From patchwork Tue Jun 5 02:09:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ram Pai X-Patchwork-Id: 925289 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 410Ftg1ft5z9rxs for ; Tue, 5 Jun 2018 12:22:03 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=us.ibm.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="NZhQ4Mmw"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 410Ftg05qfzF116 for ; Tue, 5 Jun 2018 12:22:03 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=none (p=none dis=none) header.from=us.ibm.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="NZhQ4Mmw"; dkim-atps=neutral X-Original-To: linuxppc-dev@lists.ozlabs.org Delivered-To: linuxppc-dev@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=gmail.com (client-ip=2607:f8b0:400d:c0d::243; helo=mail-qt0-x243.google.com; envelope-from=ram.n.pai@gmail.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=none (p=none dis=none) header.from=us.ibm.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="NZhQ4Mmw"; dkim-atps=neutral Received: from mail-qt0-x243.google.com (mail-qt0-x243.google.com [IPv6:2607:f8b0:400d:c0d::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 410FdL6scMzF1RG for ; Tue, 5 Jun 2018 12:10:30 +1000 (AEST) Received: by mail-qt0-x243.google.com with SMTP id p23-v6so841365qtn.6 for ; Mon, 04 Jun 2018 19:10:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=csqVsPm5s2flb8FA/bIbtpcY1LDrcKhcEjugZltSyTQ=; b=NZhQ4MmwKb+G8eRU0oT47khIIma0PzSA2tVxIIRax8MkcFpLFByhHs3HHxajiw4dad xxuFaYD97/ae/Z07HBbhuPo9Z/Pcm+9ici++Bc7WhjxkBgB+9sHIzxeLPBbrrQZetMJd ByBZiub+VYU650/V5BmCHdySMyB95gdyR8cGFHLIDCRfniTZouQoy71FGk7gkrVTXcYu G6Syy5ficoMEMFriHVHoRiO7GKdJC+J3m5TTnbuCJnTZlWUuUAMtNkZPpDW1F/YDh1Eu x/qa4MubOhFXwY47xQPro1R9nw+CFN4T/bOv7LRudjMg8VEULYM1Iv/Gv2uoFN0yc3hn zRDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=csqVsPm5s2flb8FA/bIbtpcY1LDrcKhcEjugZltSyTQ=; b=Kmf7BpFV0PIb1Sdpm2RgqTRBWABHI5pAqxAHYL/uZYlZ1rE4E8DgDyfss5p8oy0U0W T/chDrGRJiiPO50kt6l3s+xNE+rb8nA3fuym8IOS6D3ufSEoE+uLqrrIwwmr94ue3wmu uOpPQmUb3EmxQgTbewitZ10I1e4HQP5zVQU57s4CCmGMGU6bTELFpMdCnQP2UZjCZ7nt IqtbZw7euJHW2iJMqUnT4yx9sO2sBlaQt9NP6USbAvaQSap0PCfz/shisErk1Ec511lP VR4g9Y6dTasAOw/TcMhZ7fbGaf5yMCBLruJYBLwWPsGulqqRLni4+v88IClHv6gTCPit SCPQ== X-Gm-Message-State: APt69E0qg3wre1Wph+aMyE8LubDz+tTFQPYn5UVyFKfMcDkevRV3+0aG 5G+Bj5b3DB3X/nrPAn6Hs9o= X-Google-Smtp-Source: ADUXVKKD2+kmkAlrWGCtNJD14Wr3GAvDC6d+31Pn+OUSskJge3+IjZTDzYnhfmL9tI0tgXk2CqPOOQ== X-Received: by 2002:ac8:18b9:: with SMTP id s54-v6mr15405244qtj.139.1528164628883; Mon, 04 Jun 2018 19:10:28 -0700 (PDT) Received: from localhost.localdomain (50-39-100-161.bvtn.or.frontiernet.net. [50.39.100.161]) by smtp.gmail.com with ESMTPSA id b52-v6sm39476917qta.58.2018.06.04.19.10.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 04 Jun 2018 19:10:28 -0700 (PDT) From: Ram Pai To: mpe@ellerman.id.au Subject: [PATCH 4/5] powerpc/pkeys: Preallocate execute-only key Date: Mon, 4 Jun 2018 19:09:53 -0700 Message-Id: <1528164594-23823-5-git-send-email-linuxram@us.ibm.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1528164594-23823-1-git-send-email-linuxram@us.ibm.com> References: <1528164594-23823-1-git-send-email-linuxram@us.ibm.com> X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: fweimer@redhat.com, Ulrich.Weigand@de.ibm.com, linuxram@us.ibm.com, mhocko@kernel.org, dave.hansen@intel.com, aneesh.kumar@linux.vnet.ibm.com, luto@kernel.org, bauerman@linux.vnet.ibm.com, linuxppc-dev@lists.ozlabs.org Errors-To: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Sender: "Linuxppc-dev" execute-only key is allocated dynamically. This is a problem. When a thread implicitly creates a