From: ira.weiny@intel.com To: Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>, Andy Lutomirski <luto@kernel.org>, Peter Zijlstra <peterz@infradead.org> Cc: Fenghua Yu <fenghua.yu@intel.com>, x86@kernel.org, Dave Hansen <dave.hansen@linux.intel.com>, Andrew Morton <akpm@linux-foundation.org>, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-nvdimm@lists.01.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org Subject: [PATCH RFC V2 03/17] x86/pks: Enable Protection Keys Supervisor (PKS) Date: Fri, 17 Jul 2020 00:20:42 -0700 [thread overview] Message-ID: <20200717072056.73134-4-ira.weiny@intel.com> (raw) In-Reply-To: <20200717072056.73134-1-ira.weiny@intel.com> From: Fenghua Yu <fenghua.yu@intel.com> Protection Keys for Supervisor pages (PKS) enables fast, hardware thread specific, manipulation of permission restrictions on supervisor page mappings. It uses the same mechanism of Protection Keys as those on User mappings but applies that mechanism to supervisor mappings using a supervisor specific MSR. