From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753185AbcG2QaP (ORCPT ); Fri, 29 Jul 2016 12:30:15 -0400 Received: from mga14.intel.com ([192.55.52.115]:47320 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751640AbcG2QaM (ORCPT ); Fri, 29 Jul 2016 12:30:12 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,440,1464678000"; d="scan'208";a="1031595236" Subject: [PATCH 00/10] [v6] System Calls for Memory Protection Keys To: linux-kernel@vger.kernel.org Cc: x86@kernel.org, linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, luto@kernel.org, mgorman@techsingularity.net, Dave Hansen , arnd@arndb.de, dave.hansen@intel.com From: Dave Hansen Date: Fri, 29 Jul 2016 09:30:09 -0700 Message-Id: <20160729163009.5EC1D38C@viggo.jf.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This set takes all of the feedback on the last version into account and simplifies the ABI. It adds one feature: restrictive 'init_pkru' support. I realize it's during the merge window, but I'm posting so folks who aren't busy with merge window activities can take a look. Barring any new issues, I think this is ready to be applied once 4.9 material is being queued. Folks wishing to run this code can do so on any processor with the new PKU support in qemu >=2.6. Just boot with -cpu qemu64,+pku,+xsave, and make sure to apply this patch[1] to qemu. Changes from v5: * Removed pkey_set/get() system calls to simplify ABI * Added 'init_pkru' support to ensure we have a restrictive PKRU by default. * Requisite changes to selftests, plus some bugfixes around stdio in signal handlers -- Memory Protection Keys for User pages (pkeys) is a CPU feature which will first appear on Skylake Servers, but will also be supported on future non-server parts. It provides a mechanism for enforcing page-based protections, but without requiring modification of the page tables when an application changes wishes to change permissions. Among other things, this feature was designed to help fix a class of bugs in long-running applications where data corruption is detected long after it occurs. Applications today either live with the corruption or eat a huge performance penalty from calling mprotect() frequently. The developers of these applications are already running this code and are very eager to see this feature merged and picked up in future distributions where their customers can use it. Patches to implement execute-only mapping support using pkeys were merged in to 4.6. But, to do anything more useful with pkeys, an application needs to be able to set the pkey field in the PTE (obviously has to be done in-kernel) and make changes to the "rights" register (using unprivileged instructions). An application also needs to have an an allocator for the keys themselves. If two different parts of an application both want to protect their data with pkeys, they first need to know which key to use for their individual purposes. This set introduces 3 system calls: sys_pkey_mprotect(): apply PTE to memory (patches #1-3) sys_pkey_alloc(): ask the kernel for a free pkey (patch #4) sys_pkey_free(): the reverse of alloc (patch #4) I have manpages written for these syscalls, and have had multiple rounds of reviews on the manpages list. I have not revised them to remove pkey_get/set(), but will once this is merged in -tip. This set is also available here: git://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-pkeys.git pkeys-v040 I've written a set of unit tests for these interfaces, which is available as the last patch in the series and integrated in to kselftests. Folks wishing to run this code can do so with the new PKU support in qemu >=2.6. Just boot with -cpu qemu64,+pku,+xsave, and make sure to apply this patch[1] to qemu. === diffstat === Dave Hansen (10): x86, pkeys: add fault handling for PF_PK page fault bit mm: implement new pkey_mprotect() system call x86, pkeys: make mprotect_key() mask off additional vm_flags x86, pkeys: allocation/free syscalls x86: wire up protection keys system calls generic syscalls: wire up memory protection keys syscalls pkeys: add details of system call use to Documentation/ x86, pkeys: default to a restrictive init PKRU x86, pkeys: allow configuration of init_pkru x86, pkeys: add self-tests Documentation/kernel-parameters.txt | 5 + Documentation/x86/protection-keys.txt | 63 + arch/alpha/include/uapi/asm/mman.h | 5 + arch/mips/include/uapi/asm/mman.h | 5 + arch/parisc/include/uapi/asm/mman.h | 5 + arch/x86/entry/syscalls/syscall_32.tbl | 5 + arch/x86/entry/syscalls/syscall_64.tbl | 5 + arch/x86/include/asm/mmu.h | 8 + arch/x86/include/asm/mmu_context.h | 25 +- arch/x86/include/asm/pkeys.h | 73 +- arch/x86/kernel/fpu/core.c | 4 + arch/x86/kernel/fpu/xstate.c | 5 +- arch/x86/mm/fault.c | 9 + arch/x86/mm/pkeys.c | 143 +- arch/xtensa/include/uapi/asm/mman.h | 5 + include/linux/pkeys.h | 41 +- include/linux/syscalls.h | 8 + include/uapi/asm-generic/mman-common.h | 5 + include/uapi/asm-generic/unistd.h | 12 +- mm/mprotect.c | 90 +- tools/testing/selftests/x86/Makefile | 3 +- tools/testing/selftests/x86/pkey-helpers.h | 219 +++ tools/testing/selftests/x86/protection_keys.c | 1411 +++++++++++++++++ 23 files changed, 2116 insertions(+), 38 deletions(-) === changelog === Changes from v5: * remove sys_pkey_get/set() to simplify the ABI. There was concern they could not be easily vsyscall-accelerated. * Added 'init_pkru' support to ensure we have a restrictive PKRU by default. * Requisite changes to selftests, plus some bugfixes around stdio in signal handlers Changes from v4: * removed validate_pkey(). It was redundant with the work we do in mm_pkey_alloc() and all of the mm_pkey_is_allocated() checks. * reorder patches to wait to wire up any syscalls until the end. * make allocation map functions explicity use unsigned masks * some tweaks to changelog (and associated manpages) Changes from v3: * added generic syscalls declarations to include/linux/syscalls.h to fix arm64 compile issue. Changes from v2: * selftest updates: * formatting changes like what Ingo asked for with MPX * actually call WRPKRU in __wrpkru() * once __wrpkru() was fixed, revealed a bug in the ptrace test where we were testing against the wrong pointer during the "baseline" test * Man-pages that match this set are here: http://marc.info/?l=linux-man&m=146540723525616&w=2 Changes from v1: * updates to alloc/free patch description calling out that "in-use" pkeys may still be pkey_free()'d successfully. * Fixed a bug in the selftest where the 'flags' argument was not passed to pkey_get(). * Added all syscalls to generic syscalls header * Added extra checking to selftests so it doesn't fall over when 1G pages are made the hugetlbfs default. 1. http://lists.nongnu.org/archive/html/qemu-devel/2016-07/msg04774.html Cc: linux-api@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mm@kvack.org Cc: x86@kernel.org Cc: torvalds@linux-foundation.org Cc: akpm@linux-foundation.org Cc: Arnd Bergmann Cc: mgorman@techsingularity.net Cc: Dave Hansen (Intel) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f200.google.com (mail-pf0-f200.google.com [209.85.192.200]) by kanga.kvack.org (Postfix) with ESMTP id 09D806B025F for ; Fri, 29 Jul 2016 12:30:13 -0400 (EDT) Received: by mail-pf0-f200.google.com with SMTP id 63so126427227pfx.0 for ; Fri, 29 Jul 2016 09:30:13 -0700 (PDT) Received: from mga03.intel.com (mga03.intel.com. [134.134.136.65]) by mx.google.com with ESMTP id dg3si19067453pad.63.2016.07.29.09.30.10 for ; Fri, 29 Jul 2016 09:30:10 -0700 (PDT) Subject: [PATCH 00/10] [v6] System Calls for Memory Protection Keys From: Dave Hansen Date: Fri, 29 Jul 2016 09:30:09 -0700 Message-Id: <20160729163009.5EC1D38C@viggo.jf.intel.com> Sender: owner-linux-mm@kvack.org List-ID: To: linux-kernel@vger.kernel.org Cc: x86@kernel.org, linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, luto@kernel.org, mgorman@techsingularity.net, Dave Hansen , arnd@arndb.de, dave.hansen@intel.com This set takes all of the feedback on the last version into account and simplifies the ABI. It adds one feature: restrictive 'init_pkru' support. I realize it's during the merge window, but I'm posting so folks who aren't busy with merge window activities can take a look. Barring any new issues, I think this is ready to be applied once 4.9 material is being queued. Folks wishing to run this code can do so on any processor with the new PKU support in qemu >=2.6. Just boot with -cpu qemu64,+pku,+xsave, and make sure to apply this patch[1] to qemu. Changes from v5: * Removed pkey_set/get() system calls to simplify ABI * Added 'init_pkru' support to ensure we have a restrictive PKRU by default. * Requisite changes to selftests, plus some bugfixes around stdio in signal handlers -- Memory Protection Keys for User pages (pkeys) is a CPU feature which will first appear on Skylake Servers, but will also be supported on future non-server parts. It provides a mechanism for enforcing page-based protections, but without requiring modification of the page tables when an application changes wishes to change permissions. Among other things, this feature was designed to help fix a class of bugs in long-running applications where data corruption is detected long after it occurs. Applications today either live with the corruption or eat a huge performance penalty from calling mprotect() frequently. The developers of these applications are already running this code and are very eager to see this feature merged and picked up