[v12,00/11] Support page table check PowerPC

Message

Rohan McLure April 2, 2024, 5:11 a.m. UTC

Support page table check on all PowerPC platforms. This works by
serialising assignments, reassignments and clears of page table
entries at each level in order to ensure that anonymous mappings
have at most one writable consumer, and likewise that file-backed
mappings are not simultaneously also anonymous mappings.

In order to support this infrastructure, a number of stubs must be
defined for all powerpc platforms. Additionally, seperate set_pte_at()
and set_pte_at_unchecked(), to allow for internal, uninstrumented mappings.

v12:
 * Rename commits that revert changes to instead reflect that we are
   reinstating old behaviour due to it providing more flexibility
 * Add return line to pud_pfn() stub
 * Instrument ptep_get_and_clear() for nohash

v11:
 * The pud_pfn() stub, which previously had no legitimate users on any
   powerpc platform, now has users in Book3s64 with transparent pages.
   Include a stub of the same name for each platform that does not
   define their own.
 * Drop patch that standardised use of p*d_leaf(), as already included
   upstream in v6.9.
 * Provide fallback definitions of p{m,u}d_user_accessible_page() that
   do not reference p*d_leaf(), p*d_pte(), as they are defined after
   powerpc/mm headers by linux/mm headers.
 * Ensure that set_pte_at_unchecked() has the same checks as
   set_pte_at().
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/ 

v10:
 * Revert patches that removed address and mm parameters from page table
   check routines, including consuming code from arm64, x86_64 and
   riscv.
 * Implement *_user_accessible_page() routines in terms of pte_user()
   where available (64-bit, book3s) but otherwise by checking the
   address (on platforms where the pte does not imply whether the
   mapping is for user or kernel) 
 * Internal set_pte_at() calls replaced with set_pte_at_unchecked(), which
   is identical, but prevents double instrumentation.
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/T/

v9:
 * Adapt to using the set_ptes() API, using __set_pte_at() where we need
   must avoid instrumentation.
 * Use the logic of *_access_permitted() for implementing
   *_user_accessible_page(), which are required routines for page table
   check.
 * Even though we no longer need p{m,u,4}d_leaf(), still default
   implement these to assist in refactoring out extant
   p{m,u,4}_is_leaf().
 * Add p{m,u}_pte() stubs where asm-generic does not provide them, as
   page table check wants all *user_accessible_page() variants, and we
   would like to default implement the variants in terms of
   pte_user_accessible_page().
 * Avoid the ugly pmdp_collapse_flush() macro nonsense! Just instrument
   its constituent calls instead for radix and hash.
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/

v8:
 * Fix linux/page_table_check.h include in asm/pgtable.h breaking
   32-bit.
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/

v7:
 * Remove use of extern in set_pte prototypes
 * Clean up pmdp_collapse_flush macro
 * Replace set_pte_at with static inline function
 * Fix commit message for patch 7
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/

v6:
 * Support huge pages and p{m,u}d accounting.
 * Remove instrumentation from set_pte from kernel internal pages.
 * 64s: Implement pmdp_collapse_flush in terms of __pmdp_collapse_flush
   as access to the mm_struct * is required.
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/

v5:
Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/

Rohan McLure (11):
  mm/page_table_check: Reinstate address parameter in
    [__]page_table_check_pud_set()
  mm/page_table_check: Reinstate address parameter in
    [__]page_table_check_pmd_set()
  mm/page_table_check: Provide addr parameter to
    page_table_check_pte_set()
  mm/page_table_check: Reinstate address parameter in
    [__]page_table_check_pud_clear()
  mm/page_table_check: Reinstate address parameter in
    [__]page_table_check_pmd_clear()
  mm/page_table_check: Reinstate address parameter in
    [__]page_table_check_pte_clear()
  mm: Provide address parameter to p{te,md,ud}_user_accessible_page()
  powerpc: mm: Add pud_pfn() stub
  poweprc: mm: Implement *_user_accessible_page() for ptes
  powerpc: mm: Use set_pte_at_unchecked() for early-boot / internal
    usages
  powerpc: mm: Support page table check

 arch/arm64/include/asm/pgtable.h             | 18 +++---
 arch/powerpc/Kconfig                         |  1 +
 arch/powerpc/include/asm/book3s/32/pgtable.h | 12 +++-
 arch/powerpc/include/asm/book3s/64/pgtable.h | 62 +++++++++++++++---
 arch/powerpc/include/asm/nohash/pgtable.h    | 13 +++-
 arch/powerpc/include/asm/pgtable.h           | 19 ++++++
 arch/powerpc/mm/book3s64/hash_pgtable.c      |  6 +-
 arch/powerpc/mm/book3s64/pgtable.c           | 17 +++--
 arch/powerpc/mm/book3s64/radix_pgtable.c     | 11 ++--
 arch/powerpc/mm/nohash/book3e_pgtable.c      |  2 +-
 arch/powerpc/mm/pgtable.c                    | 12 ++++
 arch/powerpc/mm/pgtable_32.c                 |  2 +-
 arch/riscv/include/asm/pgtable.h             | 18 +++---
 arch/x86/include/asm/pgtable.h               | 20 +++---
 include/linux/page_table_check.h             | 67 ++++++++++++--------
 include/linux/pgtable.h                      |  8 +--
 mm/page_table_check.c                        | 39 +++++++-----
 17 files changed, 228 insertions(+), 99 deletions(-)

