Messages in this thread | | | Subject | Re: [PATCH v28 09/32] x86/mm: Introduce _PAGE_COW | From | "Yu, Yu-cheng" <> | Date | Tue, 17 Aug 2021 11:24:29 -0700 |
| |
On 8/16/2021 3:43 AM, Borislav Petkov wrote: > On Thu, Jul 22, 2021 at 01:51:56PM -0700, Yu-cheng Yu wrote: >> @@ -153,13 +178,23 @@ static inline int pud_young(pud_t pud) >> >> static inline int pte_write(pte_t pte) >> { >> - return pte_flags(pte) & _PAGE_RW; >> + /* >> + * Shadow stack pages are always writable - but not by normal >> + * instructions, and only by shadow stack operations. Therefore, >> + * the W=0,D=1 test with pte_shstk(). >> + */ >> + return (pte_flags(pte) & _PAGE_RW) || pte_shstk(pte); > > Well, this is weird: if some kernel code queries a shstk page and this > here function says it is writable but then goes and tries to write into > it and that write fails, then it'll confuse the user. > > IOW, from where I'm standing, that should be: > > return (pte_flags(pte) & _PAGE_RW) && !pte_shstk(pte); > > as in, a writable page is one which has _PAGE_RW and it is *not* a > shadow stack page because latter is special and not really writable. > > Hmmm? >
Indeed, this can be looked at in a few ways. We can visualize pte_write() as 'CPU can write to it with MOV' or 'CPU can write to it with any opcodes'. Depending on whatever pte_write() is, copy-on-write code can be adjusted accordingly.
Yu-cheng
| |