From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D556C1474A9 for ; Thu, 9 Jan 2025 07:17:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736407069; cv=none; b=aoKugji0DWaRkG8r43XkJpxmcrcCsFhQCKuBHuMU9GivLDm/jtB1d0/6Q8QHMk0lEhurunFWAsNRU14LpJhT3U9krJmHQVKi2vAmD+Nuoghr84AY6iMu2BoOm5mtXRoTICWm3dA3uK/uZJgv8ZMosZrTGJ2ANFZqFCKD90L+v70= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736407069; c=relaxed/simple; bh=8gVcxzeqzL/+fcERlltM6grRSzLHAAtdaECOnc63yrM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=l+7lfp/WLBXxoCSZlo5JpKN0RcQuyQoF/yRHXAjdiy1v36qBwqZn8iLunwLD0qlVkfwfk94+/PhmnNEonFsXlS7pNLKZvliTWETlW52cq54Ss6IaT6oYLTi+aRcb/aXD5ObXeS/A1dnyU7UzmyRfEFGs95pM1n7RN1hJuHwjSzY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=ZdgOnCB1; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="ZdgOnCB1" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-2ee76befe58so1006784a91.2 for ; Wed, 08 Jan 2025 23:17:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1736407066; x=1737011866; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=goDrdg8W+niPDn8ee1CTbptL4R9YVIAcGFLpDdY+Uh8=; b=ZdgOnCB1hBn1oxXNNPsuhDzxDNs4GfZUBnWgnLRLusOgyleBeEkfDb/XTKiBFV/37v 6MhCw87QqTWJMj6ZNOdvdt58wTRz6qEzVNkRCDUhA5w0S7pwt1PbysjZXg+indAg4MuK mxNbtDGnsxkkCh7RMVtW+1/fHXc2/b9MnaYIHSUAcQiSlNyUoo4goV0Jaa3A4Tg7s0S3 9EYorCE5XkEbSu/v/J2yLEKJ/xqhgRfl2Mn0LeOOHGByOHend7hv2DFgWyVCTLB6ecIQ 21rJ9f+VPqa4O071ab8bvHFlpJY+jDJAQBpzrqo+CphSQ5dvCRyAr+jxeNfJskNEPHQF tJeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736407066; x=1737011866; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=goDrdg8W+niPDn8ee1CTbptL4R9YVIAcGFLpDdY+Uh8=; b=f3YyRctyGy6NeED0ThscNyXZc0j3Gcs0fj9e+nX3VvePBDFC1s5Jn4won4pu17DZzz q+ehBcagYtVva8w6RiYzNPeu4a+V+o243metqqEkIq+5G927mITeHotNc3ak0mUbxEcz iFK9JXqu1yr94VpdPlZLtvv1GUAoq+sxUrQRDznyLjk/cOgsvQ7vY5tgkEz1I1uSVHo+ qMhekwukPhBd0d8WZ/HcMZEuLBhBwumc8u0glUv+U0XBMmRV90ad1vYCcXLOJGGJyWYY rEk0S2UQ574ItLyhReqILkw7Myf8YsUdtqKFE966gm2XqgafFkYK6rW3UDZ0oNCAYNcp o2Tg== X-Forwarded-Encrypted: i=1; AJvYcCUTwHlOjfCXZ5gppBU6o+qozlKzj08OkLgGXQYhbWCwx0oHNEcWTtkQNOlqL+5xaCY3II3iQBA6ZohABlY=@vger.kernel.org X-Gm-Message-State: AOJu0YxlkqdmJd64BJtL4taOZLn1fWAT1UwadFwvzs0POz+hEg8uEet6 Z/VsvpSEt6QyyBBL/kt1EfXhKV2B0zIawDFFpfYcFddbWDtRzgz6EBPmZXjYi0w= X-Gm-Gg: ASbGncuOAgFE5LXV0Dq6qD0MIL3Ywn/IXAtHa3O8GbZxLXvnpJakgiOGf+nipEOgXsK oREezQ2No67JLvPo6pYshHfBC2asohA/+vynt8V8C+ll2LWprVEZ8V9yi8AuJdYnF3oHfiV4YQ0 cENpvD/66JnDQ1E3SNEDJLy3t81f2CxF8jd2QKI3EAfK+axbzSHI27vksMnz7wesGVHmld6Dzj1 eGXbWpfCMdDGVtlnU5LE6Cty1DD5tJg5mdv8GcU9VrAq027zQFm5MwFnFooXnHZHjkGVhS/lqOj pKIk X-Google-Smtp-Source: AGHT+IEsAuvKeLfnjNnQ0YmOJjZ/KDeiDHrFAudvPLzZf1ylAUBvPZmXYBm85/H4yI4Dr4XRcKGbcw== X-Received: by 2002:a05:6a00:3910:b0:728:e906:e446 with SMTP id d2e1a72fcca58-72d220077b5mr9905948b3a.24.1736407066229; Wed, 08 Jan 2025 23:17:46 -0800 (PST) Received: from [10.4.51.182] ([139.177.225.244]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-72aad848020sm36417198b3a.81.2025.01.08.23.17.37 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 08 Jan 2025 23:17:45 -0800 (PST) Message-ID: <6b4c4abb-8d53-4b17-8a1c-1d28fb4d5f88@bytedance.com> Date: Thu, 9 Jan 2025 15:17:33 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [RFC PATCH v2 13/15] arm64: mm: Guard page table writes with kpkeys To: Kevin Brodsky Cc: linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Andrew Morton , Mark Brown , Catalin Marinas , Dave Hansen , Jann Horn , Jeff Xu , Joey Gouly , Kees Cook , Linus Walleij , Andy Lutomirski , Marc Zyngier , Peter Zijlstra , Pierre Langlois , Quentin Perret , "Mike Rapoport (IBM)" , Ryan Roberts , Thomas Gleixner , Will Deacon , Matthew Wilcox , linux-arm-kernel@lists.infradead.org, x86@kernel.org References: <20250108103250.3188419-1-kevin.brodsky@arm.com> <20250108103250.3188419-14-kevin.brodsky@arm.com> From: Qi Zheng Content-Language: en-US In-Reply-To: <20250108103250.3188419-14-kevin.brodsky@arm.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Kevin, On 2025/1/8 18:32, Kevin Brodsky wrote: > When CONFIG_KPKEYS_HARDENED_PGTABLES is enabled, page tables (both > user and kernel) are mapped with a privileged pkey in the linear > mapping. As a result, they can only be written under the > kpkeys_hardened_pgtables guard, which sets POR_EL1 appropriately to > allow such writes. > > Use this guard wherever page tables genuinely need to be written, > keeping its scope as small as possible (so that POR_EL1 is reset as > fast as possible). Where atomics are involved, the guard's scope > encompasses the whole loop to avoid switching POR_EL1 unnecessarily. > > This patch is a no-op if CONFIG_KPKEYS_HARDENED_PGTABLES is disabled > (default). > > Signed-off-by: Kevin Brodsky > --- > arch/arm64/include/asm/pgtable.h | 19 +++++++++++++++++-- > arch/arm64/mm/fault.c | 2 ++ > 2 files changed, 19 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h > index f8dac6673887..0d60a49dc234 100644 > --- a/arch/arm64/include/asm/pgtable.h > +++ b/arch/arm64/include/asm/pgtable.h > @@ -39,6 +39,7 @@ > #include > #include > #include > +#include > > #ifdef CONFIG_TRANSPARENT_HUGEPAGE > #define __HAVE_ARCH_FLUSH_PMD_TLB_RANGE > @@ -314,6 +315,7 @@ static inline pte_t pte_clear_uffd_wp(pte_t pte) > > static inline void __set_pte_nosync(pte_t *ptep, pte_t pte) > { > + guard(kpkeys_hardened_pgtables)(); > WRITE_ONCE(*ptep, pte); > } > > @@ -758,6 +760,7 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) > } > #endif /* __PAGETABLE_PMD_FOLDED */ > > + guard(kpkeys_hardened_pgtables)(); > WRITE_ONCE(*pmdp, pmd); > > if (pmd_valid(pmd)) { I noticed a long time ago that set_pte/set_pmd/... was implemented separately by each architecture without a unified entry point. This makes it difficult to add some hooks for them. Taking set_pte() as an example, is it possible to do the following: 1) add a generic set_pte() in include/asm-generic/tlb.h (Or other more appropriate files) static inline void set_pte(pte_t *ptep, pte_t pte) { arch_set_pte(ptep, pte); } 2) let each architecture include this file and rename the original set_pte() to arch_set_pte(). 3) then we can add hooks for generic set_pte(): static inline void set_pte(pte_t *ptep, pte_t pte) { guard(kpkeys_hardened_pgtables)(); arch_set_pte(ptep, pte); } 4) in this way, the architecture that supports ARCH_HAS_KPKEYS_HARDENED_PGTABLES only needs to implement the kpkeys_hardened_pgtables(), otherwise it is no-op. Just some immature ideas, and the related set/clear interfaces are currently quite messy. ;) Of course, this does not affect the feature to be implemented in this patch series. Thanks!