From: Dave Hansen <dave.hansen@linux.intel.com>
To: Nadav Amit <namit@vmware.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
"open list:MEMORY MANAGEMENT" <linux-mm@kvack.org>,
Fengguang Wu <fengguang.wu@intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Andy Lutomirski <luto@kernel.org>,
Arjan van de Ven <arjan@linux.intel.com>,
Borislav Petkov <bp@alien8.de>,
Dan Williams <dan.j.williams@intel.com>,
David Woodhouse <dwmw2@infradead.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"hughd@google.com" <hughd@google.com>,
"jpoimboe@redhat.com" <jpoimboe@redhat.com>,
"jgross@suse.com" <jgross@suse.com>,
"keescook@google.com" <keescook@google.com>,
"torvalds@linux-foundation.org" <torvalds@linux-foundation.org>,
"peterz@infradead.org" <peterz@infradead.org>,
"tglx@linutronix.de" <tglx@linutronix.de>,
"mingo@kernel.org" <mingo@kernel.org>
Subject: Re: [PATCH 5/5] x86, pti: filter at vma->vm_page_prot population
Date: Mon, 23 Apr 2018 04:37:24 -0700 [thread overview]
Message-ID: <30d4fd5a-a82f-2a94-e8cb-ad9b7d2dc5e7@linux.intel.com> (raw)
In-Reply-To: <295DB0D1-CDFB-482C-93DF-63DAA36DAE22@vmware.com>
On 04/20/2018 06:21 PM, Nadav Amit wrote:
>> pgprot_t vm_get_page_prot(unsigned long vm_flags)
>> {
>> - return __pgprot(pgprot_val(protection_map[vm_flags &
>> + pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &
>> (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
>> pgprot_val(arch_vm_get_page_prot(vm_flags)));
>> +
>> + return arch_filter_pgprot(ret);
>> }
>> EXPORT_SYMBOL(vm_get_page_prot);
> Wouldna??t it be simpler or at least cleaner to change the protection map if
> NX is not supported? I presume it can be done paging_init() similarly to the
> way other archs (e.g., arm, mips) do.
I thought about it, but doing it there requires getting the _timing_
right. You have to do it before the protection map gets used but after
__supported_pte_mask is totally initialized. This seemed more
straightforward, especially as a bug fix.
What you are talking about might be a good cleanup, though.
WARNING: multiple messages have this Message-ID (diff)
From: Dave Hansen <dave.hansen@linux.intel.com>
To: Nadav Amit <namit@vmware.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
"open list:MEMORY MANAGEMENT" <linux-mm@kvack.org>,
Fengguang Wu <fengguang.wu@intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Andy Lutomirski <luto@kernel.org>,
Arjan van de Ven <arjan@linux.intel.com>,
Borislav Petkov <bp@alien8.de>,
Dan Williams <dan.j.williams@intel.com>,
David Woodhouse <dwmw2@infradead.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"hughd@google.com" <hughd@google.com>,
"jpoimboe@redhat.com" <jpoimboe@redhat.com>,
"jgross@suse.com" <jgross@suse.com>,
"keescook@google.com" <keescook@google.com>,
"torvalds@linux-foundation.org" <torvalds@linux-foundation.org>,
"peterz@infradead.org" <peterz@infradead.org>,
"tglx@linutronix.de" <tglx@linutronix.de>,
"mingo@kernel.org" <mingo@kernel.org>
Subject: Re: [PATCH 5/5] x86, pti: filter at vma->vm_page_prot population
Date: Mon, 23 Apr 2018 04:37:24 -0700 [thread overview]
Message-ID: <30d4fd5a-a82f-2a94-e8cb-ad9b7d2dc5e7@linux.intel.com> (raw)
In-Reply-To: <295DB0D1-CDFB-482C-93DF-63DAA36DAE22@vmware.com>
On 04/20/2018 06:21 PM, Nadav Amit wrote:
>> pgprot_t vm_get_page_prot(unsigned long vm_flags)
>> {
>> - return __pgprot(pgprot_val(protection_map[vm_flags &
>> + pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &
>> (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
>> pgprot_val(arch_vm_get_page_prot(vm_flags)));
>> +
>> + return arch_filter_pgprot(ret);
>> }
>> EXPORT_SYMBOL(vm_get_page_prot);
> Wouldn’t it be simpler or at least cleaner to change the protection map if
> NX is not supported? I presume it can be done paging_init() similarly to the
> way other archs (e.g., arm, mips) do.
