lkml.org 
[lkml]   [2020]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [RFC PATCH v9 14/27] mm: Handle Shadow Stack page fault
    From
    Date
    On Tue, 2020-04-07 at 15:21 -0700, Dave Hansen wrote:
    > On 4/7/20 11:14 AM, Yu-cheng Yu wrote:
    > > On Wed, 2020-02-26 at 16:08 -0800, Dave Hansen wrote:
    > > > > diff --git a/mm/memory.c b/mm/memory.c
    > > > > index 45442d9a4f52..6daa28614327 100644
    > > > > --- a/mm/memory.c
    > > > > +++ b/mm/memory.c
    > > > > @@ -772,7 +772,8 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
    > > > > * If it's a COW mapping, write protect it both
    > > > > * in the parent and the child
    > > > > */
    > > > > - if (is_cow_mapping(vm_flags) && pte_write(pte)) {
    > > > > + if ((is_cow_mapping(vm_flags) && pte_write(pte)) ||
    > > > > + arch_copy_pte_mapping(vm_flags)) {
    > > > > ptep_set_wrprotect(src_mm, addr, src_pte);
    > > > > pte = pte_wrprotect(pte);
    > > > > }
    > > >
    > > > You have to modify this because pte_write()==0 for shadow stack PTEs, right?
    > > >
    > > > Aren't shadow stack ptes *logically* writable, even if they don't have
    > > > the write bit set? What would happen if we made pte_write()==1 for them?
    > >
    > > Here the vm_flags needs to have VM_MAYWRITE, and the PTE needs to have
    > > _PAGE_WRITE. A shadow stack does not have either.
    >
    > I literally mean taking pte_write(), and doing something l
    >
    > static inline int pte_write(pte_t pte)
    > {
    > if (pte_present(pte) && pte_is_shadow_stack(pte))
    > return 1;
    >
    > return pte_flags(pte) & _PAGE_RW;
    > }
    >
    > Then if is_cow_mapping() returns true for shadow stack VMAs, the above
    > code doesn't need to change.

    One benefit of this change is can_follow_write_pte() does not need any changes.
    A shadow stack PTE not in copy-on-write status is pte_write().

    However, there are places that use pte_write() to determine if the PTE can be
    made _PAGE_RW. One such case is in change_pte_range(), where

    preserve_write = prot_numa && pte_write(oldpte);

    and later,

    if (preserve_write)
    ptent = pte_mk_savedwrite(ptent);

    Currently, there are other checks and shadow stack PTEs won't become _PAGE_RW.
    I am wondering if this can be overlooked later when the code is modified.

    Another potential issue is, because pte_write()==1, a shadow stack PTE is made a
    write migration entry, and can later accidentally become _PAGE_RW. I think the
    page fault handler would catch that, but still call it out in case I miss
    anything.

    Yu-cheng

    \
     
     \ /
      Last update: 2020-04-08 20:19    [W:2.796 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site