Comments

Pasha Tatashin April 3, 2024, 11:17 p.m. UTC | #1

On Tue, Apr 2, 2024 at 1:11 AM Rohan McLure <[e-mail]> wrote:
>
> This reverts commit 6d144436d954 ("mm/page_table_check: remove unused
> parameter in [__]page_table_check_pud_set").
>
> Reinstate previously unused parameters for the purpose of supporting
> powerpc platforms, as many do not encode user/kernel ownership of the
> page in the pte, but instead in the address of the access.
>
> riscv: Respect change to delete mm, addr parameters from __set_pte_at()
>
> This commit also changed calls to __set_pte_at() to use fewer parameters
> on riscv. Keep that change rather than reverting it, as the signature of
> __set_pte_at() is changed in a different commit.
>
> Signed-off-by: Rohan McLure <[e-mail]>

Reviewed-by: Pasha Tatashin <[e-mail]>

For some reason this one was not delivered to the linux-mm mailing list.

Pasha

Pasha Tatashin April 3, 2024, 11:24 p.m. UTC | #2

All patches in this series should be also CC'd to [e-mail].

Pasha Tatashin April 3, 2024, 11:26 p.m. UTC | #3

On Tue, Apr 2, 2024 at 1:11 AM Rohan McLure <[e-mail]> wrote:
>
> This reverts commit 1831414cd729 ("mm/page_table_check: remove unused
> parameter in [__]page_table_check_pmd_clear").
>
> Reinstate previously unused parameters for the purpose of supporting
> powerpc platforms, as many do not encode user/kernel ownership of the
> page in the pte, but instead in the address of the access.
>
> Signed-off-by: Rohan McLure <[e-mail]>

Reviewed-by: Pasha Tatashin <[e-mail]>

Pasha Tatashin April 3, 2024, 11:46 p.m. UTC | #4

On Tue, Apr 2, 2024 at 1:11 AM Rohan McLure <[e-mail]> wrote:
>
> This reverts commit aa232204c468 ("mm/page_table_check: remove unused
> parameter in [__]page_table_check_pte_clear").
>
> Reinstate previously unused parameters for the purpose of supporting
> powerpc platforms, as many do not encode user/kernel ownership of the
> page in the pte, but instead in the address of the access.
>
> Signed-off-by: Rohan McLure <[e-mail]>

Reviewed-by: Pasha Tatashin <[e-mail]>

Pasha Tatashin April 3, 2024, 11:55 p.m. UTC | #5

On Tue, Apr 2, 2024 at 1:11 AM Rohan McLure <[e-mail]> wrote:
>
> The page table check feature requires that pud_pfn() be defined
> on each consuming architecture. Since only 64-bit, Book3S platforms
> allow for hugepages at this upper level, and since the calling code is
> gated by a call to pud_user_accessible_page(), which will return zero,
> include this stub as a BUILD_BUG().
>
> Signed-off-by: Rohan McLure <[e-mail]>

Reviewed-by: Pasha Tatashin <[e-mail]>

LEROY Christophe June 18, 2024, 1:09 p.m. UTC | #6

Le 02/04/2024 à 07:11, Rohan McLure a écrit :
> Support page table check on all PowerPC platforms. This works by
> serialising assignments, reassignments and clears of page table
> entries at each level in order to ensure that anonymous mappings
> have at most one writable consumer, and likewise that file-backed
> mappings are not simultaneously also anonymous mappings.
> 
> In order to support this infrastructure, a number of stubs must be
> defined for all powerpc platforms. Additionally, seperate set_pte_at()
> and set_pte_at_unchecked(), to allow for internal, uninstrumented mappings.

Seems like this series doesn't apply, patch 1 has conflict with RISCV, 
patch 2 with mm and RISCV.

Please rebase as appropriate.

