From patchwork Mon Aug 30 23:59:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 12466129 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A174C43214 for ; Tue, 31 Aug 2021 00:00:01 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1528A61037 for ; Tue, 31 Aug 2021 00:00:00 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 1528A61037 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 518388D0001; Mon, 30 Aug 2021 20:00:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4C6F06B0072; Mon, 30 Aug 2021 20:00:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 390E78D0001; Mon, 30 Aug 2021 20:00:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0231.hostedemail.com [216.40.44.231]) by kanga.kvack.org (Postfix) with ESMTP id 274DE6B0071 for ; Mon, 30 Aug 2021 20:00:00 -0400 (EDT) Received: from smtpin37.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id B8A131EA02 for ; Mon, 30 Aug 2021 23:59:59 +0000 (UTC) X-FDA: 78533417718.37.316C9E9 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by imf14.hostedemail.com (Postfix) with ESMTP id E8589600198A for ; Mon, 30 Aug 2021 23:59:58 +0000 (UTC) X-IronPort-AV: E=McAfee;i="6200,9189,10092"; a="205504309" X-IronPort-AV: E=Sophos;i="5.84,364,1620716400"; d="scan'208";a="205504309" Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Aug 2021 16:59:57 -0700 X-IronPort-AV: E=Sophos;i="5.84,364,1620716400"; d="scan'208";a="530712788" Received: from ajinkyak-mobl2.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.212.240.95]) by fmsmga003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Aug 2021 16:59:56 -0700 From: Rick Edgecombe To: dave.hansen@intel.com, luto@kernel.org, peterz@infradead.org, x86@kernel.org, akpm@linux-foundation.org, keescook@chromium.org, shakeelb@google.com, vbabka@suse.cz, rppt@kernel.org Cc: Rick Edgecombe , linux-mm@kvack.org, linux-hardening@vger.kernel.org, kernel-hardening@lists.openwall.com, ira.weiny@intel.com, dan.j.williams@intel.com, linux-kernel@vger.kernel.org Subject: [RFC PATCH v2 00/19] PKS write protected page tables Date: Mon, 30 Aug 2021 16:59:08 -0700 Message-Id: <20210830235927.6443-1-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 Authentication-Results: imf14.hostedemail.com; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=intel.com (policy=none); spf=none (imf14.hostedemail.com: domain of rick.p.edgecombe@intel.com has no SPF policy when checking 134.134.136.126) smtp.mailfrom=rick.p.edgecombe@intel.com X-Stat-Signature: e5uuw9736w5zsqgqssr1xca9yr6dqp48 X-Rspamd-Queue-Id: E8589600198A X-Rspamd-Server: rspam04 X-HE-Tag: 1630367998-185592 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi, This is a second RFC for the PKS write protected tables concept. I'm sharing to show the progress to interested people. I'd also appreciate any comments, especially on the direct map page table protection solution (patch 17). Since v1[1], the improvements are: - Fully handle direct map page tables, and handle hotplug/unplug path. - Create a debug time checker that scans page tables and verifies their protection. - Fix odds-and-ends kernel page tables that showed up with debug checker. At this point all of the typical normal page tables should be protected. - Fix toggling of writablility for odds-and-ends page table modifications found that don't use the normal helpers. - Create atomic context grouped page allocator, after finding some page table allocations that are passing GFP_ATOMIC. - Create "soft" mode that warns and disables protection on violation instead of oopsing. - Boot parameters for disabling pks tables - Change PageTable set clear to ctor/dtor (peterz) - Remove VM_BUG_ON_PAGE in alloc_table() (Shakeel Butt) - PeterZ/Vlastimil had suggested to also build a non-PKS mode for use in debugging. I skipped it for now because the series was too big. - Rebased to latest PKS core v7 [2] Also, Mike Rapoport has been experimenting[3] with this usage to work on how to share caches of permissioned/broken pages between use cases. This RFCv2 still uses the "grouped pages" concept, where each usage would maintain its own cache, but should be able to integrate with a central solution if something is developed. Next I was planning to look into characterizing/tuning the performance, although what page allocation scheme is ultimately used will probably impact that. This applies on top of the PKS core v7 series[2] and this patch[4]. Testing is still pretty light. This RFC has been acked by Dave Hansen. [1] https://lore.kernel.org/lkml/20210505003032.489164-1-rick.p.edgecombe@intel.com/ [2] https://lore.kernel.org/lkml/20210804043231.2655537-1-ira.weiny@intel.com/ [3] https://lore.kernel.org/lkml/20210823132513.15836-1-rppt@kernel.org/ [4] https://lore.kernel.org/lkml/20210818221026.10794-1-rick.p.edgecombe@intel.com/ Rick Edgecombe (19): list: Support getting most recent element in list_lru list: Support list head not in object for list_lru x86/mm/cpa: Add grouped page allocations mm: Explicitly zero page table lock ptr x86, mm: Use cache of page tables x86/mm/cpa: Add perm callbacks to grouped pages x86/cpufeatures: Add feature for pks tables x86/mm/cpa: Add get_grouped_page_atomic() x86/mm: Support GFP_ATOMIC in alloc_table_node() x86/mm: Use alloc_table() for fill_pte(), etc mm/sparsemem: Use alloc_table() for table allocations x86/mm: Use free_table in unmap path mm/debug_vm_page_table: Use setters instead of WRITE_ONCE x86/efi: Toggle table protections when copying x86/mm/cpa: Add set_memory_pks() x86/mm: Protect page tables with PKS x86/mm/cpa: PKS protect direct map page tables x86/mm: Add PKS table soft mode x86/mm: Add PKS table debug checking .../admin-guide/kernel-parameters.txt | 4 + arch/x86/boot/compressed/ident_map_64.c | 5 + arch/x86/include/asm/cpufeatures.h | 2 +- arch/x86/include/asm/pgalloc.h | 6 +- arch/x86/include/asm/pgtable.h | 31 +- arch/x86/include/asm/pgtable_64.h | 33 +- arch/x86/include/asm/pkeys_common.h | 1 - arch/x86/include/asm/set_memory.h | 24 + arch/x86/mm/init.c | 90 +++ arch/x86/mm/init_64.c | 29 +- arch/x86/mm/pat/set_memory.c | 527 +++++++++++++++++- arch/x86/mm/pgtable.c | 183 +++++- arch/x86/mm/pkeys.c | 4 + arch/x86/platform/efi/efi_64.c | 8 + include/asm-generic/pgalloc.h | 46 +- include/linux/list_lru.h | 26 + include/linux/mm.h | 16 +- include/linux/pkeys.h | 1 + mm/Kconfig | 23 + mm/debug_vm_pgtable.c | 36 +- mm/list_lru.c | 38 +- mm/memory.c | 1 + mm/sparse-vmemmap.c | 22 +- mm/swap.c | 6 + mm/swap_state.c | 5 + .../arch/x86/include/asm/disabled-features.h | 8 +- 26 files changed, 1123 insertions(+), 52 deletions(-)