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline int pmd_young(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_flags(pmd) & _PAGE_ACCESSED;
|
|
|
|
}
|
|
|
|
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
static inline bool pud_dirty(pud_t pud)
|
2017-02-24 14:57:02 -08:00
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
return pud_flags(pud) & _PAGE_DIRTY_BITS;
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pud_young(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_flags(pud) & _PAGE_ACCESSED;
|
|
|
|
}
|
|
|
|
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline int pte_write(pte_t pte)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
/*
|
|
|
|
* Shadow stack pages are logically writable, but do not have
|
|
|
|
* _PAGE_RW. Check for them separately from _PAGE_RW itself.
|
|
|
|
*/
|
|
|
|
return (pte_flags(pte) & _PAGE_RW) || pte_shstk(pte);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
2023-06-12 17:10:35 -07:00
|
|
|
#define pmd_write pmd_write
|
|
|
|
static inline int pmd_write(pmd_t pmd)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
/*
|
|
|
|
* Shadow stack pages are logically writable, but do not have
|
|
|
|
* _PAGE_RW. Check for them separately from _PAGE_RW itself.
|
|
|
|
*/
|
|
|
|
return (pmd_flags(pmd) & _PAGE_RW) || pmd_shstk(pmd);
|
2023-06-12 17:10:35 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
#define pud_write pud_write
|
|
|
|
static inline int pud_write(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_flags(pud) & _PAGE_RW;
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pte_huge(pte_t pte)
|
|
|
|
{
|
2008-05-26 23:31:06 +01:00
|
|
|
return pte_flags(pte) & _PAGE_PSE;
|
2008-01-30 13:32:56 +01:00
|
|
|
}
|
|
|
|
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline int pte_global(pte_t pte)
|
|
|
|
{
|
2008-05-26 23:31:06 +01:00
|
|
|
return pte_flags(pte) & _PAGE_GLOBAL;
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pte_exec(pte_t pte)
|
|
|
|
{
|
2008-05-26 23:31:06 +01:00
|
|
|
return !(pte_flags(pte) & _PAGE_NX);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
mm: introduce pte_special pte bit
s390 for one, cannot implement VM_MIXEDMAP with pfn_valid, due to their memory
model (which is more dynamic than most). Instead, they had proposed to
implement it with an additional path through vm_normal_page(), using a bit in
the pte to determine whether or not the page should be refcounted:
vm_normal_page()
{
...
if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
if (vma->vm_flags & VM_MIXEDMAP) {
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
#else
if (!pfn_valid(pfn))
return NULL;
#endif
goto out;
}
...
}
This is fine, however if we are allowed to use a bit in the pte to determine
refcountedness, we can use that to _completely_ replace all the vma based
schemes. So instead of adding more cases to the already complex vma-based
scheme, we can have a clearly seperate and simple pte-based scheme (and get
slightly better code generation in the process):
vm_normal_page()
{
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
return pte_page(pte);
#else
...
#endif
}
And finally, we may rather make this concept usable by any architecture rather
than making it s390 only, so implement a new type of pte state for this.
Unfortunately the old vma based code must stay, because some architectures may
not be able to spare pte bits. This makes vm_normal_page a little bit more
ugly than we would like, but the 2 cases are clearly seperate.
So introduce a pte_special pte state, and use it in mm/memory.c. It is
currently a noop for all architectures, so this doesn't actually result in any
compiled code changes to mm/memory.o.
BTW:
I haven't put vm_normal_page() into arch code as-per an earlier suggestion.
The reason is that, regardless of where vm_normal_page is actually
implemented, the *abstraction* is still exactly the same. Also, while it
depends on whether the architecture has pte_special or not, that is the
only two possible cases, and it really isn't an arch specific function --
the role of the arch code should be to provide primitive functions and
accessors with which to build the core code; pte_special does that. We do
not want architectures to know or care about vm_normal_page itself, and
we definitely don't want them being able to invent something new there
out of sight of mm/ code. If we made vm_normal_page an arch function, then
we have to make vm_insert_mixed (next patch) an arch function too. So I
don't think moving it to arch code fundamentally improves any abstractions,
while it does practically make the code more difficult to follow, for both
mm and arch developers, and easier to misuse.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Carsten Otte <cotte@de.ibm.com>
Cc: Jared Hulbert <jaredeh@gmail.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 02:13:00 -07:00
|
|
|
static inline int pte_special(pte_t pte)
|
|
|
|
{
|
2015-02-12 14:58:38 -08:00
|
|
|
return pte_flags(pte) & _PAGE_SPECIAL;
|
mm: introduce pte_special pte bit
s390 for one, cannot implement VM_MIXEDMAP with pfn_valid, due to their memory
model (which is more dynamic than most). Instead, they had proposed to
implement it with an additional path through vm_normal_page(), using a bit in
the pte to determine whether or not the page should be refcounted:
vm_normal_page()
{
...
if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
if (vma->vm_flags & VM_MIXEDMAP) {
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
#else
if (!pfn_valid(pfn))
return NULL;
#endif
goto out;
}
...
}
This is fine, however if we are allowed to use a bit in the pte to determine
refcountedness, we can use that to _completely_ replace all the vma based
schemes. So instead of adding more cases to the already complex vma-based
scheme, we can have a clearly seperate and simple pte-based scheme (and get
slightly better code generation in the process):
vm_normal_page()
{
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
return pte_page(pte);
#else
...
#endif
}
And finally, we may rather make this concept usable by any architecture rather
than making it s390 only, so implement a new type of pte state for this.
Unfortunately the old vma based code must stay, because some architectures may
not be able to spare pte bits. This makes vm_normal_page a little bit more
ugly than we would like, but the 2 cases are clearly seperate.
So introduce a pte_special pte state, and use it in mm/memory.c. It is
currently a noop for all architectures, so this doesn't actually result in any
compiled code changes to mm/memory.o.
BTW:
I haven't put vm_normal_page() into arch code as-per an earlier suggestion.
The reason is that, regardless of where vm_normal_page is actually
implemented, the *abstraction* is still exactly the same. Also, while it
depends on whether the architecture has pte_special or not, that is the
only two possible cases, and it really isn't an arch specific function --
the role of the arch code should be to provide primitive functions and
accessors with which to build the core code; pte_special does that. We do
not want architectures to know or care about vm_normal_page itself, and
we definitely don't want them being able to invent something new there
out of sight of mm/ code. If we made vm_normal_page an arch function, then
we have to make vm_insert_mixed (next patch) an arch function too. So I
don't think moving it to arch code fundamentally improves any abstractions,
while it does practically make the code more difficult to follow, for both
mm and arch developers, and easier to misuse.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Carsten Otte <cotte@de.ibm.com>
Cc: Jared Hulbert <jaredeh@gmail.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 02:13:00 -07:00
|
|
|
}
|
|
|
|
|
2018-06-13 15:48:24 -07:00
|
|
|
/* Entries that were set to PROT_NONE are inverted */
|
|
|
|
|
|
|
|
static inline u64 protnone_mask(u64 val);
|
|
|
|
|
2023-08-02 16:13:56 +01:00
|
|
|
#define PFN_PTE_SHIFT PAGE_SHIFT
|
|
|
|
|
2008-09-09 16:42:45 +01:00
|
|
|
static inline unsigned long pte_pfn(pte_t pte)
|
|
|
|
{
|
2018-06-27 17:46:50 +02:00
|
|
|
phys_addr_t pfn = pte_val(pte);
|
2018-06-13 15:48:24 -07:00
|
|
|
pfn ^= protnone_mask(pfn);
|
|
|
|
return (pfn & PTE_PFN_MASK) >> PAGE_SHIFT;
|
2008-09-09 16:42:45 +01:00
|
|
|
}
|
|
|
|
|
2009-06-27 15:35:15 +09:00
|
|
|
static inline unsigned long pmd_pfn(pmd_t pmd)
|
|
|
|
{
|
2018-06-27 17:46:50 +02:00
|
|
|
phys_addr_t pfn = pmd_val(pmd);
|
2018-06-13 15:48:24 -07:00
|
|
|
pfn ^= protnone_mask(pfn);
|
|
|
|
return (pfn & pmd_pfn_mask(pmd)) >> PAGE_SHIFT;
|
2009-06-27 15:35:15 +09:00
|
|
|
}
|
|
|
|
|
2024-03-27 11:23:24 -04:00
|
|
|
#define pud_pfn pud_pfn
|
2013-02-11 14:52:36 +00:00
|
|
|
static inline unsigned long pud_pfn(pud_t pud)
|
|
|
|
{
|
2018-06-27 17:46:50 +02:00
|
|
|
phys_addr_t pfn = pud_val(pud);
|
2018-06-13 15:48:24 -07:00
|
|
|
pfn ^= protnone_mask(pfn);
|
|
|
|
return (pfn & pud_pfn_mask(pud)) >> PAGE_SHIFT;
|
2013-02-11 14:52:36 +00:00
|
|
|
}
|
|
|
|
|
2017-03-13 17:33:04 +03:00
|
|
|
static inline unsigned long p4d_pfn(p4d_t p4d)
|
|
|
|
{
|
|
|
|
return (p4d_val(p4d) & p4d_pfn_mask(p4d)) >> PAGE_SHIFT;
|
|
|
|
}
|
|
|
|
|
2017-07-17 16:10:06 -05:00
|
|
|
static inline unsigned long pgd_pfn(pgd_t pgd)
|
|
|
|
{
|
|
|
|
return (pgd_val(pgd) & PTE_PFN_MASK) >> PAGE_SHIFT;
|
|
|
|
}
|
|
|
|
|
2024-03-05 12:37:49 +08:00
|
|
|
#define p4d_leaf p4d_leaf
|
2024-03-05 12:37:50 +08:00
|
|
|
static inline bool p4d_leaf(p4d_t p4d)
|
2017-03-13 17:33:04 +03:00
|
|
|
{
|
|
|
|
/* No 512 GiB pages yet */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-09-09 16:42:45 +01:00
|
|
|
#define pte_page(pte) pfn_to_page(pte_pfn(pte))
|
|
|
|
|
2024-03-05 12:37:49 +08:00
|
|
|
#define pmd_leaf pmd_leaf
|
2024-03-05 12:37:50 +08:00
|
|
|
static inline bool pmd_leaf(pmd_t pte)
|
2008-03-23 01:03:12 -07:00
|
|
|
{
|
2012-10-08 16:33:27 -07:00
|
|
|
return pmd_flags(pte) & _PAGE_PSE;
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
|
2024-03-05 12:37:49 +08:00
|
|
|
/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_leaf */
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline int pmd_trans_huge(pmd_t pmd)
|
|
|
|
{
|
2016-01-15 16:56:52 -08:00
|
|
|
return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE;
|
2011-01-13 15:47:01 -08:00
|
|
|
}
|
2011-01-13 15:47:09 -08:00
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
|
|
|
|
static inline int pud_trans_huge(pud_t pud)
|
|
|
|
{
|
|
|
|
return (pud_val(pud) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
arch: fix has_transparent_hugepage()
I've just discovered that the useful-sounding has_transparent_hugepage()
is actually an architecture-dependent minefield: on some arches it only
builds if CONFIG_TRANSPARENT_HUGEPAGE=y, on others it's also there when
not, but on some of those (arm and arm64) it then gives the wrong
answer; and on mips alone it's marked __init, which would crash if
called later (but so far it has not been called later).
Straighten this out: make it available to all configs, with a sensible
default in asm-generic/pgtable.h, removing its definitions from those
arches (arc, arm, arm64, sparc, tile) which are served by the default,
adding #define has_transparent_hugepage has_transparent_hugepage to
those (mips, powerpc, s390, x86) which need to override the default at
runtime, and removing the __init from mips (but maybe that kind of code
should be avoided after init: set a static variable the first time it's
called).
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andres Lagar-Cavilla <andreslc@google.com>
Cc: Yang Shi <yang.shi@linaro.org>
Cc: Ning Qu <quning@gmail.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Vineet Gupta <vgupta@synopsys.com> [arch/arc]
Acked-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> [arch/s390]
Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-05-19 17:13:00 -07:00
|
|
|
#define has_transparent_hugepage has_transparent_hugepage
|
2011-01-13 15:47:09 -08:00
|
|
|
static inline int has_transparent_hugepage(void)
|
|
|
|
{
|
2016-03-29 17:42:03 +02:00
|
|
|
return boot_cpu_has(X86_FEATURE_PSE);
|
2011-01-13 15:47:09 -08:00
|
|
|
}
|
2016-01-15 16:56:52 -08:00
|
|
|
|
2019-07-16 16:30:47 -07:00
|
|
|
#ifdef CONFIG_ARCH_HAS_PTE_DEVMAP
|
2016-01-15 16:56:52 -08:00
|
|
|
static inline int pmd_devmap(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return !!(pmd_val(pmd) & _PAGE_DEVMAP);
|
|
|
|
}
|
2017-02-24 14:57:02 -08:00
|
|
|
|
|
|
|
#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
|
|
|
|
static inline int pud_devmap(pud_t pud)
|
|
|
|
{
|
|
|
|
return !!(pud_val(pud) & _PAGE_DEVMAP);
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static inline int pud_devmap(pud_t pud)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif
|
2017-06-06 14:31:20 +03:00
|
|
|
|
|
|
|
static inline int pgd_devmap(pgd_t pgd)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
2016-01-15 16:56:52 -08:00
|
|
|
#endif
|
2011-01-13 15:47:01 -08:00
|
|
|
#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
|
|
|
|
|
2009-01-22 14:24:22 -08:00
|
|
|
static inline pte_t pte_set_flags(pte_t pte, pteval_t set)
|
|
|
|
{
|
|
|
|
pteval_t v = native_pte_val(pte);
|
|
|
|
|
|
|
|
return native_make_pte(v | set);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_clear_flags(pte_t pte, pteval_t clear)
|
|
|
|
{
|
|
|
|
pteval_t v = native_pte_val(pte);
|
|
|
|
|
|
|
|
return native_make_pte(v & ~clear);
|
|
|
|
}
|
|
|
|
|
x86/mm: Introduce _PAGE_SAVED_DIRTY
Some OSes have a greater dependence on software available bits in PTEs than
Linux. That left the hardware architects looking for a way to represent a
new memory type (shadow stack) within the existing bits. They chose to
repurpose a lightly-used state: Write=0,Dirty=1. So in order to support
shadow stack memory, Linux should avoid creating memory with this PTE bit
combination unless it intends for it to be shadow stack.
The reason it's lightly used is that Dirty=1 is normally set by HW
_before_ a write. A write with a Write=0 PTE would typically only generate
a fault, not set Dirty=1. Hardware can (rarely) both set Dirty=1 *and*
generate the fault, resulting in a Write=0,Dirty=1 PTE. Hardware which
supports shadow stacks will no longer exhibit this oddity.
So that leaves Write=0,Dirty=1 PTEs created in software. To avoid
inadvertently created shadow stack memory, in places where Linux normally
creates Write=0,Dirty=1, it can use the software-defined _PAGE_SAVED_DIRTY
in place of the hardware _PAGE_DIRTY. In other words, whenever Linux needs
to create Write=0,Dirty=1, it instead creates Write=0,SavedDirty=1 except
for shadow stack, which is Write=0,Dirty=1.