I thought about it, but doing it there requires getting the _timing_
right. You have to do it before the protection map gets used but after
__supported_pte_mask is totally initialized. This seemed more
straightforward, especially as a bug fix.
What you are talking about might be a good cleanup, though.
next prev parent reply other threads:[~2018-04-23 11:37 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-20 22:20 [PATCH 0/5] x86, mm: PTI Global page fixes for 4.17 Dave Hansen
2018-04-20 22:20 ` Dave Hansen
2018-04-20 22:20 ` [PATCH 1/5] x86, pti: fix boot problems from Global-bit setting Dave Hansen
2018-04-20 22:20 ` Dave Hansen
2018-04-23 10:50 ` Aaro Koskinen
2018-04-23 10:50 ` Aaro Koskinen
2018-04-24 8:06 ` [tip:x86/pti] x86/pti: Fix " tip-bot for Dave Hansen
2018-04-25 9:06 ` tip-bot for Dave Hansen
2018-04-20 22:20 ` [PATCH 2/5] x86, pti: fix boot warning " Dave Hansen
2018-04-20 22:20 ` Dave Hansen
2018-04-23 10:51 ` Aaro Koskinen
2018-04-23 10:51 ` Aaro Koskinen
2018-04-24 8:07 ` [tip:x86/pti] x86/pti: Fix " tip-bot for Dave Hansen
2018-04-25 9:07 ` tip-bot for Dave Hansen
2018-04-20 22:20 ` [PATCH 3/5] x86, pti: reduce amount of kernel text allowed to be Global Dave Hansen
2018-04-20 22:20 ` Dave Hansen
2018-04-24 8:08 ` [tip:x86/pti] x86, pti: Reduce " tip-bot for Dave Hansen
2018-04-25 9:08 ` [tip:x86/pti] x86/pti: " tip-bot for Dave Hansen
2018-04-20 22:20 ` [PATCH 4/5] x86, pti: disallow global kernel text with RANDSTRUCT Dave Hansen
2018-04-20 22:20 ` Dave Hansen
2018-04-24 8:08 ` [tip:x86/pti] x86/pti: Disallow " tip-bot for Dave Hansen
2018-04-25 9:08 ` tip-bot for Dave Hansen
2018-04-20 22:20 ` [PATCH 5/5] x86, pti: filter at vma->vm_page_prot population Dave Hansen
2018-04-20 22:20 ` Dave Hansen
2018-04-21 1:21 ` Nadav Amit
2018-04-23 11:37 ` Dave Hansen [this message]
2018-04-23 11:37 ` Dave Hansen
2018-04-24 8:09 ` [tip:x86/pti] x86, pti: Filter " tip-bot for Dave Hansen
2018-04-25 9:09 ` [tip:x86/pti] x86/pti: " tip-bot for Dave Hansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=30d4fd5a-a82f-2a94-e8cb-ad9b7d2dc5e7@linux.intel.com \
--to=dave.hansen@linux.intel.com \
--cc=aarcange@redhat.com \
--cc=arjan@linux.intel.com \
--cc=bp@alien8.de \
--cc=dan.j.williams@intel.com \
--cc=dwmw2@infradead.org \
--cc=fengguang.wu@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hughd@google.com \
--cc=jgross@suse.com \
--cc=jpoimboe@redhat.com \
--cc=keescook@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=namit@vmware.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.