From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on archive.lwn.net X-Spam-Level: X-Spam-Status: No, score=-5.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham autolearn_force=no version=3.4.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by archive.lwn.net (Postfix) with ESMTP id 3CA6D7D071 for ; Tue, 17 Jul 2018 23:04:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730128AbeGQXjP (ORCPT ); Tue, 17 Jul 2018 19:39:15 -0400 Received: from mga17.intel.com ([192.55.52.151]:34308 "EHLO mga17.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730055AbeGQXjP (ORCPT ); Tue, 17 Jul 2018 19:39:15 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Jul 2018 16:04:23 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.51,367,1526367600"; d="scan'208";a="73200020" Received: from 2b52.sc.intel.com ([143.183.136.146]) by fmsmga001.fm.intel.com with ESMTP; 17 Jul 2018 16:04:22 -0700 Message-ID: <1531868435.3541.18.camel@intel.com> Subject: Re: [RFC PATCH v2 16/27] mm: Modify can_follow_write_pte/pmd for shadow stack From: Yu-cheng Yu To: Peter Zijlstra Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , "Ravi V. Shankar" , Vedvyas Shanbhogue Date: Tue, 17 Jul 2018 16:00:35 -0700 In-Reply-To: <20180711092951.GW2476@hirez.programming.kicks-ass.net> References: <20180710222639.8241-1-yu-cheng.yu@intel.com> <20180710222639.8241-17-yu-cheng.yu@intel.com> <20180711092951.GW2476@hirez.programming.kicks-ass.net> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.18.5.2-0ubuntu3.2 Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-doc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org On Wed, 2018-07-11 at 11:29 +0200, Peter Zijlstra wrote: > On Tue, Jul 10, 2018 at 03:26:28PM -0700, Yu-cheng Yu wrote: > > > > There are three possible shadow stack PTE settings: > > > >   Normal SHSTK PTE: (R/O + DIRTY_HW) > >   SHSTK PTE COW'ed: (R/O + DIRTY_HW) > >   SHSTK PTE shared as R/O data: (R/O + DIRTY_SW) > I count _2_ distinct states there. > > > > > Update can_follow_write_pte/pmd for the shadow stack. > So the below disallows can_follow_write when shstk && _PAGE_DIRTY_SW, > but this here Changelog doesn't explain why. Doesn't even get close. Can we add the following to the log: When a SHSTK PTE is shared, it is (R/O + DIRTY_SW); otherwise it is (R/O + DIRTY_HW). When we (FOLL_WRITE | FOLL_FORCE) on a SHSTK PTE, the following must be true:   - It has been COW'ed at least once (FOLL_COW is set);   - It still is not shared, i.e. PTE is (R/O + DIRTY_HW); > > Also, the code is a right mess :/ Can't we try harder to not let this > shadow stack stuff escape arch code. We either check here if the VMA is SHSTK mapping or move the logic to pte_dirty().  The latter would be less obvious.  Or can we create a can_follow_write_shstk_pte()? Yu-cheng -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html