There are six bits left available to software in the 64-bit PTE after
consuming a bit for _PAGE_SAVED_DIRTY. For 32 bit, the same bit as
_PAGE_BIT_UFFD_WP is used, since user fault fd is not supported on 32
bit. This leaves one unused software bit on 32 bit (_PAGE_BIT_SOFT_DIRTY,
as this is also not supported on 32 bit).
Implement only the infrastructure for _PAGE_SAVED_DIRTY. Changes to
actually begin creating _PAGE_SAVED_DIRTY PTEs will follow once other
pieces are in place.
Since this SavedDirty shifting is done for all x86 CPUs, this leaves
the possibility for the hardware oddity to still create Write=0,Dirty=1
PTEs in rare cases. Since these CPUs also don't support shadow stack, this
will be harmless as it was before the introduction of SavedDirty.
Implement the shifting logic to be branchless. Embed the logic of whether
to do the shifting (including checking the Write bits) so that it can be
called by future callers that would otherwise need additional branching
logic. This efficiency allows the logic of when to do the shifting to be
centralized, making the code easier to reason about.
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-11-rick.p.edgecombe%40intel.com
2023-06-12 17:10:36 -07:00
|
|
|
/*
|
|
|
|
* Write protection operations can result in Dirty=1,Write=0 PTEs. But in the
|
|
|
|
* case of X86_FEATURE_USER_SHSTK, these PTEs denote shadow stack memory. So
|
|
|
|
* when creating dirty, write-protected memory, a software bit is used:
|
|
|
|
* _PAGE_BIT_SAVED_DIRTY. The following functions take a PTE and transition the
|
|
|
|
* Dirty bit to SavedDirty, and vice-vesra.
|
|
|
|
*
|
|
|
|
* This shifting is only done if needed. In the case of shifting
|
|
|
|
* Dirty->SavedDirty, the condition is if the PTE is Write=0. In the case of
|
|
|
|
* shifting SavedDirty->Dirty, the condition is Write=1.
|
|
|
|
*/
|
|
|
|
static inline pgprotval_t mksaveddirty_shift(pgprotval_t v)
|
|
|
|
{
|
|
|
|
pgprotval_t cond = (~v >> _PAGE_BIT_RW) & 1;
|
|
|
|
|
|
|
|
v |= ((v >> _PAGE_BIT_DIRTY) & cond) << _PAGE_BIT_SAVED_DIRTY;
|
|
|
|
v &= ~(cond << _PAGE_BIT_DIRTY);
|
|
|
|
|
|
|
|
return v;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pgprotval_t clear_saveddirty_shift(pgprotval_t v)
|
|
|
|
{
|
|
|
|
pgprotval_t cond = (v >> _PAGE_BIT_RW) & 1;
|
|
|
|
|
|
|
|
v |= ((v >> _PAGE_BIT_SAVED_DIRTY) & cond) << _PAGE_BIT_DIRTY;
|
|
|
|
v &= ~(cond << _PAGE_BIT_SAVED_DIRTY);
|
|
|
|
|
|
|
|
return v;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mksaveddirty(pte_t pte)
|
|
|
|
{
|
|
|
|
pteval_t v = native_pte_val(pte);
|
|
|
|
|
|
|
|
v = mksaveddirty_shift(v);
|
|
|
|
return native_make_pte(v);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_clear_saveddirty(pte_t pte)
|
|
|
|
{
|
|
|
|
pteval_t v = native_pte_val(pte);
|
|
|
|
|
|
|
|
v = clear_saveddirty_shift(v);
|
|
|
|
return native_make_pte(v);
|
|
|
|
}
|
|
|
|
|
2022-12-14 15:15:33 -05:00
|
|
|
static inline pte_t pte_wrprotect(pte_t pte)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pte = pte_clear_flags(pte, _PAGE_RW);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Blindly clearing _PAGE_RW might accidentally create
|
|
|
|
* a shadow stack PTE (Write=0,Dirty=1). Move the hardware
|
|
|
|
* dirty value to the software bit, if present.
|
|
|
|
*/
|
|
|
|
return pte_mksaveddirty(pte);
|
2022-12-14 15:15:33 -05:00
|
|
|
}
|
|
|
|
|
2020-04-06 20:05:33 -07:00
|
|
|
#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP
|
|
|
|
static inline int pte_uffd_wp(pte_t pte)
|
|
|
|
{
|
mm/page_table_check: support userfault wr-protect entries
Allow page_table_check hooks to check over userfaultfd wr-protect criteria
upon pgtable updates. The rule is no co-existance allowed for any
writable flag against userfault wr-protect flag.
This should be better than c2da319c2e, where we used to only sanitize such
issues during a pgtable walk, but when hitting such issue we don't have a
good chance to know where does that writable bit came from [1], so that
even the pgtable walk exposes a kernel bug (which is still helpful on
triaging) but not easy to track and debug.
Now we switch to track the source. It's much easier too with the recent
introduction of page table check.
There are some limitations with using the page table check here for
userfaultfd wr-protect purpose:
- It is only enabled with explicit enablement of page table check configs
and/or boot parameters, but should be good enough to track at least
syzbot issues, as syzbot should enable PAGE_TABLE_CHECK[_ENFORCED] for
x86 [1]. We used to have DEBUG_VM but it's now off for most distros,
while distros also normally not enable PAGE_TABLE_CHECK[_ENFORCED], which
is similar.
- It conditionally works with the ptep_modify_prot API. It will be
bypassed when e.g. XEN PV is enabled, however still work for most of the
rest scenarios, which should be the common cases so should be good
enough.
- Hugetlb check is a bit hairy, as the page table check cannot identify
hugetlb pte or normal pte via trapping at set_pte_at(), because of the
current design where hugetlb maps every layers to pte_t... For example,
the default set_huge_pte_at() can invoke set_pte_at() directly and lose
the hugetlb context, treating it the same as a normal pte_t. So far it's
fine because we have huge_pte_uffd_wp() always equals to pte_uffd_wp() as
long as supported (x86 only). It'll be a bigger problem when we'll
define _PAGE_UFFD_WP differently at various pgtable levels, because then
one huge_pte_uffd_wp() per-arch will stop making sense first.. as of now
we can leave this for later too.
This patch also removes commit c2da319c2e altogether, as we have something
better now.
[1] https://lore.kernel.org/all/000000000000dce0530615c89210@google.com/
Link: https://lkml.kernel.org/r/20240417212549.2766883-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-04-17 17:25:49 -04:00
|
|
|
return pte_flags(pte) & _PAGE_UFFD_WP;
|
2020-04-06 20:05:33 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkuffd_wp(pte_t pte)
|
|
|
|
{
|
2022-12-14 15:15:33 -05:00
|
|
|
return pte_wrprotect(pte_set_flags(pte, _PAGE_UFFD_WP));
|
2020-04-06 20:05:33 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_clear_uffd_wp(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_clear_flags(pte, _PAGE_UFFD_WP);
|
|
|
|
}
|
|
|
|
#endif /* CONFIG_HAVE_ARCH_USERFAULTFD_WP */
|
|
|
|
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline pte_t pte_mkclean(pte_t pte)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
return pte_clear_flags(pte, _PAGE_DIRTY_BITS);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkold(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_clear_flags(pte, _PAGE_ACCESSED);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkexec(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_clear_flags(pte, _PAGE_NX);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkdirty(pte_t pte)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pte = pte_set_flags(pte, _PAGE_DIRTY | _PAGE_SOFT_DIRTY);
|
|
|
|
|
|
|
|
return pte_mksaveddirty(pte);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkwrite_shstk(pte_t pte)
|
|
|
|
{
|
|
|
|
pte = pte_clear_flags(pte, _PAGE_RW);
|
|
|
|
|
|
|
|
return pte_set_flags(pte, _PAGE_DIRTY);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkyoung(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_set_flags(pte, _PAGE_ACCESSED);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
2023-06-12 17:10:27 -07:00
|
|
|
static inline pte_t pte_mkwrite_novma(pte_t pte)
|
2008-03-23 01:03:12 -07:00
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_set_flags(pte, _PAGE_RW);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
struct vm_area_struct;
|
|
|
|
pte_t pte_mkwrite(pte_t pte, struct vm_area_struct *vma);
|
|
|
|
#define pte_mkwrite pte_mkwrite
|
|
|
|
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline pte_t pte_mkhuge(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_set_flags(pte, _PAGE_PSE);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_clrhuge(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_clear_flags(pte, _PAGE_PSE);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_mkglobal(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_set_flags(pte, _PAGE_GLOBAL);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_clrglobal(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_clear_flags(pte, _PAGE_GLOBAL);
|
2008-03-23 01:03:12 -07:00
|
|
|
}
|
2008-01-30 13:32:56 +01:00
|
|
|
|
mm: introduce pte_special pte bit
s390 for one, cannot implement VM_MIXEDMAP with pfn_valid, due to their memory
model (which is more dynamic than most). Instead, they had proposed to
implement it with an additional path through vm_normal_page(), using a bit in
the pte to determine whether or not the page should be refcounted:
vm_normal_page()
{
...
if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
if (vma->vm_flags & VM_MIXEDMAP) {
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
#else
if (!pfn_valid(pfn))
return NULL;
#endif
goto out;
}
...
}
This is fine, however if we are allowed to use a bit in the pte to determine
refcountedness, we can use that to _completely_ replace all the vma based
schemes. So instead of adding more cases to the already complex vma-based
scheme, we can have a clearly seperate and simple pte-based scheme (and get
slightly better code generation in the process):
vm_normal_page()
{
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
return pte_page(pte);
#else
...
#endif
}
And finally, we may rather make this concept usable by any architecture rather
than making it s390 only, so implement a new type of pte state for this.
Unfortunately the old vma based code must stay, because some architectures may
not be able to spare pte bits. This makes vm_normal_page a little bit more
ugly than we would like, but the 2 cases are clearly seperate.
So introduce a pte_special pte state, and use it in mm/memory.c. It is
currently a noop for all architectures, so this doesn't actually result in any
compiled code changes to mm/memory.o.
BTW:
I haven't put vm_normal_page() into arch code as-per an earlier suggestion.
The reason is that, regardless of where vm_normal_page is actually
implemented, the *abstraction* is still exactly the same. Also, while it
depends on whether the architecture has pte_special or not, that is the
only two possible cases, and it really isn't an arch specific function --
the role of the arch code should be to provide primitive functions and
accessors with which to build the core code; pte_special does that. We do
not want architectures to know or care about vm_normal_page itself, and
we definitely don't want them being able to invent something new there
out of sight of mm/ code. If we made vm_normal_page an arch function, then
we have to make vm_insert_mixed (next patch) an arch function too. So I
don't think moving it to arch code fundamentally improves any abstractions,
while it does practically make the code more difficult to follow, for both
mm and arch developers, and easier to misuse.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Carsten Otte <cotte@de.ibm.com>
Cc: Jared Hulbert <jaredeh@gmail.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 02:13:00 -07:00
|
|
|
static inline pte_t pte_mkspecial(pte_t pte)
|
|
|
|
{
|
2009-01-22 14:24:22 -08:00
|
|
|
return pte_set_flags(pte, _PAGE_SPECIAL);
|
mm: introduce pte_special pte bit
s390 for one, cannot implement VM_MIXEDMAP with pfn_valid, due to their memory
model (which is more dynamic than most). Instead, they had proposed to
implement it with an additional path through vm_normal_page(), using a bit in
the pte to determine whether or not the page should be refcounted:
vm_normal_page()
{
...
if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
if (vma->vm_flags & VM_MIXEDMAP) {
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
#else
if (!pfn_valid(pfn))
return NULL;
#endif
goto out;
}
...
}
This is fine, however if we are allowed to use a bit in the pte to determine
refcountedness, we can use that to _completely_ replace all the vma based
schemes. So instead of adding more cases to the already complex vma-based
scheme, we can have a clearly seperate and simple pte-based scheme (and get
slightly better code generation in the process):
vm_normal_page()
{
#ifdef s390
if (!mixedmap_refcount_pte(pte))
return NULL;
return pte_page(pte);
#else
...
#endif
}
And finally, we may rather make this concept usable by any architecture rather
than making it s390 only, so implement a new type of pte state for this.
Unfortunately the old vma based code must stay, because some architectures may
not be able to spare pte bits. This makes vm_normal_page a little bit more
ugly than we would like, but the 2 cases are clearly seperate.
So introduce a pte_special pte state, and use it in mm/memory.c. It is
currently a noop for all architectures, so this doesn't actually result in any
compiled code changes to mm/memory.o.
BTW:
I haven't put vm_normal_page() into arch code as-per an earlier suggestion.
The reason is that, regardless of where vm_normal_page is actually
implemented, the *abstraction* is still exactly the same. Also, while it
depends on whether the architecture has pte_special or not, that is the
only two possible cases, and it really isn't an arch specific function --
the role of the arch code should be to provide primitive functions and
accessors with which to build the core code; pte_special does that. We do
not want architectures to know or care about vm_normal_page itself, and
we definitely don't want them being able to invent something new there
out of sight of mm/ code. If we made vm_normal_page an arch function, then
we have to make vm_insert_mixed (next patch) an arch function too. So I
don't think moving it to arch code fundamentally improves any abstractions,
while it does practically make the code more difficult to follow, for both
mm and arch developers, and easier to misuse.
[akpm@linux-foundation.org: build fix]
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Carsten Otte <cotte@de.ibm.com>
Cc: Jared Hulbert <jaredeh@gmail.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 02:13:00 -07:00
|
|
|
}
|
|
|
|
|
2016-01-15 16:56:40 -08:00
|
|
|
static inline pte_t pte_mkdevmap(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_set_flags(pte, _PAGE_SPECIAL|_PAGE_DEVMAP);
|
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline pmd_t pmd_set_flags(pmd_t pmd, pmdval_t set)
|
|
|
|
{
|
|
|
|
pmdval_t v = native_pmd_val(pmd);
|
|
|
|
|
2018-02-19 07:48:11 -07:00
|
|
|
return native_make_pmd(v | set);
|
2011-01-13 15:47:01 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_clear_flags(pmd_t pmd, pmdval_t clear)
|
|
|
|
{
|
|
|
|
pmdval_t v = native_pmd_val(pmd);
|
|
|
|
|
2018-02-19 07:48:11 -07:00
|
|
|
return native_make_pmd(v & ~clear);
|
2011-01-13 15:47:01 -08:00
|
|
|
}
|
|
|
|
|
x86/mm: Introduce _PAGE_SAVED_DIRTY
Some OSes have a greater dependence on software available bits in PTEs than
Linux. That left the hardware architects looking for a way to represent a
new memory type (shadow stack) within the existing bits. They chose to
repurpose a lightly-used state: Write=0,Dirty=1. So in order to support
shadow stack memory, Linux should avoid creating memory with this PTE bit
combination unless it intends for it to be shadow stack.
The reason it's lightly used is that Dirty=1 is normally set by HW
_before_ a write. A write with a Write=0 PTE would typically only generate
a fault, not set Dirty=1. Hardware can (rarely) both set Dirty=1 *and*
generate the fault, resulting in a Write=0,Dirty=1 PTE. Hardware which
supports shadow stacks will no longer exhibit this oddity.
So that leaves Write=0,Dirty=1 PTEs created in software. To avoid
inadvertently created shadow stack memory, in places where Linux normally
creates Write=0,Dirty=1, it can use the software-defined _PAGE_SAVED_DIRTY
in place of the hardware _PAGE_DIRTY. In other words, whenever Linux needs
to create Write=0,Dirty=1, it instead creates Write=0,SavedDirty=1 except
for shadow stack, which is Write=0,Dirty=1.
There are six bits left available to software in the 64-bit PTE after
consuming a bit for _PAGE_SAVED_DIRTY. For 32 bit, the same bit as
_PAGE_BIT_UFFD_WP is used, since user fault fd is not supported on 32
bit. This leaves one unused software bit on 32 bit (_PAGE_BIT_SOFT_DIRTY,
as this is also not supported on 32 bit).
Implement only the infrastructure for _PAGE_SAVED_DIRTY. Changes to
actually begin creating _PAGE_SAVED_DIRTY PTEs will follow once other
pieces are in place.
Since this SavedDirty shifting is done for all x86 CPUs, this leaves
the possibility for the hardware oddity to still create Write=0,Dirty=1
PTEs in rare cases. Since these CPUs also don't support shadow stack, this
will be harmless as it was before the introduction of SavedDirty.
Implement the shifting logic to be branchless. Embed the logic of whether
to do the shifting (including checking the Write bits) so that it can be
called by future callers that would otherwise need additional branching
logic. This efficiency allows the logic of when to do the shifting to be
centralized, making the code easier to reason about.
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-11-rick.p.edgecombe%40intel.com
2023-06-12 17:10:36 -07:00
|
|
|
/* See comments above mksaveddirty_shift() */
|
|
|
|
static inline pmd_t pmd_mksaveddirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
pmdval_t v = native_pmd_val(pmd);
|
|
|
|
|
|
|
|
v = mksaveddirty_shift(v);
|
|
|
|
return native_make_pmd(v);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* See comments above mksaveddirty_shift() */
|
|
|
|
static inline pmd_t pmd_clear_saveddirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
pmdval_t v = native_pmd_val(pmd);
|
|
|
|
|
|
|
|
v = clear_saveddirty_shift(v);
|
|
|
|
return native_make_pmd(v);
|
|
|
|
}
|
|
|
|
|
2022-12-14 15:15:33 -05:00
|
|
|
static inline pmd_t pmd_wrprotect(pmd_t pmd)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pmd = pmd_clear_flags(pmd, _PAGE_RW);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Blindly clearing _PAGE_RW might accidentally create
|
|
|
|
* a shadow stack PMD (RW=0, Dirty=1). Move the hardware
|
|
|
|
* dirty value to the software bit.
|
|
|
|
*/
|
|
|
|
return pmd_mksaveddirty(pmd);
|
2022-12-14 15:15:33 -05:00
|
|
|
}
|
|
|
|
|
2020-04-06 20:05:33 -07:00
|
|
|
#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP
|
|
|
|
static inline int pmd_uffd_wp(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_flags(pmd) & _PAGE_UFFD_WP;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_mkuffd_wp(pmd_t pmd)
|
|
|
|
{
|
2022-12-14 15:15:33 -05:00
|
|
|
return pmd_wrprotect(pmd_set_flags(pmd, _PAGE_UFFD_WP));
|
2020-04-06 20:05:33 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_clear_uffd_wp(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_clear_flags(pmd, _PAGE_UFFD_WP);
|
|
|
|
}
|
|
|
|
#endif /* CONFIG_HAVE_ARCH_USERFAULTFD_WP */
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline pmd_t pmd_mkold(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_clear_flags(pmd, _PAGE_ACCESSED);
|
|
|
|
}
|
|
|
|
|
2016-01-15 16:55:20 -08:00
|
|
|
static inline pmd_t pmd_mkclean(pmd_t pmd)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
return pmd_clear_flags(pmd, _PAGE_DIRTY_BITS);
|
2016-01-15 16:55:20 -08:00
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline pmd_t pmd_mkdirty(pmd_t pmd)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pmd = pmd_set_flags(pmd, _PAGE_DIRTY | _PAGE_SOFT_DIRTY);
|
|
|
|
|
|
|
|
return pmd_mksaveddirty(pmd);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_mkwrite_shstk(pmd_t pmd)
|
|
|
|
{
|
|
|
|
pmd = pmd_clear_flags(pmd, _PAGE_RW);
|
|
|
|
|
|
|
|
return pmd_set_flags(pmd, _PAGE_DIRTY);
|
2011-01-13 15:47:01 -08:00
|
|
|
}
|
|
|
|
|
2016-01-15 16:56:43 -08:00
|
|
|
static inline pmd_t pmd_mkdevmap(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_DEVMAP);
|
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline pmd_t pmd_mkhuge(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_PSE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_mkyoung(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_ACCESSED);
|
|
|
|
}
|
|
|
|
|
2023-06-12 17:10:27 -07:00
|
|
|
static inline pmd_t pmd_mkwrite_novma(pmd_t pmd)
|
2011-01-13 15:47:01 -08:00
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_RW);
|
|
|
|
}
|
|
|
|
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pmd_t pmd_mkwrite(pmd_t pmd, struct vm_area_struct *vma);
|
|
|
|
#define pmd_mkwrite pmd_mkwrite
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline pud_t pud_set_flags(pud_t pud, pudval_t set)
|
|
|
|
{
|
|
|
|
pudval_t v = native_pud_val(pud);
|
|
|
|
|
2018-02-19 07:48:11 -07:00
|
|
|
return native_make_pud(v | set);
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_clear_flags(pud_t pud, pudval_t clear)
|
|
|
|
{
|
|
|
|
pudval_t v = native_pud_val(pud);
|
|
|
|
|
2018-02-19 07:48:11 -07:00
|
|
|
return native_make_pud(v & ~clear);
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
x86/mm: Introduce _PAGE_SAVED_DIRTY
Some OSes have a greater dependence on software available bits in PTEs than
Linux. That left the hardware architects looking for a way to represent a
new memory type (shadow stack) within the existing bits. They chose to
repurpose a lightly-used state: Write=0,Dirty=1. So in order to support
shadow stack memory, Linux should avoid creating memory with this PTE bit
combination unless it intends for it to be shadow stack.
The reason it's lightly used is that Dirty=1 is normally set by HW
_before_ a write. A write with a Write=0 PTE would typically only generate
a fault, not set Dirty=1. Hardware can (rarely) both set Dirty=1 *and*
generate the fault, resulting in a Write=0,Dirty=1 PTE. Hardware which
supports shadow stacks will no longer exhibit this oddity.
So that leaves Write=0,Dirty=1 PTEs created in software. To avoid
inadvertently created shadow stack memory, in places where Linux normally
creates Write=0,Dirty=1, it can use the software-defined _PAGE_SAVED_DIRTY
in place of the hardware _PAGE_DIRTY. In other words, whenever Linux needs
to create Write=0,Dirty=1, it instead creates Write=0,SavedDirty=1 except
for shadow stack, which is Write=0,Dirty=1.
There are six bits left available to software in the 64-bit PTE after
consuming a bit for _PAGE_SAVED_DIRTY. For 32 bit, the same bit as
_PAGE_BIT_UFFD_WP is used, since user fault fd is not supported on 32
bit. This leaves one unused software bit on 32 bit (_PAGE_BIT_SOFT_DIRTY,
as this is also not supported on 32 bit).
Implement only the infrastructure for _PAGE_SAVED_DIRTY. Changes to
actually begin creating _PAGE_SAVED_DIRTY PTEs will follow once other
pieces are in place.
Since this SavedDirty shifting is done for all x86 CPUs, this leaves
the possibility for the hardware oddity to still create Write=0,Dirty=1
PTEs in rare cases. Since these CPUs also don't support shadow stack, this
will be harmless as it was before the introduction of SavedDirty.
Implement the shifting logic to be branchless. Embed the logic of whether
to do the shifting (including checking the Write bits) so that it can be
called by future callers that would otherwise need additional branching
logic. This efficiency allows the logic of when to do the shifting to be
centralized, making the code easier to reason about.
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-11-rick.p.edgecombe%40intel.com
2023-06-12 17:10:36 -07:00
|
|
|
/* See comments above mksaveddirty_shift() */
|
|
|
|
static inline pud_t pud_mksaveddirty(pud_t pud)
|
|
|
|
{
|
|
|
|
pudval_t v = native_pud_val(pud);
|
|
|
|
|
|
|
|
v = mksaveddirty_shift(v);
|
|
|
|
return native_make_pud(v);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* See comments above mksaveddirty_shift() */
|
|
|
|
static inline pud_t pud_clear_saveddirty(pud_t pud)
|
|
|
|
{
|
|
|
|
pudval_t v = native_pud_val(pud);
|
|
|
|
|
|
|
|
v = clear_saveddirty_shift(v);
|
|
|
|
return native_make_pud(v);
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline pud_t pud_mkold(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_clear_flags(pud, _PAGE_ACCESSED);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_mkclean(pud_t pud)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
return pud_clear_flags(pud, _PAGE_DIRTY_BITS);
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_wrprotect(pud_t pud)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pud = pud_clear_flags(pud, _PAGE_RW);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Blindly clearing _PAGE_RW might accidentally create
|
|
|
|
* a shadow stack PUD (RW=0, Dirty=1). Move the hardware
|
|
|
|
* dirty value to the software bit.
|
|
|
|
*/
|
|
|
|
return pud_mksaveddirty(pud);
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_mkdirty(pud_t pud)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pud = pud_set_flags(pud, _PAGE_DIRTY | _PAGE_SOFT_DIRTY);
|
|
|
|
|
|
|
|
return pud_mksaveddirty(pud);
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_mkdevmap(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_set_flags(pud, _PAGE_DEVMAP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_mkhuge(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_set_flags(pud, _PAGE_PSE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_mkyoung(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_set_flags(pud, _PAGE_ACCESSED);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pud_t pud_mkwrite(pud_t pud)
|
|
|
|
{
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pud = pud_set_flags(pud, _PAGE_RW);
|
|
|
|
|
|
|
|
return pud_clear_saveddirty(pud);
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
2014-06-04 16:08:16 -07:00
|
|
|
#ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY
|
mm: soft-dirty bits for user memory changes tracking
The soft-dirty is a bit on a PTE which helps to track which pages a task
writes to. In order to do this tracking one should
1. Clear soft-dirty bits from PTEs ("echo 4 > /proc/PID/clear_refs)
2. Wait some time.
3. Read soft-dirty bits (55'th in /proc/PID/pagemap2 entries)
To do this tracking, the writable bit is cleared from PTEs when the
soft-dirty bit is. Thus, after this, when the task tries to modify a
page at some virtual address the #PF occurs and the kernel sets the
soft-dirty bit on the respective PTE.
Note, that although all the task's address space is marked as r/o after
the soft-dirty bits clear, the #PF-s that occur after that are processed
fast. This is so, since the pages are still mapped to physical memory,
and thus all the kernel does is finds this fact out and puts back
writable, dirty and soft-dirty bits on the PTE.
Another thing to note, is that when mremap moves PTEs they are marked
with soft-dirty as well, since from the user perspective mremap modifies
the virtual memory at mremap's new address.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Cc: Glauber Costa <glommer@parallels.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-07-03 15:01:20 -07:00
|
|
|
static inline int pte_soft_dirty(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_flags(pte) & _PAGE_SOFT_DIRTY;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pmd_soft_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_flags(pmd) & _PAGE_SOFT_DIRTY;
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline int pud_soft_dirty(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_flags(pud) & _PAGE_SOFT_DIRTY;
|
|
|
|
}
|
|
|
|
|
mm: soft-dirty bits for user memory changes tracking
The soft-dirty is a bit on a PTE which helps to track which pages a task
writes to. In order to do this tracking one should
1. Clear soft-dirty bits from PTEs ("echo 4 > /proc/PID/clear_refs)
2. Wait some time.
3. Read soft-dirty bits (55'th in /proc/PID/pagemap2 entries)
To do this tracking, the writable bit is cleared from PTEs when the
soft-dirty bit is. Thus, after this, when the task tries to modify a
page at some virtual address the #PF occurs and the kernel sets the
soft-dirty bit on the respective PTE.
Note, that although all the task's address space is marked as r/o after
the soft-dirty bits clear, the #PF-s that occur after that are processed
fast. This is so, since the pages are still mapped to physical memory,
and thus all the kernel does is finds this fact out and puts back
writable, dirty and soft-dirty bits on the PTE.
Another thing to note, is that when mremap moves PTEs they are marked
with soft-dirty as well, since from the user perspective mremap modifies
the virtual memory at mremap's new address.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Cc: Glauber Costa <glommer@parallels.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-07-03 15:01:20 -07:00
|
|
|
static inline pte_t pte_mksoft_dirty(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_set_flags(pte, _PAGE_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_mksoft_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline pud_t pud_mksoft_dirty(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_set_flags(pud, _PAGE_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
2015-04-22 14:20:47 +02:00
|
|
|
static inline pte_t pte_clear_soft_dirty(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_clear_flags(pte, _PAGE_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_clear_soft_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_clear_flags(pmd, _PAGE_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline pud_t pud_clear_soft_dirty(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_clear_flags(pud, _PAGE_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
2014-06-04 16:08:16 -07:00
|
|
|
#endif /* CONFIG_HAVE_ARCH_SOFT_DIRTY */
|
|
|
|
|
2009-02-04 18:33:38 -08:00
|
|
|
/*
|
|
|
|
* Mask out unsupported bits in a present pgprot. Non-present pgprots
|
|
|
|
* can use those bits for other purposes, so leave them be.
|
|
|
|
*/
|
|
|
|
static inline pgprotval_t massage_pgprot(pgprot_t pgprot)
|
|
|
|
{
|
|
|
|
pgprotval_t protval = pgprot_val(pgprot);
|
|
|
|
|
|
|
|
if (protval & _PAGE_PRESENT)
|
|
|
|
protval &= __supported_pte_mask;
|
|
|
|
|
|
|
|
return protval;
|
|
|
|
}
|
|
|
|
|
2018-04-06 13:55:09 -07:00
|
|
|
static inline pgprotval_t check_pgprot(pgprot_t pgprot)
|
|
|
|
{
|
|
|
|
pgprotval_t massaged_val = massage_pgprot(pgprot);
|
|
|
|
|
|
|
|
/* mmdebug.h can not be included here because of dependencies */
|
|
|
|
#ifdef CONFIG_DEBUG_VM
|
|
|
|
WARN_ONCE(pgprot_val(pgprot) != massaged_val,
|
|
|
|
"attempted to set unsupported pgprot: %016llx "
|
|
|
|
"bits: %016llx supported: %016llx\n",
|
|
|
|
(u64)pgprot_val(pgprot),
|
|
|
|
(u64)pgprot_val(pgprot) ^ massaged_val,
|
|
|
|
(u64)__supported_pte_mask);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
return massaged_val;
|
|
|
|
}
|
|
|
|
|
2008-01-30 13:32:57 +01:00
|
|
|
static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
|
|
|
|
{
|
2018-06-27 17:46:50 +02:00
|
|
|
phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
|
2018-06-13 15:48:24 -07:00
|
|
|
pfn ^= protnone_mask(pgprot_val(pgprot));
|
|
|
|
pfn &= PTE_PFN_MASK;
|
|
|
|
return __pte(pfn | check_pgprot(pgprot));
|
2008-01-30 13:32:57 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
|
|
|
|
{
|
2018-06-27 17:46:50 +02:00
|
|
|
phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
|
2018-06-13 15:48:24 -07:00
|
|
|
pfn ^= protnone_mask(pgprot_val(pgprot));
|
|
|
|
pfn &= PHYSICAL_PMD_PAGE_MASK;
|
|
|
|
return __pmd(pfn | check_pgprot(pgprot));
|
2008-01-30 13:32:57 +01:00
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot)
|
|
|
|
{
|
2018-06-27 17:46:50 +02:00
|
|
|
phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
|
2018-06-13 15:48:24 -07:00
|
|
|
pfn ^= protnone_mask(pgprot_val(pgprot));
|
|
|
|
pfn &= PHYSICAL_PUD_PAGE_MASK;
|
|
|
|
return __pud(pfn | check_pgprot(pgprot));
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
2020-06-03 16:03:45 -07:00
|
|
|
static inline pmd_t pmd_mkinvalid(pmd_t pmd)
|
2018-08-07 15:09:37 -07:00
|
|
|
{
|
|
|
|
return pfn_pmd(pmd_pfn(pmd),
|
|
|
|
__pgprot(pmd_flags(pmd) & ~(_PAGE_PRESENT|_PAGE_PROTNONE)));
|
|
|
|
}
|
|
|
|
|
2018-06-13 15:48:24 -07:00
|
|
|
static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask);
|
|
|
|
|
2008-01-30 13:32:57 +01:00
|
|
|
static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
|
|
|
|
{
|
2018-06-13 15:48:24 -07:00
|
|
|
pteval_t val = pte_val(pte), oldval = val;
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pte_t pte_result;
|
2008-01-30 13:32:57 +01:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Chop off the NX bit (if present), and add the NX portion of
|
|
|
|
* the newprot (if present):
|
|
|
|
*/
|
2008-05-14 16:05:51 -07:00
|
|
|
val &= _PAGE_CHG_MASK;
|
2018-04-06 13:55:09 -07:00
|
|
|
val |= check_pgprot(newprot) & ~_PAGE_CHG_MASK;
|
2018-06-13 15:48:24 -07:00
|
|
|
val = flip_protnone_guard(oldval, val, PTE_PFN_MASK);
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
|
|
|
|
pte_result = __pte(val);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* To avoid creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
|
|
|
|
* 1. Marking Write=0 PTEs Dirty=1
|
|
|
|
* 2. Marking Dirty=1 PTEs Write=0
|
|
|
|
*
|
|
|
|
* The first case cannot happen because the _PAGE_CHG_MASK will filter
|
|
|
|
* out any Dirty bit passed in newprot. Handle the second case by
|
|
|
|
* going through the mksaveddirty exercise. Only do this if the old
|
|
|
|
* value was Write=1 to avoid doing this on Shadow Stack PTEs.
|
|
|
|
*/
|
|
|
|
if (oldval & _PAGE_RW)
|
|
|
|
pte_result = pte_mksaveddirty(pte_result);
|
|
|
|
else
|
|
|
|
pte_result = pte_clear_saveddirty(pte_result);
|
|
|
|
|
|
|
|
return pte_result;
|
2008-01-30 13:32:57 +01:00
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:02 -08:00
|
|
|
static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
|
|
|
|
{
|
2018-06-13 15:48:24 -07:00
|
|
|
pmdval_t val = pmd_val(pmd), oldval = val;
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
pmd_t pmd_result;
|
2011-01-13 15:47:02 -08:00
|
|
|
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
val &= (_HPAGE_CHG_MASK & ~_PAGE_DIRTY);
|
2018-04-06 13:55:09 -07:00
|
|
|
val |= check_pgprot(newprot) & ~_HPAGE_CHG_MASK;
|
2018-06-13 15:48:24 -07:00
|
|
|
val = flip_protnone_guard(oldval, val, PHYSICAL_PMD_PAGE_MASK);
|
x86/mm: Start actually marking _PAGE_SAVED_DIRTY
The recently introduced _PAGE_SAVED_DIRTY should be used instead of the
HW Dirty bit whenever a PTE is Write=0, in order to not inadvertently
create shadow stack PTEs. Update pte_mk*() helpers to do this, and apply
the same changes to pmd and pud. Since there is no x86 version of
pte_mkwrite() to hold this arch specific logic, create one. Add it to
x86/mm/pgtable.c instead of x86/asm/include/pgtable.h as future patches
will require it to live in pgtable.c and it will make the diff easier
for reviewers.
Since CPUs without shadow stack support could create Write=0,Dirty=1
PTEs, only return true for pte_shstk() if the CPU also supports shadow
stack. This will prevent these HW creates PTEs as showing as true for
pte_write().
For pte_modify() this is a bit trickier. It takes a "raw" pgprot_t which
was not necessarily created with any of the existing PTE bit helpers.
That means that it can return a pte_t with Write=0,Dirty=1, a shadow
stack PTE, when it did not intend to create one.
Modify it to also move _PAGE_DIRTY to _PAGE_SAVED_DIRTY. To avoid
creating Write=0,Dirty=1 PTEs, pte_modify() needs to avoid:
1. Marking Write=0 PTEs Dirty=1
2. Marking Dirty=1 PTEs Write=0
The first case cannot happen as the existing behavior of pte_modify() is to
filter out any Dirty bit passed in newprot. Handle the second case by
shifting _PAGE_DIRTY=1 to _PAGE_SAVED_DIRTY=1 if the PTE was write
protected by the pte_modify() call. Apply the same changes to pmd_modify().
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-13-rick.p.edgecombe%40intel.com
2023-06-12 17:10:38 -07:00
|
|
|
|
|
|
|
pmd_result = __pmd(val);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* To avoid creating Write=0,Dirty=1 PMDs, pte_modify() needs to avoid:
|
|
|
|
* 1. Marking Write=0 PMDs Dirty=1
|
|
|
|
* 2. Marking Dirty=1 PMDs Write=0
|
|
|
|
*
|
|
|
|
* The first case cannot happen because the _PAGE_CHG_MASK will filter
|
|
|
|
* out any Dirty bit passed in newprot. Handle the second case by
|
|
|
|
* going through the mksaveddirty exercise. Only do this if the old
|
|
|
|
* value was Write=1 to avoid doing this on Shadow Stack PTEs.
|
|
|
|
*/
|
|
|
|
if (oldval & _PAGE_RW)
|
|
|
|
pmd_result = pmd_mksaveddirty(pmd_result);
|
|
|
|
else
|
|
|
|
pmd_result = pmd_clear_saveddirty(pmd_result);
|
|
|
|
|
|
|
|
return pmd_result;
|
2011-01-13 15:47:02 -08:00
|
|
|
}
|
|
|
|
|
2020-03-04 12:45:26 +01:00
|
|
|
/*
|
|
|
|
* mprotect needs to preserve PAT and encryption bits when updating
|
|
|
|
* vm_page_prot
|
|
|
|
*/
|
2008-05-14 16:05:51 -07:00
|
|
|
#define pgprot_modify pgprot_modify
|
|
|
|
static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
|
|
|
|
{
|
|
|
|
pgprotval_t preservebits = pgprot_val(oldprot) & _PAGE_CHG_MASK;
|
2020-03-04 12:45:26 +01:00
|
|
|
pgprotval_t addbits = pgprot_val(newprot) & ~_PAGE_CHG_MASK;
|
2008-05-14 16:05:51 -07:00
|
|
|
return __pgprot(preservebits | addbits);
|
|
|
|
}
|
|
|
|
|
2015-09-17 12:24:18 -06:00
|
|
|
#define pte_pgprot(x) __pgprot(pte_flags(x))
|
|
|
|
#define pmd_pgprot(x) __pgprot(pmd_flags(x))
|
|
|
|
#define pud_pgprot(x) __pgprot(pud_flags(x))
|
2017-03-17 21:55:15 +03:00
|
|
|
#define p4d_pgprot(x) __pgprot(p4d_flags(x))
|
2008-01-30 13:33:51 +01:00
|
|
|
|
2009-02-04 18:33:38 -08:00
|
|
|
#define canon_pgprot(p) __pgprot(massage_pgprot(p))
|
2008-01-30 13:33:53 +01:00
|
|
|
|
x86, pat: Allow ISA memory range uncacheable mapping requests
Max Vozeler reported:
> Bug 13877 - bogl-term broken with CONFIG_X86_PAT=y, works with =n
>
> strace of bogl-term:
> 814 mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED, 4, 0)
> = -1 EAGAIN (Resource temporarily unavailable)
> 814 write(2, "bogl: mmaping /dev/fb0: Resource temporarily unavailable\n",
> 57) = 57
PAT code maps the ISA memory range as WB in the PAT attribute, so that
fixed range MTRR registers define the actual memory type (UC/WC/WT etc).
But the upper level is_new_memtype_allowed() API checks are failing,
as the request here is for UC and the return tracked type is WB (Tracked type is
WB as MTRR type for this legacy range potentially will be different for each
4k page).
Fix is_new_memtype_allowed() by always succeeding the ISA address range
checks, as the null PAT (WB) and def MTRR fixed range register settings
satisfy the memory type needs of the applications that map the ISA address
range.
Reported-and-Tested-by: Max Vozeler <xam@debian.org>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-08-17 13:23:50 -07:00
|
|
|
static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,
|
2014-11-03 14:01:53 +01:00
|
|
|
enum page_cache_mode pcm,
|
|
|
|
enum page_cache_mode new_pcm)
|
2009-01-09 16:13:10 -08:00
|
|
|
{
|
x86, pat: Allow ISA memory range uncacheable mapping requests
Max Vozeler reported:
> Bug 13877 - bogl-term broken with CONFIG_X86_PAT=y, works with =n
>
> strace of bogl-term:
> 814 mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED, 4, 0)
> = -1 EAGAIN (Resource temporarily unavailable)
> 814 write(2, "bogl: mmaping /dev/fb0: Resource temporarily unavailable\n",
> 57) = 57
PAT code maps the ISA memory range as WB in the PAT attribute, so that
fixed range MTRR registers define the actual memory type (UC/WC/WT etc).
But the upper level is_new_memtype_allowed() API checks are failing,
as the request here is for UC and the return tracked type is WB (Tracked type is
WB as MTRR type for this legacy range potentially will be different for each
4k page).
Fix is_new_memtype_allowed() by always succeeding the ISA address range
checks, as the null PAT (WB) and def MTRR fixed range register settings
satisfy the memory type needs of the applications that map the ISA address
range.
Reported-and-Tested-by: Max Vozeler <xam@debian.org>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-08-17 13:23:50 -07:00
|
|
|
/*
|
2009-11-23 15:12:07 -08:00
|
|
|
* PAT type is always WB for untracked ranges, so no need to check.
|
x86, pat: Allow ISA memory range uncacheable mapping requests
Max Vozeler reported:
> Bug 13877 - bogl-term broken with CONFIG_X86_PAT=y, works with =n
>
> strace of bogl-term:
> 814 mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED, 4, 0)
> = -1 EAGAIN (Resource temporarily unavailable)
> 814 write(2, "bogl: mmaping /dev/fb0: Resource temporarily unavailable\n",
> 57) = 57
PAT code maps the ISA memory range as WB in the PAT attribute, so that
fixed range MTRR registers define the actual memory type (UC/WC/WT etc).
But the upper level is_new_memtype_allowed() API checks are failing,
as the request here is for UC and the return tracked type is WB (Tracked type is
WB as MTRR type for this legacy range potentially will be different for each
4k page).
Fix is_new_memtype_allowed() by always succeeding the ISA address range
checks, as the null PAT (WB) and def MTRR fixed range register settings
satisfy the memory type needs of the applications that map the ISA address
range.
Reported-and-Tested-by: Max Vozeler <xam@debian.org>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-08-17 13:23:50 -07:00
|
|
|
*/
|
2009-11-23 14:49:20 -08:00
|
|
|
if (x86_platform.is_untracked_pat_range(paddr, paddr + size))
|
x86, pat: Allow ISA memory range uncacheable mapping requests
Max Vozeler reported:
> Bug 13877 - bogl-term broken with CONFIG_X86_PAT=y, works with =n
>
> strace of bogl-term:
> 814 mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED, 4, 0)
> = -1 EAGAIN (Resource temporarily unavailable)
> 814 write(2, "bogl: mmaping /dev/fb0: Resource temporarily unavailable\n",
> 57) = 57
PAT code maps the ISA memory range as WB in the PAT attribute, so that
fixed range MTRR registers define the actual memory type (UC/WC/WT etc).
But the upper level is_new_memtype_allowed() API checks are failing,
as the request here is for UC and the return tracked type is WB (Tracked type is
WB as MTRR type for this legacy range potentially will be different for each
4k page).
Fix is_new_memtype_allowed() by always succeeding the ISA address range
checks, as the null PAT (WB) and def MTRR fixed range register settings
satisfy the memory type needs of the applications that map the ISA address
range.