execute-only key, and resets UAMOR for that key, the UAMOR value does not percolate to all the other threads. Any other thread may ignorantly change the permissions on the key. This can cause the key to be not execute-only for that thread. Preallocate the execute-only key and ensure that no thread can change the permission of the key, by resetting the corresponding bit in UAMOR. CC: Andy Lutomirski CC: Florian Weimer CC: Thiago Jung Bauermann CC: Michael Ellerman Signed-off-by: Ram Pai --- arch/powerpc/mm/pkeys.c | 53 +++++++--------------------------------------- 1 files changed, 8 insertions(+), 45 deletions(-) diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c index 90ab793..0b98db6 100644 --- a/arch/powerpc/mm/pkeys.c +++ b/arch/powerpc/mm/pkeys.c @@ -25,6 +25,7 @@ #define IAMR_EX_BIT 0x1UL #define PKEY_REG_BITS (sizeof(u64)*8) #define pkeyshift(pkey) (PKEY_REG_BITS - ((pkey+1) * AMR_BITS_PER_PKEY)) +#define EXECUTE_ONLY_KEY 2 static void scan_pkey_feature(void) { @@ -120,7 +121,8 @@ int pkey_initialize(void) #else os_reserved = 0; #endif - initial_allocation_mask = (0x1 << 0) | (0x1 << 1); + initial_allocation_mask = (0x1 << 0) | (0x1 << 1) | + (0x1 << EXECUTE_ONLY_KEY); /* register mask is in BE format */ pkey_amr_mask = ~0x0ul; @@ -130,6 +132,7 @@ int pkey_initialize(void) pkey_amr_mask &= ~(0x3ul << pkeyshift(i)); pkey_iamr_mask &= ~(0x1ul << pkeyshift(i)); } + pkey_amr_mask |= (AMR_RD_BIT|AMR_WR_BIT) << pkeyshift(EXECUTE_ONLY_KEY); pkey_uamor_mask = ~0x0ul; pkey_uamor_mask &= ~(0x3ul << pkeyshift(0)); @@ -140,6 +143,8 @@ int pkey_initialize(void) * pseries kernel running on powerVM. */ pkey_uamor_mask &= ~(0x3ul << pkeyshift(1)); + pkey_uamor_mask &= ~(0x3ul << pkeyshift(EXECUTE_ONLY_KEY)); + for (i = (pkeys_total - os_reserved); i < pkeys_total; i++) pkey_uamor_mask &= ~(0x3ul << pkeyshift(i)); @@ -153,8 +158,7 @@ void pkey_mm_init(struct mm_struct *mm) if (static_branch_likely(&pkey_disabled)) return; mm_pkey_allocation_map(mm) = initial_allocation_mask; - /* -1 means unallocated or invalid */ - mm->context.execute_only_pkey = -1; + mm->context.execute_only_pkey = EXECUTE_ONLY_KEY; } static inline u64 read_amr(void) @@ -333,48 +337,7 @@ static inline bool pkey_allows_readwrite(int pkey) int __execute_only_pkey(struct mm_struct *mm) { - bool need_to_set_mm_pkey = false; - int execute_only_pkey = mm->context.execute_only_pkey; - int ret; - - /* Do we need to assign a pkey for mm's execute-only maps? */ - if (execute_only_pkey == -1) { - /* Go allocate one to use, which might fail */ - execute_only_pkey = mm_pkey_alloc(mm); - if (execute_only_pkey < 0) - return -1; - need_to_set_mm_pkey = true; - } - - /* - * We do not want to go through the relatively costly dance to set AMR - * if we do not need to. Check it first and assume that if the - * execute-only pkey is readwrite-disabled than we do not have to set it - * ourselves. - */ - if (!need_to_set_mm_pkey && !pkey_allows_readwrite(execute_only_pkey)) - return execute_only_pkey; - - /* - * Set up AMR so that it denies access for everything other than - * execution. - */ - ret = __arch_set_user_pkey_access(current, execute_only_pkey, - PKEY_DISABLE_ACCESS | - PKEY_DISABLE_WRITE); - /* - * If the AMR-set operation failed somehow, just return 0 and - * effectively disable execute-only support. - */ - if (ret) { - mm_pkey_free(mm, execute_only_pkey); - return -1; - } - - /* We got one, store it and use it from here on out */ - if (need_to_set_mm_pkey) - mm->context.execute_only_pkey = execute_only_pkey; - return execute_only_pkey; + return mm->context.execute_only_pkey; } static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)