| Message ID | 20220130211838.8382-20-rick.p.edgecombe@intel.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Shadow stacks for userspace | expand |
On 1/30/22 13:18, Rick Edgecombe wrote: > +bool is_shadow_stack_mapping(vm_flags_t vm_flags) > +{ > + return vm_flags & VM_SHADOW_STACK; > +} > diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h > index bc8713a76e03..21fdb1273571 100644 > --- a/include/linux/pgtable.h > +++ b/include/linux/pgtable.h > @@ -911,6 +911,14 @@ static inline void ptep_modify_prot_commit(struct vm_area_struct *vma, > __ptep_modify_prot_commit(vma, addr, ptep, pte); > } > #endif /* __HAVE_ARCH_PTEP_MODIFY_PROT_TRANSACTION */ > + > +#ifndef is_shadow_stack_mapping > +static inline bool is_shadow_stack_mapping(vm_flags_t vm_flags) > +{ > + return false; > +} > +#endif Hold your horses there. Remember: +#ifdef CONFIG_X86_SHADOW_STACK +# define VM_SHADOW_STACK VM_HIGH_ARCH_5 +#else +# define VM_SHADOW_STACK VM_NONE +#endif Plus: #define VM_NONE 0x00000000 That means the arch-generic version, when CONFIG_X86_SHADOW_STACK is off compiles down to: bool is_shadow_stack_mapping(vm_flags_t vm_flags) { return vm_flags & 0x00000000; } I _suspect_ the compiler *might* compile that down to the same thing as: return false; So, why not just have one version, no additional #ifdefs, and be done with it? Heck, why have the helper in the first place? Just check VM_SHADOW_STACK directly.
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 36166bdd0b98..55641498485c 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -1666,6 +1666,9 @@ static inline bool arch_faults_on_old_pte(void) #define maybe_mkwrite maybe_mkwrite extern pte_t maybe_mkwrite(pte_t pte, struct vm_area_struct *vma); +#define is_shadow_stack_mapping is_shadow_stack_mapping +extern bool is_shadow_stack_mapping(vm_flags_t vm_flags); + #endif /* __ASSEMBLY__ */ #endif /* _ASM_X86_PGTABLE_H */ diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c index c22c8e9c37e8..61a364b9ae0a 100644 --- a/arch/x86/mm/pgtable.c +++ b/arch/x86/mm/pgtable.c @@ -884,3 +884,8 @@ int pmd_free_pte_page(pmd_t *pmd, unsigned long addr) #endif /* CONFIG_X86_64 */ #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ + +bool is_shadow_stack_mapping(vm_flags_t vm_flags) +{ + return vm_flags & VM_SHADOW_STACK; +} diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h index bc8713a76e03..21fdb1273571 100644 --- a/include/linux/pgtable.h +++ b/include/linux/pgtable.h @@ -911,6 +911,14 @@ static inline void ptep_modify_prot_commit(struct vm_area_struct *vma, __ptep_modify_prot_commit(vma, addr, ptep, pte); } #endif /* __HAVE_ARCH_PTEP_MODIFY_PROT_TRANSACTION */ + +#ifndef is_shadow_stack_mapping +static inline bool is_shadow_stack_mapping(vm_flags_t vm_flags) +{ + return false; +} +#endif + #endif /* CONFIG_MMU */ /* diff --git a/mm/mmap.c b/mm/mmap.c index 1e8fdb0b51ed..9bab326332af 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1716,6 +1716,9 @@ static inline int accountable_mapping(struct file *file, vm_flags_t vm_flags) if (file && is_file_hugepages(file)) return 0; + if (is_shadow_stack_mapping(vm_flags)) + return 1; + return (vm_flags & (VM_NORESERVE | VM_SHARED | VM_WRITE)) == VM_WRITE; } @@ -3345,6 +3348,8 @@ void vm_stat_account(struct mm_struct *mm, vm_flags_t flags, long npages) mm->stack_vm += npages; else if (is_data_mapping(flags)) mm->data_vm += npages; + else if (is_shadow_stack_mapping(flags)) + mm->stack_vm += npages; } static vm_fault_t special_mapping_fault(struct vm_fault *vmf);