Reported-and-Tested-by: Max Vozeler <xam@debian.org>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-08-17 13:23:50 -07:00
|
|
|
return 1;
|
|
|
|
|
2009-01-09 16:13:10 -08:00
|
|
|
/*
|
|
|
|
* Certain new memtypes are not allowed with certain
|
|
|
|
* requested memtype:
|
|
|
|
* - request is uncached, return cannot be write-back
|
|
|
|
* - request is write-combine, return cannot be write-back
|
2015-06-04 18:55:14 +02:00
|
|
|
* - request is write-through, return cannot be write-back
|
|
|
|
* - request is write-through, return cannot be write-combine
|
2009-01-09 16:13:10 -08:00
|
|
|
*/
|
2014-11-03 14:01:53 +01:00
|
|
|
if ((pcm == _PAGE_CACHE_MODE_UC_MINUS &&
|
|
|
|
new_pcm == _PAGE_CACHE_MODE_WB) ||
|
|
|
|
(pcm == _PAGE_CACHE_MODE_WC &&
|
2015-06-04 18:55:14 +02:00
|
|
|
new_pcm == _PAGE_CACHE_MODE_WB) ||
|
|
|
|
(pcm == _PAGE_CACHE_MODE_WT &&
|
|
|
|
new_pcm == _PAGE_CACHE_MODE_WB) ||
|
|
|
|
(pcm == _PAGE_CACHE_MODE_WT &&
|
|
|
|
new_pcm == _PAGE_CACHE_MODE_WC)) {
|
2009-01-09 16:13:10 -08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2009-02-24 11:57:21 +09:00
|
|
|
pmd_t *populate_extra_pmd(unsigned long vaddr);
|
|
|
|
pte_t *populate_extra_pte(unsigned long vaddr);
|
2018-07-18 11:40:56 +02:00
|
|
|
|
2023-11-21 08:07:31 -08:00
|
|
|
#ifdef CONFIG_MITIGATION_PAGE_TABLE_ISOLATION
|
2018-07-18 11:40:56 +02:00
|
|
|
pgd_t __pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Take a PGD location (pgdp) and a pgd value that needs to be set there.
|
|
|
|
* Populates the user and returns the resulting PGD that must be set in
|
|
|
|
* the kernel copy of the page tables.
|
|
|
|
*/
|
|
|
|
static inline pgd_t pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd)
|
|
|
|
{
|
|
|
|
if (!static_cpu_has(X86_FEATURE_PTI))
|
|
|
|
return pgd;
|
|
|
|
return __pti_set_user_pgtbl(pgdp, pgd);
|
|
|
|
}
|
2023-11-21 08:07:31 -08:00
|
|
|
#else /* CONFIG_MITIGATION_PAGE_TABLE_ISOLATION */
|
2018-07-18 11:40:56 +02:00
|
|
|
static inline pgd_t pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd)
|
|
|
|
{
|
|
|
|
return pgd;
|
|
|
|
}
|
2023-11-21 08:07:31 -08:00
|
|
|
#endif /* CONFIG_MITIGATION_PAGE_TABLE_ISOLATION */
|
2018-07-18 11:40:56 +02:00
|
|
|
|
2008-01-30 13:32:56 +01:00
|
|
|
#endif /* __ASSEMBLY__ */
|
|
|
|
|
2018-07-18 11:40:56 +02:00
|
|
|
|
2007-10-11 11:20:03 +02:00
|
|
|
#ifdef CONFIG_X86_32
|
2012-10-02 18:01:25 +01:00
|
|
|
# include <asm/pgtable_32.h>
|
2007-10-11 11:20:03 +02:00
|
|
|
#else
|
2012-10-02 18:01:25 +01:00
|
|
|
# include <asm/pgtable_64.h>
|
2007-10-11 11:20:03 +02:00
|
|
|
#endif
|
2008-01-30 13:32:55 +01:00
|
|
|
|
2009-02-05 11:30:54 -08:00
|
|
|
#ifndef __ASSEMBLY__
|
2009-02-05 11:30:55 -08:00
|
|
|
#include <linux/mm_types.h>
|
2013-09-11 14:22:47 -07:00
|
|
|
#include <linux/mmdebug.h>
|
2013-01-22 13:24:31 -08:00
|
|
|
#include <linux/log2.h>
|
2017-03-21 08:17:25 +01:00
|
|
|
#include <asm/fixmap.h>
|
2009-02-05 11:30:54 -08:00
|
|
|
|
2009-02-05 11:30:43 -08:00
|
|
|
static inline int pte_none(pte_t pte)
|
|
|
|
{
|
2016-07-07 17:19:12 -07:00
|
|
|
return !(pte.pte & ~(_PAGE_KNL_ERRATUM_MASK));
|
2009-02-05 11:30:43 -08:00
|
|
|
}
|
|
|
|
|
2009-02-05 11:30:44 -08:00
|
|
|
#define __HAVE_ARCH_PTE_SAME
|
|
|
|
static inline int pte_same(pte_t a, pte_t b)
|
|
|
|
{
|
|
|
|
return a.pte == b.pte;
|
|
|
|
}
|
|
|
|
|
2024-02-15 10:31:52 +00:00
|
|
|
static inline pte_t pte_advance_pfn(pte_t pte, unsigned long nr)
|
2023-09-20 05:09:58 +01:00
|
|
|
{
|
|
|
|
if (__pte_needs_invert(pte_val(pte)))
|
2024-02-15 10:31:52 +00:00
|
|
|
return __pte(pte_val(pte) - (nr << PFN_PTE_SHIFT));
|
|
|
|
return __pte(pte_val(pte) + (nr << PFN_PTE_SHIFT));
|
2023-09-20 05:09:58 +01:00
|
|
|
}
|
2024-02-15 10:31:52 +00:00
|
|
|
#define pte_advance_pfn pte_advance_pfn
|
2023-09-20 05:09:58 +01:00
|
|
|
|
2009-02-05 11:30:45 -08:00
|
|
|
static inline int pte_present(pte_t a)
|
2014-06-04 16:06:30 -07:00
|
|
|
{
|
|
|
|
return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE);
|
|
|
|
}
|
|
|
|
|
2019-07-16 16:30:47 -07:00
|
|
|
#ifdef CONFIG_ARCH_HAS_PTE_DEVMAP
|
2016-01-15 16:56:55 -08:00
|
|
|
static inline int pte_devmap(pte_t a)
|
|
|
|
{
|
|
|
|
return (pte_flags(a) & _PAGE_DEVMAP) == _PAGE_DEVMAP;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2012-10-09 15:31:12 +02:00
|
|
|
#define pte_accessible pte_accessible
|
mm: fix TLB flush race between migration, and change_protection_range
There are a few subtle races, between change_protection_range (used by
mprotect and change_prot_numa) on one side, and NUMA page migration and
compaction on the other side.
The basic race is that there is a time window between when the PTE gets
made non-present (PROT_NONE or NUMA), and the TLB is flushed.
During that time, a CPU may continue writing to the page.
This is fine most of the time, however compaction or the NUMA migration
code may come in, and migrate the page away.
When that happens, the CPU may continue writing, through the cached
translation, to what is no longer the current memory location of the
process.
This only affects x86, which has a somewhat optimistic pte_accessible.
All other architectures appear to be safe, and will either always flush,
or flush whenever there is a valid mapping, even with no permissions
(SPARC).
The basic race looks like this:
CPU A CPU B CPU C
load TLB entry
make entry PTE/PMD_NUMA
fault on entry
read/write old page
start migrating page
change PTE/PMD to new page
read/write old page [*]
flush TLB
reload TLB from new entry
read/write new page
lose data
[*] the old page may belong to a new user at this point!
The obvious fix is to flush remote TLB entries, by making sure that
pte_accessible aware of the fact that PROT_NONE and PROT_NUMA memory may
still be accessible if there is a TLB flush pending for the mm.
This should fix both NUMA migration and compaction.
[mgorman@suse.de: fix build]
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-18 17:08:44 -08:00
|
|
|
static inline bool pte_accessible(struct mm_struct *mm, pte_t a)
|
2012-10-09 15:31:12 +02:00
|
|
|
{
|
mm: fix TLB flush race between migration, and change_protection_range
There are a few subtle races, between change_protection_range (used by
mprotect and change_prot_numa) on one side, and NUMA page migration and
compaction on the other side.
The basic race is that there is a time window between when the PTE gets
made non-present (PROT_NONE or NUMA), and the TLB is flushed.
During that time, a CPU may continue writing to the page.
This is fine most of the time, however compaction or the NUMA migration
code may come in, and migrate the page away.
When that happens, the CPU may continue writing, through the cached
translation, to what is no longer the current memory location of the
process.
This only affects x86, which has a somewhat optimistic pte_accessible.
All other architectures appear to be safe, and will either always flush,
or flush whenever there is a valid mapping, even with no permissions
(SPARC).
The basic race looks like this:
CPU A CPU B CPU C
load TLB entry
make entry PTE/PMD_NUMA
fault on entry
read/write old page
start migrating page
change PTE/PMD to new page
read/write old page [*]
flush TLB
reload TLB from new entry
read/write new page
lose data
[*] the old page may belong to a new user at this point!
The obvious fix is to flush remote TLB entries, by making sure that
pte_accessible aware of the fact that PROT_NONE and PROT_NUMA memory may
still be accessible if there is a TLB flush pending for the mm.
This should fix both NUMA migration and compaction.
[mgorman@suse.de: fix build]
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-18 17:08:44 -08:00
|
|
|
if (pte_flags(a) & _PAGE_PRESENT)
|
|
|
|
return true;
|
|
|
|
|
2015-02-12 14:58:32 -08:00
|
|
|
if ((pte_flags(a) & _PAGE_PROTNONE) &&
|
2022-01-14 14:06:10 -08:00
|
|
|
atomic_read(&mm->tlb_flush_pending))
|
mm: fix TLB flush race between migration, and change_protection_range
There are a few subtle races, between change_protection_range (used by
mprotect and change_prot_numa) on one side, and NUMA page migration and
compaction on the other side.
The basic race is that there is a time window between when the PTE gets
made non-present (PROT_NONE or NUMA), and the TLB is flushed.
During that time, a CPU may continue writing to the page.
This is fine most of the time, however compaction or the NUMA migration
code may come in, and migrate the page away.
When that happens, the CPU may continue writing, through the cached
translation, to what is no longer the current memory location of the
process.
This only affects x86, which has a somewhat optimistic pte_accessible.
All other architectures appear to be safe, and will either always flush,
or flush whenever there is a valid mapping, even with no permissions
(SPARC).
The basic race looks like this:
CPU A CPU B CPU C
load TLB entry
make entry PTE/PMD_NUMA
fault on entry
read/write old page
start migrating page
change PTE/PMD to new page
read/write old page [*]
flush TLB
reload TLB from new entry
read/write new page
lose data
[*] the old page may belong to a new user at this point!
The obvious fix is to flush remote TLB entries, by making sure that
pte_accessible aware of the fact that PROT_NONE and PROT_NUMA memory may
still be accessible if there is a TLB flush pending for the mm.
This should fix both NUMA migration and compaction.
[mgorman@suse.de: fix build]
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-18 17:08:44 -08:00
|
|
|
return true;
|
|
|
|
|
|
|
|
return false;
|
2012-10-09 15:31:12 +02:00
|
|
|
}
|
|
|
|
|
2009-02-05 11:30:50 -08:00
|
|
|
static inline int pmd_present(pmd_t pmd)
|
|
|
|
{
|
2012-10-08 16:33:27 -07:00
|
|
|
/*
|
|
|
|
* Checking for _PAGE_PSE is needed too because
|
|
|
|
* split_huge_page will temporarily clear the present bit (but
|
|
|
|
* the _PAGE_PSE flag will remain set at all times while the
|
|
|
|
* _PAGE_PRESENT bit is clear).
|
|
|
|
*/
|
2015-02-12 14:58:32 -08:00
|
|
|
return pmd_flags(pmd) & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_PSE);
|
2009-02-05 11:30:50 -08:00
|
|
|
}
|
|
|
|
|
2015-02-12 14:58:19 -08:00
|
|
|
#ifdef CONFIG_NUMA_BALANCING
|
|
|
|
/*
|
|
|
|
* These work without NUMA balancing but the kernel does not care. See the
|
2020-06-08 21:32:38 -07:00
|
|
|
* comment in include/linux/pgtable.h
|
2015-02-12 14:58:19 -08:00
|
|
|
*/
|
|
|
|
static inline int pte_protnone(pte_t pte)
|
|
|
|
{
|
2015-02-19 13:06:53 +00:00
|
|
|
return (pte_flags(pte) & (_PAGE_PROTNONE | _PAGE_PRESENT))
|
|
|
|
== _PAGE_PROTNONE;
|
2015-02-12 14:58:19 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pmd_protnone(pmd_t pmd)
|
|
|
|
{
|
2015-02-19 13:06:53 +00:00
|
|
|
return (pmd_flags(pmd) & (_PAGE_PROTNONE | _PAGE_PRESENT))
|
|
|
|
== _PAGE_PROTNONE;
|
2015-02-12 14:58:19 -08:00
|
|
|
}
|
|
|
|
#endif /* CONFIG_NUMA_BALANCING */
|
|
|
|
|
2009-02-05 11:30:51 -08:00
|
|
|
static inline int pmd_none(pmd_t pmd)
|
|
|
|
{
|
|
|
|
/* Only check low word on 32-bit platforms, since it might be
|
|
|
|
out of sync with upper half. */
|
2016-07-07 17:19:12 -07:00
|
|
|
unsigned long val = native_pmd_val(pmd);
|
|
|
|
return (val & ~_PAGE_KNL_ERRATUM_MASK) == 0;
|
2009-02-05 11:30:51 -08:00
|
|
|
}
|
|
|
|
|
2009-02-05 11:30:59 -08:00
|
|
|
static inline unsigned long pmd_page_vaddr(pmd_t pmd)
|
|
|
|
{
|
2015-09-17 12:24:17 -06:00
|
|
|
return (unsigned long)__va(pmd_val(pmd) & pmd_pfn_mask(pmd));
|
2009-02-05 11:30:59 -08:00
|
|
|
}
|
|
|
|
|
2009-02-09 11:42:57 +01:00
|
|
|
/*
|
|
|
|
* Currently stuck as a macro due to indirect forward reference to
|
|
|
|
* linux/mmzone.h's __section_mem_map_addr() definition:
|
|
|
|
*/
|
2017-07-17 16:10:06 -05:00
|
|
|
#define pmd_page(pmd) pfn_to_page(pmd_pfn(pmd))
|
2009-02-05 11:31:00 -08:00
|
|
|
|
2009-02-05 11:31:05 -08:00
|
|
|
/*
|
|
|
|
* Conversion functions: convert a page and protection to a page entry,
|
|
|
|
* and a page entry and page directory to the page they refer to.
|
|
|
|
*
|
|
|
|
* (Currently stuck as a macro because of indirect forward reference
|
|
|
|
* to linux/mm.h:page_to_nid())
|
|
|
|
*/
|
x86/mm: Warn if create Write=0,Dirty=1 with raw prot
When user shadow stack is in use, Write=0,Dirty=1 is treated by the CPU as
shadow stack memory. So for shadow stack memory this bit combination is
valid, but when Dirty=1,Write=1 (conventionally writable) memory is being
write protected, the kernel has been taught to transition the Dirty=1
bit to SavedDirty=1, to avoid inadvertently creating shadow stack
memory. It does this inside pte_wrprotect() because it knows the PTE is
not intended to be a writable shadow stack entry, it is supposed to be
write protected.
However, when a PTE is created by a raw prot using mk_pte(), mk_pte()
can't know whether to adjust Dirty=1 to SavedDirty=1. It can't
distinguish between the caller intending to create a shadow stack PTE or
needing the SavedDirty shift.