Christophe

> 
> v12:
>   * Rename commits that revert changes to instead reflect that we are
>     reinstating old behaviour due to it providing more flexibility
>   * Add return line to pud_pfn() stub
>   * Instrument ptep_get_and_clear() for nohash
> 
> v11:
>   * The pud_pfn() stub, which previously had no legitimate users on any
>     powerpc platform, now has users in Book3s64 with transparent pages.
>     Include a stub of the same name for each platform that does not
>     define their own.
>   * Drop patch that standardised use of p*d_leaf(), as already included
>     upstream in v6.9.
>   * Provide fallback definitions of p{m,u}d_user_accessible_page() that
>     do not reference p*d_leaf(), p*d_pte(), as they are defined after
>     powerpc/mm headers by linux/mm headers.
>   * Ensure that set_pte_at_unchecked() has the same checks as
>     set_pte_at().
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/
> 
> v10:
>   * Revert patches that removed address and mm parameters from page table
>     check routines, including consuming code from arm64, x86_64 and
>     riscv.
>   * Implement *_user_accessible_page() routines in terms of pte_user()
>     where available (64-bit, book3s) but otherwise by checking the
>     address (on platforms where the pte does not imply whether the
>     mapping is for user or kernel)
>   * Internal set_pte_at() calls replaced with set_pte_at_unchecked(), which
>     is identical, but prevents double instrumentation.
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/T/
> 
> v9:
>   * Adapt to using the set_ptes() API, using __set_pte_at() where we need
>     must avoid instrumentation.
>   * Use the logic of *_access_permitted() for implementing
>     *_user_accessible_page(), which are required routines for page table
>     check.
>   * Even though we no longer need p{m,u,4}d_leaf(), still default
>     implement these to assist in refactoring out extant
>     p{m,u,4}_is_leaf().
>   * Add p{m,u}_pte() stubs where asm-generic does not provide them, as
>     page table check wants all *user_accessible_page() variants, and we
>     would like to default implement the variants in terms of
>     pte_user_accessible_page().
>   * Avoid the ugly pmdp_collapse_flush() macro nonsense! Just instrument
>     its constituent calls instead for radix and hash.
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/
> 
> v8:
>   * Fix linux/page_table_check.h include in asm/pgtable.h breaking
>     32-bit.
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/
> 
> v7:
>   * Remove use of extern in set_pte prototypes
>   * Clean up pmdp_collapse_flush macro
>   * Replace set_pte_at with static inline function
>   * Fix commit message for patch 7
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/
> 
> v6:
>   * Support huge pages and p{m,u}d accounting.
>   * Remove instrumentation from set_pte from kernel internal pages.
>   * 64s: Implement pmdp_collapse_flush in terms of __pmdp_collapse_flush
>     as access to the mm_struct * is required.
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/
> 
> v5:
> Link: https://lore.kernel.org/linuxppc-dev/[e-mail]/
> 
> Rohan McLure (11):
>    mm/page_table_check: Reinstate address parameter in
>      [__]page_table_check_pud_set()
>    mm/page_table_check: Reinstate address parameter in
>      [__]page_table_check_pmd_set()
>    mm/page_table_check: Provide addr parameter to
>      page_table_check_pte_set()
>    mm/page_table_check: Reinstate address parameter in
>      [__]page_table_check_pud_clear()
>    mm/page_table_check: Reinstate address parameter in
>      [__]page_table_check_pmd_clear()
>    mm/page_table_check: Reinstate address parameter in
>      [__]page_table_check_pte_clear()
>    mm: Provide address parameter to p{te,md,ud}_user_accessible_page()
>    powerpc: mm: Add pud_pfn() stub
>    poweprc: mm: Implement *_user_accessible_page() for ptes
>    powerpc: mm: Use set_pte_at_unchecked() for early-boot / internal
>      usages
>    powerpc: mm: Support page table check
> 
>   arch/arm64/include/asm/pgtable.h             | 18 +++---
>   arch/powerpc/Kconfig                         |  1 +
>   arch/powerpc/include/asm/book3s/32/pgtable.h | 12 +++-
>   arch/powerpc/include/asm/book3s/64/pgtable.h | 62 +++++++++++++++---
>   arch/powerpc/include/asm/nohash/pgtable.h    | 13 +++-
>   arch/powerpc/include/asm/pgtable.h           | 19 ++++++
>   arch/powerpc/mm/book3s64/hash_pgtable.c      |  6 +-
>   arch/powerpc/mm/book3s64/pgtable.c           | 17 +++--
>   arch/powerpc/mm/book3s64/radix_pgtable.c     | 11 ++--
>   arch/powerpc/mm/nohash/book3e_pgtable.c      |  2 +-
>   arch/powerpc/mm/pgtable.c                    | 12 ++++
>   arch/powerpc/mm/pgtable_32.c                 |  2 +-
>   arch/riscv/include/asm/pgtable.h             | 18 +++---
>   arch/x86/include/asm/pgtable.h               | 20 +++---
>   include/linux/page_table_check.h             | 67 ++++++++++++--------
>   include/linux/pgtable.h                      |  8 +--
>   mm/page_table_check.c                        | 39 +++++++-----
>   17 files changed, 228 insertions(+), 99 deletions(-)
>