in future distributions where their customers can use it. Patches to implement execute-only mapping support using pkeys were merged in to 4.6. But, to do anything more useful with pkeys, an application needs to be able to set the pkey field in the PTE (obviously has to be done in-kernel) and make changes to the "rights" register (using unprivileged instructions). An application also needs to have an an allocator for the keys themselves. If two different parts of an application both want to protect their data with pkeys, they first need to know which key to use for their individual purposes. This set introduces 3 system calls: sys_pkey_mprotect(): apply PTE to memory (patches #1-3) sys_pkey_alloc(): ask the kernel for a free pkey (patch #4) sys_pkey_free(): the reverse of alloc (patch #4) I have manpages written for these syscalls, and have had multiple rounds of reviews on the manpages list. I have not revised them to remove pkey_get/set(), but will once this is merged in -tip. This set is also available here: git://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-pkeys.git pkeys-v040 I've written a set of unit tests for these interfaces, which is available as the last patch in the series and integrated in to kselftests. Folks wishing to run this code can do so with the new PKU support in qemu >=2.6. Just boot with -cpu qemu64,+pku,+xsave, and make sure to apply this patch[1] to qemu. === diffstat === Dave Hansen (10): x86, pkeys: add fault handling for PF_PK page fault bit mm: implement new pkey_mprotect() system call x86, pkeys: make mprotect_key() mask off additional vm_flags x86, pkeys: allocation/free syscalls x86: wire up protection keys system calls generic syscalls: wire up memory protection keys syscalls pkeys: add details of system call use to Documentation/ x86, pkeys: default to a restrictive init PKRU x86, pkeys: allow configuration of init_pkru x86, pkeys: add self-tests Documentation/kernel-parameters.txt | 5 + Documentation/x86/protection-keys.txt | 63 + arch/alpha/include/uapi/asm/mman.h | 5 + arch/mips/include/uapi/asm/mman.h | 5 + arch/parisc/include/uapi/asm/mman.h | 5 + arch/x86/entry/syscalls/syscall_32.tbl | 5 + arch/x86/entry/syscalls/syscall_64.tbl | 5 + arch/x86/include/asm/mmu.h | 8 + arch/x86/include/asm/mmu_context.h | 25 +- arch/x86/include/asm/pkeys.h | 73 +- arch/x86/kernel/fpu/core.c | 4 + arch/x86/kernel/fpu/xstate.c | 5 +- arch/x86/mm/fault.c | 9 + arch/x86/mm/pkeys.c | 143 +- arch/xtensa/include/uapi/asm/mman.h | 5 + include/linux/pkeys.h | 41 +- include/linux/syscalls.h | 8 + include/uapi/asm-generic/mman-common.h | 5 + include/uapi/asm-generic/unistd.h | 12 +- mm/mprotect.c | 90 +- tools/testing/selftests/x86/Makefile | 3 +- tools/testing/selftests/x86/pkey-helpers.h | 219 +++ tools/testing/selftests/x86/protection_keys.c | 1411 +++++++++++++++++ 23 files changed, 2116 insertions(+), 38 deletions(-) === changelog === Changes from v5: * remove sys_pkey_get/set() to simplify the ABI. There was concern they could not be easily vsyscall-accelerated. * Added 'init_pkru' support to ensure we have a restrictive PKRU by default. * Requisite changes to selftests, plus some bugfixes around stdio in signal handlers Changes from v4: * removed validate_pkey(). It was redundant with the work we do in mm_pkey_alloc() and all of the mm_pkey_is_allocated() checks. * reorder patches to wait to wire up any syscalls until the end. * make allocation map functions explicity use unsigned masks * some tweaks to changelog (and associated manpages) Changes from v3: * added generic syscalls declarations to include/linux/syscalls.h to fix arm64 compile issue. Changes from v2: * selftest updates: * formatting changes like what Ingo asked for with MPX * actually call WRPKRU in __wrpkru() * once __wrpkru() was fixed, revealed a bug in the ptrace test where we were testing against the wrong pointer during the "baseline" test * Man-pages that match this set are here: http://marc.info/?l=linux-man&m=146540723525616&w=2 Changes from v1: * updates to alloc/free patch description calling out that "in-use" pkeys may still be pkey_free()'d successfully. * Fixed a bug in the selftest where the 'flags' argument was not passed to pkey_get(). * Added all syscalls to generic syscalls header * Added extra checking to selftests so it doesn't fall over when 1G pages are made the hugetlbfs default. 1. http://lists.nongnu.org/archive/html/qemu-devel/2016-07/msg04774.html Cc: linux-api@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mm@kvack.org Cc: x86@kernel.org Cc: torvalds@linux-foundation.org Cc: akpm@linux-foundation.org Cc: Arnd Bergmann Cc: mgorman@techsingularity.net Cc: Dave Hansen (Intel) -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org