The kernel has been updated to not do this, and so Write=0,Dirty=1
memory should only be created by the pte_mkfoo() helpers. Add a warning
to make sure no new mk_pte() start doing this, like, for example,
set_memory_rox() did.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-19-rick.p.edgecombe%40intel.com
2023-06-12 17:10:44 -07:00
|
|
|
#define mk_pte(page, pgprot) \
|
|
|
|
({ \
|
|
|
|
pgprot_t __pgprot = pgprot; \
|
|
|
|
\
|
|
|
|
WARN_ON_ONCE((pgprot_val(__pgprot) & (_PAGE_DIRTY | _PAGE_RW)) == \
|
|
|
|
_PAGE_DIRTY); \
|
|
|
|
pfn_pte(page_to_pfn(page), __pgprot); \
|
|
|
|
})
|
2009-02-05 11:31:05 -08:00
|
|
|
|
2009-02-05 11:31:11 -08:00
|
|
|
static inline int pmd_bad(pmd_t pmd)
|
|
|
|
{
|
2022-09-18 01:59:59 -06:00
|
|
|
return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
|
|
|
|
(_KERNPG_TABLE & ~_PAGE_ACCESSED);
|
2009-02-05 11:31:11 -08:00
|
|
|
}
|
|
|
|
|
2009-02-05 11:31:12 -08:00
|
|
|
static inline unsigned long pages_to_mb(unsigned long npg)
|
|
|
|
{
|
|
|
|
return npg >> (20 - PAGE_SHIFT);
|
|
|
|
}
|
|
|
|
|
2015-04-14 15:46:14 -07:00
|
|
|
#if CONFIG_PGTABLE_LEVELS > 2
|
2009-02-05 11:31:13 -08:00
|
|
|
static inline int pud_none(pud_t pud)
|
|
|
|
{
|
2016-07-07 17:19:12 -07:00
|
|
|
return (native_pud_val(pud) & ~(_PAGE_KNL_ERRATUM_MASK)) == 0;
|
2009-02-05 11:31:13 -08:00
|
|
|
}
|
|
|
|
|
2009-02-05 11:30:48 -08:00
|
|
|
static inline int pud_present(pud_t pud)
|
|
|
|
{
|
2009-02-05 11:31:16 -08:00
|
|
|
return pud_flags(pud) & _PAGE_PRESENT;
|
2009-02-05 11:30:48 -08:00
|
|
|
}
|
2009-02-05 11:30:53 -08:00
|
|
|
|
2021-07-07 18:09:53 -07:00
|
|
|
static inline pmd_t *pud_pgtable(pud_t pud)
|
2009-02-05 11:30:53 -08:00
|
|
|
{
|
2021-07-07 18:09:53 -07:00
|
|
|
return (pmd_t *)__va(pud_val(pud) & pud_pfn_mask(pud));
|
2009-02-05 11:30:53 -08:00
|
|
|
}
|
2009-02-05 11:30:55 -08:00
|
|
|
|
2009-02-09 11:42:57 +01:00
|
|
|
/*
|
|
|
|
* Currently stuck as a macro due to indirect forward reference to
|
|
|
|
* linux/mmzone.h's __section_mem_map_addr() definition:
|
|
|
|
*/
|
2017-07-17 16:10:06 -05:00
|
|
|
#define pud_page(pud) pfn_to_page(pud_pfn(pud))
|
2009-02-05 11:31:02 -08:00
|
|
|
|
2024-03-05 12:37:49 +08:00
|
|
|
#define pud_leaf pud_leaf
|
2024-03-05 12:37:50 +08:00
|
|
|
static inline bool pud_leaf(pud_t pud)
|
2009-02-05 11:31:08 -08:00
|
|
|
{
|
2009-02-09 00:09:52 -08:00
|
|
|
return (pud_val(pud) & (_PAGE_PSE | _PAGE_PRESENT)) ==
|
2009-02-05 11:31:08 -08:00
|
|
|
(_PAGE_PSE | _PAGE_PRESENT);
|
|
|
|
}
|
2009-02-05 11:31:10 -08:00
|
|
|
|
|
|
|
static inline int pud_bad(pud_t pud)
|
|
|
|
{
|
2009-02-05 11:31:16 -08:00
|
|
|
return (pud_flags(pud) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
|
2009-02-05 11:31:10 -08:00
|
|
|
}
|
2015-04-14 15:46:14 -07:00
|
|
|
#endif /* CONFIG_PGTABLE_LEVELS > 2 */
|
2009-02-05 11:30:48 -08:00
|
|
|
|
2017-03-17 21:55:15 +03:00
|
|
|
#if CONFIG_PGTABLE_LEVELS > 3
|
|
|
|
static inline int p4d_none(p4d_t p4d)
|
|
|
|
{
|
|
|
|
return (native_p4d_val(p4d) & ~(_PAGE_KNL_ERRATUM_MASK)) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int p4d_present(p4d_t p4d)
|
|
|
|
{
|
|
|
|
return p4d_flags(p4d) & _PAGE_PRESENT;
|
|
|
|
}
|
|
|
|
|
2021-07-07 18:09:56 -07:00
|
|
|
static inline pud_t *p4d_pgtable(p4d_t p4d)
|
2017-03-17 21:55:15 +03:00
|
|
|
{
|
2021-07-07 18:09:56 -07:00
|
|
|
return (pud_t *)__va(p4d_val(p4d) & p4d_pfn_mask(p4d));
|
2017-03-17 21:55:15 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Currently stuck as a macro due to indirect forward reference to
|
|
|
|
* linux/mmzone.h's __section_mem_map_addr() definition:
|
|
|
|
*/
|
2017-07-17 16:10:06 -05:00
|
|
|
#define p4d_page(p4d) pfn_to_page(p4d_pfn(p4d))
|
2017-03-17 21:55:15 +03:00
|
|
|
|
|
|
|
static inline int p4d_bad(p4d_t p4d)
|
|
|
|
{
|
2017-12-04 15:07:38 +01:00
|
|
|
unsigned long ignore_flags = _KERNPG_TABLE | _PAGE_USER;
|
|
|
|
|
2023-11-21 08:07:31 -08:00
|
|
|
if (IS_ENABLED(CONFIG_MITIGATION_PAGE_TABLE_ISOLATION))
|
2017-12-04 15:07:38 +01:00
|
|
|
ignore_flags |= _PAGE_NX;
|
|
|
|
|
|
|
|
return (p4d_flags(p4d) & ~ignore_flags) != 0;
|
2017-03-17 21:55:15 +03:00
|
|
|
}
|
|
|
|
#endif /* CONFIG_PGTABLE_LEVELS > 3 */
|
|
|
|
|
2017-03-13 17:33:04 +03:00
|
|
|
static inline unsigned long p4d_index(unsigned long address)
|
|
|
|
{
|
|
|
|
return (address >> P4D_SHIFT) & (PTRS_PER_P4D - 1);
|
|
|
|
}
|
|
|
|
|
2017-03-17 21:55:15 +03:00
|
|
|
#if CONFIG_PGTABLE_LEVELS > 4
|
2009-02-05 11:30:49 -08:00
|
|
|
static inline int pgd_present(pgd_t pgd)
|
|
|
|
{
|
2018-05-18 13:35:24 +03:00
|
|
|
if (!pgtable_l5_enabled())
|
2018-02-14 21:25:40 +03:00
|
|
|
return 1;
|
2009-02-05 11:31:16 -08:00
|
|
|
return pgd_flags(pgd) & _PAGE_PRESENT;
|
2009-02-05 11:30:49 -08:00
|
|
|
}
|
2009-02-05 11:30:52 -08:00
|
|
|
|
|
|
|
static inline unsigned long pgd_page_vaddr(pgd_t pgd)
|
|
|
|
{
|
|
|
|
return (unsigned long)__va((unsigned long)pgd_val(pgd) & PTE_PFN_MASK);
|
|
|
|
}
|
2009-02-05 11:30:56 -08:00
|
|
|
|
2009-02-09 11:42:57 +01:00
|
|
|
/*
|
|
|
|
* Currently stuck as a macro due to indirect forward reference to
|
|
|
|
* linux/mmzone.h's __section_mem_map_addr() definition:
|
|
|
|
*/
|
2017-07-17 16:10:06 -05:00
|
|
|
#define pgd_page(pgd) pfn_to_page(pgd_pfn(pgd))
|
2009-02-05 11:30:57 -08:00
|
|
|
|
|
|
|
/* to find an entry in a page-table-directory. */
|
2018-06-26 13:03:41 +03:00
|
|
|
static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
|
2009-02-05 11:30:58 -08:00
|
|
|
{
|
2018-05-18 13:35:24 +03:00
|
|
|
if (!pgtable_l5_enabled())
|
2018-02-14 21:25:40 +03:00
|
|
|
return (p4d_t *)pgd;
|
2017-03-17 21:55:15 +03:00
|
|
|
return (p4d_t *)pgd_page_vaddr(*pgd) + p4d_index(address);
|
2009-02-05 11:30:58 -08:00
|
|
|
}
|
2009-02-05 11:31:09 -08:00
|
|
|
|
|
|
|
static inline int pgd_bad(pgd_t pgd)
|
|
|
|
{
|
2017-12-04 15:07:38 +01:00
|
|
|
unsigned long ignore_flags = _PAGE_USER;
|
|
|
|
|
2018-05-18 13:35:24 +03:00
|
|
|
if (!pgtable_l5_enabled())
|
2018-02-14 21:25:40 +03:00
|
|
|
return 0;
|
|
|
|
|
2023-11-21 08:07:31 -08:00
|
|
|
if (IS_ENABLED(CONFIG_MITIGATION_PAGE_TABLE_ISOLATION))
|
2017-12-04 15:07:38 +01:00
|
|
|
ignore_flags |= _PAGE_NX;
|
|
|
|
|
|
|
|
return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
|
2009-02-05 11:31:09 -08:00
|
|
|
}
|
2009-02-05 11:31:14 -08:00
|
|
|
|
|
|
|
static inline int pgd_none(pgd_t pgd)
|
|
|
|
{
|
2018-05-18 13:35:24 +03:00
|
|
|
if (!pgtable_l5_enabled())
|
2018-02-14 21:25:40 +03:00
|
|
|
return 0;
|
2016-07-07 17:19:12 -07:00
|
|
|
/*
|
|
|
|
* There is no need to do a workaround for the KNL stray
|
|
|
|
* A/D bit erratum here. PGDs only point to page tables
|
|
|
|
* except on 32-bit non-PAE which is not supported on
|
|
|
|
* KNL.
|
|
|
|
*/
|
2009-02-05 11:31:17 -08:00
|
|
|
return !native_pgd_val(pgd);
|
2009-02-05 11:31:14 -08:00
|
|
|
}
|
2017-03-17 21:55:15 +03:00
|
|
|
#endif /* CONFIG_PGTABLE_LEVELS > 4 */
|
2009-02-05 11:30:49 -08:00
|
|
|
|
2008-01-30 13:32:56 +01:00
|
|
|
#endif /* __ASSEMBLY__ */
|
|
|
|
|
2008-03-17 16:37:13 -07:00
|
|
|
#define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
|
|
|
|
#define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
|
|
|
|
|
2008-01-30 13:32:58 +01:00
|
|
|
#ifndef __ASSEMBLY__
|
|
|
|
|
2009-04-11 00:03:10 +05:30
|
|
|
extern int direct_gbpages;
|
2012-11-16 19:38:41 -08:00
|
|
|
void init_mem_mapping(void);
|
2012-11-16 19:38:58 -08:00
|
|
|
void early_alloc_pgt_buf(void);
|
2019-04-26 16:22:46 -07:00
|
|
|
void __init poking_init(void);
|
2020-04-10 14:33:24 -07:00
|
|
|
unsigned long init_memory_mapping(unsigned long start,
|
|
|
|
unsigned long end, pgprot_t prot);
|
2020-06-06 14:37:43 +02:00
|
|
|
|
|
|
|
#ifdef CONFIG_X86_64
|
|
|
|
extern pgd_t trampoline_pgd_entry;
|
2016-06-21 17:47:01 -07:00
|
|
|
#endif
|
|
|
|
|
2008-01-30 13:32:58 +01:00
|
|
|
/* local pte updates need not use xchg for locking */
|
|
|
|
static inline pte_t native_local_ptep_get_and_clear(pte_t *ptep)
|
|
|
|
{
|
|
|
|
pte_t res = *ptep;
|
|
|
|
|
|
|
|
/* Pure native function needs no input for mm, addr */
|
|
|
|
native_pte_clear(NULL, 0, ptep);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
static inline pmd_t native_local_pmdp_get_and_clear(pmd_t *pmdp)
|
|
|
|
{
|
|
|
|
pmd_t res = *pmdp;
|
|
|
|
|
|
|
|
native_pmd_clear(pmdp);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline pud_t native_local_pudp_get_and_clear(pud_t *pudp)
|
|
|
|
{
|
|
|
|
pud_t res = *pudp;
|
|
|
|
|
|
|
|
native_pud_clear(pudp);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2017-09-04 12:25:27 +02:00
|
|
|
static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
|
|
|
|
pmd_t *pmdp, pmd_t pmd)
|
2011-01-13 15:46:35 -08:00
|
|
|
{
|
2023-07-14 01:26:35 +08:00
|
|
|
page_table_check_pmd_set(mm, pmdp, pmd);
|
2019-02-10 08:40:56 +01:00
|
|
|
set_pmd(pmdp, pmd);
|
2011-01-13 15:46:35 -08:00
|
|
|
}
|
|
|
|
|
2017-09-04 12:25:27 +02:00
|
|
|
static inline void set_pud_at(struct mm_struct *mm, unsigned long addr,
|
|
|
|
pud_t *pudp, pud_t pud)
|
2017-02-24 14:57:02 -08:00
|
|
|
{
|
2023-07-14 01:26:36 +08:00
|
|
|
page_table_check_pud_set(mm, pudp, pud);
|
2017-02-24 14:57:02 -08:00
|
|
|
native_set_pud(pudp, pud);
|
|
|
|
}
|
|
|
|
|
2008-01-30 13:32:58 +01:00
|
|
|
/*
|
|
|
|
* We only update the dirty/accessed state if we set
|
|
|
|
* the dirty bit by hand in the kernel, since the hardware
|
|
|
|
* will do the accessed bit for us, and we don't want to
|
|
|
|
* race with other CPU's that might be updating the dirty
|
|
|
|
* bit at the same time.
|
|
|
|
*/
|
2008-06-25 00:18:57 -04:00
|
|
|
struct vm_area_struct;
|
|
|
|
|
2008-01-30 13:32:58 +01:00
|
|
|
#define __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
|
2008-03-17 16:37:03 -07:00
|
|
|
extern int ptep_set_access_flags(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pte_t *ptep,
|
|
|
|
pte_t entry, int dirty);
|
2008-01-30 13:32:58 +01:00
|
|
|
|
|
|
|
#define __HAVE_ARCH_PTEP_TEST_AND_CLEAR_YOUNG
|
2008-03-17 16:37:04 -07:00
|
|
|
extern int ptep_test_and_clear_young(struct vm_area_struct *vma,
|
|
|
|
unsigned long addr, pte_t *ptep);
|
2008-01-30 13:32:58 +01:00
|
|
|
|
|
|
|
#define __HAVE_ARCH_PTEP_CLEAR_YOUNG_FLUSH
|
2008-03-17 16:37:05 -07:00
|
|
|
extern int ptep_clear_flush_young(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pte_t *ptep);
|
2008-01-30 13:32:58 +01:00
|
|
|
|
|
|
|
#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
|
|
|
|
pte_t *ptep)
|
2008-01-30 13:32:58 +01:00
|
|
|
{
|
|
|
|
pte_t pte = native_ptep_get_and_clear(ptep);
|
2023-07-14 01:26:31 +08:00
|
|
|
page_table_check_pte_clear(mm, pte);
|
2008-01-30 13:32:58 +01:00
|
|
|
return pte;
|
|
|
|
}
|
|
|
|
|
|
|
|
#define __HAVE_ARCH_PTEP_GET_AND_CLEAR_FULL
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm,
|
|
|
|
unsigned long addr, pte_t *ptep,
|
|
|
|
int full)
|
2008-01-30 13:32:58 +01:00
|
|
|
{
|
|
|
|
pte_t pte;
|
|
|
|
if (full) {
|
|
|
|
/*
|
|
|
|
* Full address destruction in progress; paravirt does not
|
|
|
|
* care about updates and native needs no locking
|
|
|
|
*/
|
|
|
|
pte = native_local_ptep_get_and_clear(ptep);
|
2023-07-14 01:26:31 +08:00
|
|
|
page_table_check_pte_clear(mm, pte);
|
2008-01-30 13:32:58 +01:00
|
|
|
} else {
|
|
|
|
pte = ptep_get_and_clear(mm, addr, ptep);
|
|
|
|
}
|
|
|
|
return pte;
|
|
|
|
}
|
|
|
|
|
|
|
|
#define __HAVE_ARCH_PTEP_SET_WRPROTECT
|
2008-03-23 01:03:12 -07:00
|
|
|
static inline void ptep_set_wrprotect(struct mm_struct *mm,
|
|
|
|
unsigned long addr, pte_t *ptep)
|
2008-01-30 13:32:58 +01:00
|
|
|
{
|
x86/mm: Update ptep/pmdp_set_wrprotect() for _PAGE_SAVED_DIRTY
When shadow stack is in use, Write=0,Dirty=1 PTE are preserved for
shadow stack. Copy-on-write PTEs then have Write=0,SavedDirty=1.
When a PTE goes from Write=1,Dirty=1 to Write=0,SavedDirty=1, it could
become a transient shadow stack PTE in two cases:
1. Some processors can start a write but end up seeing a Write=0 PTE by
the time they get to the Dirty bit, creating a transient shadow stack
PTE. However, this will not occur on processors supporting shadow
stack, and a TLB flush is not necessary.
2. When _PAGE_DIRTY is replaced with _PAGE_SAVED_DIRTY non-atomically, a
transient shadow stack PTE can be created as a result.
Prevent the second case when doing a write protection and Dirty->SavedDirty
shift at the same time with a CMPXCHG loop. The first case
Note, in the PAE case CMPXCHG will need to operate on 8 byte, but
try_cmpxchg() will not use CMPXCHG8B, so it cannot operate on a full PAE
PTE. However the exiting logic is not operating on a full 8 byte region
either, and relies on the fact that the Write bit is in the first 4
bytes when doing the clear_bit(). Since both the Dirty, SavedDirty and
Write bits are in the first 4 bytes, casting to a long will be similar to
the existing behavior which also casts to a long.
Dave Hansen, Jann Horn, Andy Lutomirski, and Peter Zijlstra provided many
insights to the issue. Jann Horn provided the CMPXCHG solution.
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-12-rick.p.edgecombe%40intel.com
2023-06-12 17:10:37 -07:00
|
|
|
/*
|
|
|
|
* Avoid accidentally creating shadow stack PTEs
|
|
|
|
* (Write=0,Dirty=1). Use cmpxchg() to prevent races with
|
|
|
|
* the hardware setting Dirty=1.
|
|
|
|
*/
|
|
|
|
pte_t old_pte, new_pte;
|
|
|
|
|
|
|
|
old_pte = READ_ONCE(*ptep);
|
|
|
|
do {
|
|
|
|
new_pte = pte_wrprotect(old_pte);
|
|
|
|
} while (!try_cmpxchg((long *)&ptep->pte, (long *)&old_pte, *(long *)&new_pte));
|
2008-01-30 13:32:58 +01:00
|
|
|
}
|
|
|
|
|
2023-03-06 17:15:48 +01:00
|
|
|
#define flush_tlb_fix_spurious_fault(vma, address, ptep) do { } while (0)
|
x86, mm: Avoid unnecessary TLB flush
In x86, access and dirty bits are set automatically by CPU when CPU accesses
memory. When we go into the code path of below flush_tlb_fix_spurious_fault(),
we already set dirty bit for pte and don't need flush tlb. This might mean
tlb entry in some CPUs hasn't dirty bit set, but this doesn't matter. When
the CPUs do page write, they will automatically check the bit and no software
involved.
On the other hand, flush tlb in below position is harmful. Test creates CPU
number of threads, each thread writes to a same but random address in same vma
range and we measure the total time. Under a 4 socket system, original time is
1.96s, while with the patch, the time is 0.8s. Under a 2 socket system, there is
20% time cut too. perf shows a lot of time are taking to send ipi/handle ipi for
tlb flush.
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
LKML-Reference: <20100816011655.GA362@sli10-desk.sh.intel.com>
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Cc: Andrea Archangeli <aarcange@redhat.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2010-08-16 09:16:55 +08:00
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
#define mk_pmd(page, pgprot) pfn_pmd(page_to_pfn(page), (pgprot))
|
|
|
|
|
|
|
|
#define __HAVE_ARCH_PMDP_SET_ACCESS_FLAGS
|
|
|
|
extern int pmdp_set_access_flags(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pmd_t *pmdp,
|
|
|
|
pmd_t entry, int dirty);
|
2017-02-24 14:57:02 -08:00
|
|
|
extern int pudp_set_access_flags(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pud_t *pudp,
|
|
|
|
pud_t entry, int dirty);
|
2011-01-13 15:47:01 -08:00
|
|
|
|
|
|
|
#define __HAVE_ARCH_PMDP_TEST_AND_CLEAR_YOUNG
|
|
|
|
extern int pmdp_test_and_clear_young(struct vm_area_struct *vma,
|
|
|
|
unsigned long addr, pmd_t *pmdp);
|
2017-02-24 14:57:02 -08:00
|
|
|
extern int pudp_test_and_clear_young(struct vm_area_struct *vma,
|
|
|
|
unsigned long addr, pud_t *pudp);
|
2011-01-13 15:47:01 -08:00
|
|
|
|
|
|
|
#define __HAVE_ARCH_PMDP_CLEAR_YOUNG_FLUSH
|
|
|
|
extern int pmdp_clear_flush_young(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pmd_t *pmdp);
|
|
|
|
|
|
|
|
|
2015-06-24 16:57:44 -07:00
|
|
|
#define __HAVE_ARCH_PMDP_HUGE_GET_AND_CLEAR
|
|
|
|
static inline pmd_t pmdp_huge_get_and_clear(struct mm_struct *mm, unsigned long addr,
|
2011-01-13 15:47:01 -08:00
|
|
|
pmd_t *pmdp)
|
|
|
|
{
|
2022-01-14 14:06:41 -08:00
|
|
|
pmd_t pmd = native_pmdp_get_and_clear(pmdp);
|
|
|
|
|
2023-07-14 01:26:32 +08:00
|
|
|
page_table_check_pmd_clear(mm, pmd);
|
2022-01-14 14:06:41 -08:00
|
|
|
|
|
|
|
return pmd;
|
2011-01-13 15:47:01 -08:00
|
|
|
}
|
|
|
|
|
2017-02-24 14:57:02 -08:00
|
|
|
#define __HAVE_ARCH_PUDP_HUGE_GET_AND_CLEAR
|
|
|
|
static inline pud_t pudp_huge_get_and_clear(struct mm_struct *mm,
|
|
|
|
unsigned long addr, pud_t *pudp)
|
|
|
|
{
|
2022-01-14 14:06:41 -08:00
|
|
|
pud_t pud = native_pudp_get_and_clear(pudp);
|
|
|
|
|
2023-07-14 01:26:33 +08:00
|
|
|
page_table_check_pud_clear(mm, pud);
|
2022-01-14 14:06:41 -08:00
|
|
|
|
|
|
|
return pud;
|
2017-02-24 14:57:02 -08:00
|
|
|
}
|
|
|
|
|
2011-01-13 15:47:01 -08:00
|
|
|
#define __HAVE_ARCH_PMDP_SET_WRPROTECT
|
|
|
|
static inline void pmdp_set_wrprotect(struct mm_struct *mm,
|
|
|
|
unsigned long addr, pmd_t *pmdp)
|
|
|
|
{
|
x86/mm: Update ptep/pmdp_set_wrprotect() for _PAGE_SAVED_DIRTY
When shadow stack is in use, Write=0,Dirty=1 PTE are preserved for
shadow stack. Copy-on-write PTEs then have Write=0,SavedDirty=1.
When a PTE goes from Write=1,Dirty=1 to Write=0,SavedDirty=1, it could
become a transient shadow stack PTE in two cases:
1. Some processors can start a write but end up seeing a Write=0 PTE by
the time they get to the Dirty bit, creating a transient shadow stack
PTE. However, this will not occur on processors supporting shadow
stack, and a TLB flush is not necessary.
2. When _PAGE_DIRTY is replaced with _PAGE_SAVED_DIRTY non-atomically, a
transient shadow stack PTE can be created as a result.
Prevent the second case when doing a write protection and Dirty->SavedDirty
shift at the same time with a CMPXCHG loop. The first case
Note, in the PAE case CMPXCHG will need to operate on 8 byte, but
try_cmpxchg() will not use CMPXCHG8B, so it cannot operate on a full PAE
PTE. However the exiting logic is not operating on a full 8 byte region
either, and relies on the fact that the Write bit is in the first 4
bytes when doing the clear_bit(). Since both the Dirty, SavedDirty and
Write bits are in the first 4 bytes, casting to a long will be similar to
the existing behavior which also casts to a long.
Dave Hansen, Jann Horn, Andy Lutomirski, and Peter Zijlstra provided many
insights to the issue. Jann Horn provided the CMPXCHG solution.
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-12-rick.p.edgecombe%40intel.com
2023-06-12 17:10:37 -07:00
|
|
|
/*
|
|
|
|
* Avoid accidentally creating shadow stack PTEs
|
|
|
|
* (Write=0,Dirty=1). Use cmpxchg() to prevent races with
|
|
|
|
* the hardware setting Dirty=1.
|
|
|
|
*/
|
|
|
|
pmd_t old_pmd, new_pmd;
|
2011-01-13 15:47:01 -08:00
|
|
|
|
x86/mm: Update ptep/pmdp_set_wrprotect() for _PAGE_SAVED_DIRTY
When shadow stack is in use, Write=0,Dirty=1 PTE are preserved for
shadow stack. Copy-on-write PTEs then have Write=0,SavedDirty=1.
When a PTE goes from Write=1,Dirty=1 to Write=0,SavedDirty=1, it could
become a transient shadow stack PTE in two cases:
1. Some processors can start a write but end up seeing a Write=0 PTE by
the time they get to the Dirty bit, creating a transient shadow stack
PTE. However, this will not occur on processors supporting shadow
stack, and a TLB flush is not necessary.
2. When _PAGE_DIRTY is replaced with _PAGE_SAVED_DIRTY non-atomically, a
transient shadow stack PTE can be created as a result.
Prevent the second case when doing a write protection and Dirty->SavedDirty
shift at the same time with a CMPXCHG loop. The first case
Note, in the PAE case CMPXCHG will need to operate on 8 byte, but
try_cmpxchg() will not use CMPXCHG8B, so it cannot operate on a full PAE
PTE. However the exiting logic is not operating on a full 8 byte region
either, and relies on the fact that the Write bit is in the first 4
bytes when doing the clear_bit(). Since both the Dirty, SavedDirty and
Write bits are in the first 4 bytes, casting to a long will be similar to
the existing behavior which also casts to a long.
Dave Hansen, Jann Horn, Andy Lutomirski, and Peter Zijlstra provided many
insights to the issue. Jann Horn provided the CMPXCHG solution.
Co-developed-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-12-rick.p.edgecombe%40intel.com
2023-06-12 17:10:37 -07:00
|
|
|
old_pmd = READ_ONCE(*pmdp);
|
|
|
|
do {
|
|
|
|
new_pmd = pmd_wrprotect(old_pmd);
|
|
|
|
} while (!try_cmpxchg((long *)pmdp, (long *)&old_pmd, *(long *)&new_pmd));
|
2017-11-29 16:10:06 -08:00
|
|
|
}
|
|
|
|
|
2018-01-31 16:18:13 -08:00
|
|
|
#ifndef pmdp_establish
|
|
|
|
#define pmdp_establish pmdp_establish
|
|
|
|
static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pmd_t *pmdp, pmd_t pmd)
|
|
|
|
{
|
2023-07-14 01:26:35 +08:00
|
|
|
page_table_check_pmd_set(vma->vm_mm, pmdp, pmd);
|
2018-01-31 16:18:13 -08:00
|
|
|
if (IS_ENABLED(CONFIG_SMP)) {
|
|
|
|
return xchg(pmdp, pmd);
|
|
|
|
} else {
|
|
|
|
pmd_t old = *pmdp;
|
2018-09-02 11:14:50 -07:00
|
|
|
WRITE_ONCE(*pmdp, pmd);
|
2018-01-31 16:18:13 -08:00
|
|
|
return old;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
2022-05-09 18:20:50 -07:00
|
|
|
|
|
|
|
#define __HAVE_ARCH_PMDP_INVALIDATE_AD
|
|
|
|
extern pmd_t pmdp_invalidate_ad(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pmd_t *pmdp);
|
|
|
|
|
2018-07-18 11:40:57 +02:00
|
|
|
/*
|
|
|
|
* Page table pages are page-aligned. The lower half of the top
|
|
|
|
* level is used for userspace and the top half for the kernel.
|
|
|
|
*
|
|
|
|
* Returns true for parts of the PGD that map userspace and
|
|
|
|
* false for the parts that map the kernel.
|
|
|
|
*/
|
|
|
|
static inline bool pgdp_maps_userspace(void *__ptr)
|
|
|
|
{
|
|
|
|
unsigned long ptr = (unsigned long)__ptr;
|
|
|
|
|
|
|
|
return (((ptr & ~PAGE_MASK) / sizeof(pgd_t)) < PGD_KERNEL_START);
|
|
|
|
}
|
|
|
|
|
2024-03-05 12:37:44 +08:00
|
|
|
#define pgd_leaf pgd_leaf
|
2024-03-05 12:37:50 +08:00
|
|
|
static inline bool pgd_leaf(pgd_t pgd) { return false; }
|
2018-01-31 16:18:13 -08:00
|
|
|
|
2023-11-21 08:07:31 -08:00
|
|
|
#ifdef CONFIG_MITIGATION_PAGE_TABLE_ISOLATION
|
2018-07-18 11:40:55 +02:00
|
|
|
/*
|
2023-11-21 08:07:31 -08:00
|
|
|
* All top-level MITIGATION_PAGE_TABLE_ISOLATION page tables are order-1 pages
|
2018-07-18 11:40:55 +02:00
|
|
|
* (8k-aligned and 8k in size). The kernel one is at the beginning 4k and
|
|
|
|
* the user one is in the last 4k. To switch between them, you
|
|
|
|
* just need to flip the 12th bit in their addresses.
|
|
|
|
*/
|
|
|
|
#define PTI_PGTABLE_SWITCH_BIT PAGE_SHIFT
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This generates better code than the inline assembly in
|
|
|
|
* __set_bit().
|
|
|
|
*/
|
|
|
|
static inline void *ptr_set_bit(void *ptr, int bit)
|
|
|
|
{
|
|
|
|
unsigned long __ptr = (unsigned long)ptr;
|
|
|
|
|
|
|
|
__ptr |= BIT(bit);
|
|
|
|
return (void *)__ptr;
|
|
|
|
}
|
|
|
|
static inline void *ptr_clear_bit(void *ptr, int bit)
|
|
|
|
{
|
|
|
|
unsigned long __ptr = (unsigned long)ptr;
|
|
|
|
|
|
|
|
__ptr &= ~BIT(bit);
|
|
|
|
return (void *)__ptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pgd_t *kernel_to_user_pgdp(pgd_t *pgdp)
|
|
|
|
{
|
|
|
|
return ptr_set_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pgd_t *user_to_kernel_pgdp(pgd_t *pgdp)
|
|
|
|
{
|
|
|
|
return ptr_clear_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline p4d_t *kernel_to_user_p4dp(p4d_t *p4dp)
|
|
|
|
{
|
|
|
|
return ptr_set_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline p4d_t *user_to_kernel_p4dp(p4d_t *p4dp)
|
|
|
|
{
|
|
|
|
return ptr_clear_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
|
|
|
|
}
|
2023-11-21 08:07:31 -08:00
|
|
|
#endif /* CONFIG_MITIGATION_PAGE_TABLE_ISOLATION */
|
2018-07-18 11:40:55 +02:00
|
|
|
|
2008-03-17 16:37:14 -07:00
|
|
|
/*
|
|
|
|
* clone_pgd_range(pgd_t *dst, pgd_t *src, int count);
|
|
|
|
*
|
2021-03-18 15:28:01 +01:00
|
|
|
* dst - pointer to pgd range anywhere on a pgd page
|
2008-03-17 16:37:14 -07:00
|
|
|
* src - ""
|
|
|
|
* count - the number of pgds to copy.
|
|
|
|
*
|
|
|
|
* dst and src can be on the same page, but the range must not overlap,
|
|
|
|
* and must not cross a page boundary.
|
|
|
|
*/
|
|
|
|
static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
|
|
|
|
{
|
2017-12-04 15:07:40 +01:00
|
|
|
memcpy(dst, src, count * sizeof(pgd_t));
|
2023-11-21 08:07:31 -08:00
|
|
|
#ifdef CONFIG_MITIGATION_PAGE_TABLE_ISOLATION
|
2017-12-04 15:07:40 +01:00
|
|
|
if (!static_cpu_has(X86_FEATURE_PTI))
|
|
|
|
return;
|
|
|
|
/* Clone the user space pgd as well */
|
|
|
|
memcpy(kernel_to_user_pgdp(dst), kernel_to_user_pgdp(src),
|
|
|
|
count * sizeof(pgd_t));
|
|
|
|
#endif
|
2008-03-17 16:37:14 -07:00
|
|
|
}
|
|
|
|
|
2013-01-22 13:24:31 -08:00
|
|
|
#define PTE_SHIFT ilog2(PTRS_PER_PTE)
|
|
|
|
static inline int page_level_shift(enum pg_level level)
|
|
|
|
{
|
|
|
|
return (PAGE_SHIFT - PTE_SHIFT) + level * PTE_SHIFT;
|
|
|
|
}
|
|
|
|
static inline unsigned long page_level_size(enum pg_level level)
|
|
|
|
{
|
|
|
|
return 1UL << page_level_shift(level);
|
|
|
|
}
|
|
|
|
static inline unsigned long page_level_mask(enum pg_level level)
|
|
|
|
{
|
|
|
|
return ~(page_level_size(level) - 1);
|
|
|
|
}
|
2008-03-17 16:37:14 -07:00
|
|
|
|
2012-12-18 12:22:18 -08:00
|
|
|
/*
|
|
|
|
* The x86 doesn't have any external MMU info: the kernel page
|
|
|
|
* tables contain all the necessary information.
|
|
|
|
*/
|
|
|
|
static inline void update_mmu_cache(struct vm_area_struct *vma,
|
|
|
|
unsigned long addr, pte_t *ptep)
|
|
|
|
{
|
|
|
|
}
|
2023-08-02 16:13:56 +01:00
|
|
|
static inline void update_mmu_cache_range(struct vm_fault *vmf,
|
|
|
|
struct vm_area_struct *vma, unsigned long addr,
|
|
|
|
pte_t *ptep, unsigned int nr)
|
|
|
|
{
|
|
|
|
}
|
2012-12-18 12:22:18 -08:00
|
|
|
static inline void update_mmu_cache_pmd(struct vm_area_struct *vma,
|
|
|
|
unsigned long addr, pmd_t *pmd)
|
|
|
|
{
|
|
|
|
}
|
2017-02-24 14:57:02 -08:00
|
|
|
static inline void update_mmu_cache_pud(struct vm_area_struct *vma,
|
|
|
|
unsigned long addr, pud_t *pud)
|
|
|
|
{
|
|
|
|
}
|
2022-05-09 18:20:46 -07:00
|
|
|
static inline pte_t pte_swp_mkexclusive(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_set_flags(pte, _PAGE_SWP_EXCLUSIVE);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pte_swp_exclusive(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_flags(pte) & _PAGE_SWP_EXCLUSIVE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_swp_clear_exclusive(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_clear_flags(pte, _PAGE_SWP_EXCLUSIVE);
|
|
|
|
}
|
2008-03-17 16:37:14 -07:00
|
|
|
|
2014-06-04 16:08:16 -07:00
|
|
|
#ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY
|
2013-09-11 14:22:47 -07:00
|
|
|
static inline pte_t pte_swp_mksoft_dirty(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_set_flags(pte, _PAGE_SWP_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pte_swp_soft_dirty(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_flags(pte) & _PAGE_SWP_SOFT_DIRTY;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_swp_clear_soft_dirty(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_clear_flags(pte, _PAGE_SWP_SOFT_DIRTY);
|
|
|
|
}
|
2017-09-08 16:11:04 -07:00
|
|
|
|
|
|
|
#ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
|
|
|
|
static inline pmd_t pmd_swp_mksoft_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_SWP_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pmd_swp_soft_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_flags(pmd) & _PAGE_SWP_SOFT_DIRTY;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_swp_clear_soft_dirty(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_clear_flags(pmd, _PAGE_SWP_SOFT_DIRTY);
|
|
|
|
}
|
|
|
|
#endif
|
2014-06-04 16:08:16 -07:00
|
|
|
#endif
|
2013-09-11 14:22:47 -07:00
|
|
|
|
2020-04-06 20:05:33 -07:00
|
|
|
#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP
|
|
|
|
static inline pte_t pte_swp_mkuffd_wp(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_set_flags(pte, _PAGE_SWP_UFFD_WP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pte_swp_uffd_wp(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_flags(pte) & _PAGE_SWP_UFFD_WP;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pte_t pte_swp_clear_uffd_wp(pte_t pte)
|
|
|
|
{
|
|
|
|
return pte_clear_flags(pte, _PAGE_SWP_UFFD_WP);
|
|
|
|
}
|
2020-04-06 20:05:57 -07:00
|
|
|
|
|
|
|
static inline pmd_t pmd_swp_mkuffd_wp(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_set_flags(pmd, _PAGE_SWP_UFFD_WP);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int pmd_swp_uffd_wp(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_flags(pmd) & _PAGE_SWP_UFFD_WP;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline pmd_t pmd_swp_clear_uffd_wp(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_clear_flags(pmd, _PAGE_SWP_UFFD_WP);
|
|
|
|
}
|
2020-04-06 20:05:33 -07:00
|
|
|
#endif /* CONFIG_HAVE_ARCH_USERFAULTFD_WP */
|
|
|
|
|
mm/gup, x86/mm/pkeys: Check VMAs and PTEs for protection keys
Today, for normal faults and page table walks, we check the VMA
and/or PTE to ensure that it is compatible with the action. For
instance, if we get a write fault on a non-writeable VMA, we
SIGSEGV.
We try to do the same thing for protection keys. Basically, we
try to make sure that if a user does this:
mprotect(ptr, size, PROT_NONE);
*ptr = foo;
they see the same effects with protection keys when they do this:
mprotect(ptr, size, PROT_READ|PROT_WRITE);
set_pkey(ptr, size, 4);
wrpkru(0xffffff3f); // access disable pkey 4
*ptr = foo;
The state to do that checking is in the VMA, but we also
sometimes have to do it on the page tables only, like when doing
a get_user_pages_fast() where we have no VMA.
We add two functions and expose them to generic code:
arch_pte_access_permitted(pte_flags, write)
arch_vma_access_permitted(vma, write)
These are, of course, backed up in x86 arch code with checks
against the PTE or VMA's protection key.
But, there are also cases where we do not want to respect
protection keys. When we ptrace(), for instance, we do not want
to apply the tracer's PKRU permissions to the PTEs from the
process being traced.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Alexey Kardashevskiy <aik@ozlabs.ru>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Boaz Harrosh <boaz@plexistor.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: David Gibson <david@gibson.dropbear.id.au>
Cc: David Hildenbrand <dahi@linux.vnet.ibm.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dominik Dingel <dingel@linux.vnet.ibm.com>
Cc: Dominik Vogt <vogt@linux.vnet.ibm.com>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jason Low <jason.low2@hp.com>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Matthew Wilcox <willy@linux.intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mikulas Patocka <mpatocka@redhat.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Shachar Raindel <raindel@mellanox.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: linux-arch@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: linux-s390@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Link: http://lkml.kernel.org/r/20160212210219.14D5D715@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-02-12 13:02:19 -08:00
|
|
|
static inline u16 pte_flags_pkey(unsigned long pte_flags)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
|
|
|
|
/* ifdef to avoid doing 59-bit shift on 32-bit values */
|
|
|
|
return (pte_flags & _PAGE_PKEY_MASK) >> _PAGE_BIT_PKEY_BIT0;
|
|
|
|
#else
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2017-06-06 14:31:20 +03:00
|
|
|
static inline bool __pkru_allows_pkey(u16 pkey, bool write)
|
|
|
|
{
|
|
|
|
u32 pkru = read_pkru();
|
|
|
|
|
|
|
|
if (!__pkru_allows_read(pkru, pkey))
|
|
|
|
return false;
|
|
|
|
if (write && !__pkru_allows_write(pkru, pkey))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* 'pteval' can come from a PTE, PMD or PUD. We only check
|
|
|
|
* _PAGE_PRESENT, _PAGE_USER, and _PAGE_RW in here which are the
|
|
|
|
* same value on all 3 types.
|
|
|
|
*/
|
|
|
|
static inline bool __pte_access_permitted(unsigned long pteval, bool write)
|
|
|
|
{
|
|
|
|
unsigned long need_pte_bits = _PAGE_PRESENT|_PAGE_USER;
|
|
|
|
|
mm: Don't allow write GUPs to shadow stack memory
The x86 Control-flow Enforcement Technology (CET) feature includes a
new type of memory called shadow stack. This shadow stack memory has
some unusual properties, which requires some core mm changes to
function properly.
In userspace, shadow stack memory is writable only in very specific,
controlled ways. However, since userspace can, even in the limited
ways, modify shadow stack contents, the kernel treats it as writable
memory. As a result, without additional work there would remain many
ways for userspace to trigger the kernel to write arbitrary data to
shadow stacks via get_user_pages(, FOLL_WRITE) based operations. To
help userspace protect their shadow stacks, make this a little less
exposed by blocking writable get_user_pages() operations for shadow
stack VMAs.
Still allow FOLL_FORCE to write through shadow stack protections, as it
does for read-only protections. This is required for debugging use
cases.
[ dhansen: fix rebase goof, readd writable_file_mapping_allowed() hunk ]
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Acked-by: David Hildenbrand <david@redhat.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: John Allen <john.allen@amd.com>
Tested-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20230613001108.3040476-23-rick.p.edgecombe%40intel.com
2023-06-12 17:10:48 -07:00
|
|
|
/*
|
|
|
|
* Write=0,Dirty=1 PTEs are shadow stack, which the kernel
|
|
|
|
* shouldn't generally allow access to, but since they
|
|
|
|
* are already Write=0, the below logic covers both cases.
|
|
|
|
*/
|
2017-06-06 14:31:20 +03:00
|
|
|
if (write)
|
|
|
|
need_pte_bits |= _PAGE_RW;
|
|
|
|
|
|
|
|
if ((pteval & need_pte_bits) != need_pte_bits)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return __pkru_allows_pkey(pte_flags_pkey(pteval), write);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define pte_access_permitted pte_access_permitted
|
|
|
|
static inline bool pte_access_permitted(pte_t pte, bool write)
|
|
|
|
{
|
|
|
|
return __pte_access_permitted(pte_val(pte), write);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define pmd_access_permitted pmd_access_permitted
|
|
|
|
static inline bool pmd_access_permitted(pmd_t pmd, bool write)
|
|
|
|
{
|
|
|
|
return __pte_access_permitted(pmd_val(pmd), write);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define pud_access_permitted pud_access_permitted
|
|
|
|
static inline bool pud_access_permitted(pud_t pud, bool write)
|
|
|
|
{
|
|
|
|
return __pte_access_permitted(pud_val(pud), write);
|
|
|
|
}
|
|
|
|
|
2018-06-13 15:48:27 -07:00
|
|
|
#define __HAVE_ARCH_PFN_MODIFY_ALLOWED 1
|
|
|
|
extern bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot);
|
|
|
|
|
|
|
|
static inline bool arch_has_pfn_modify_check(void)
|
|
|
|
{
|
|
|
|
return boot_cpu_has_bug(X86_BUG_L1TF);
|
|
|
|
}
|
|
|
|
|
2023-06-12 17:10:43 -07:00
|
|
|
#define arch_check_zapped_pte arch_check_zapped_pte
|
|
|
|
void arch_check_zapped_pte(struct vm_area_struct *vma, pte_t pte);
|
|
|
|
|
|
|
|
#define arch_check_zapped_pmd arch_check_zapped_pmd
|
|
|
|
void arch_check_zapped_pmd(struct vm_area_struct *vma, pmd_t pmd);
|
|
|
|
|
2022-11-23 07:45:10 +01:00
|
|
|
#ifdef CONFIG_XEN_PV
|
|
|
|
#define arch_has_hw_nonleaf_pmd_young arch_has_hw_nonleaf_pmd_young
|
|
|
|
static inline bool arch_has_hw_nonleaf_pmd_young(void)
|
|
|
|
{
|
|
|
|
return !cpu_feature_enabled(X86_FEATURE_XENPV);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2022-05-12 20:23:06 -07:00
|
|
|
#ifdef CONFIG_PAGE_TABLE_CHECK
|
|
|
|
static inline bool pte_user_accessible_page(pte_t pte)
|
|
|
|
{
|
|
|
|
return (pte_val(pte) & _PAGE_PRESENT) && (pte_val(pte) & _PAGE_USER);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool pmd_user_accessible_page(pmd_t pmd)
|
|
|
|
{
|
|
|
|
return pmd_leaf(pmd) && (pmd_val(pmd) & _PAGE_PRESENT) && (pmd_val(pmd) & _PAGE_USER);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline bool pud_user_accessible_page(pud_t pud)
|
|
|
|
{
|
|
|
|
return pud_leaf(pud) && (pud_val(pud) & _PAGE_PRESENT) && (pud_val(pud) & _PAGE_USER);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2023-09-22 09:29:59 +02:00
|
|
|
#ifdef CONFIG_X86_SGX
|
|
|
|
int arch_memory_failure(unsigned long pfn, int flags);
|
|
|
|
#define arch_memory_failure arch_memory_failure
|
|
|
|
|
|
|
|
bool arch_is_platform_page(u64 paddr);
|
|
|
|
#define arch_is_platform_page arch_is_platform_page
|
|
|
|
#endif
|
|
|
|
|
2008-01-30 13:32:58 +01:00
|
|
|
#endif /* __ASSEMBLY__ */
|
|
|
|
|
2008-10-22 22:26:29 -07:00
|
|
|
#endif /* _ASM_X86_PGTABLE_H */
|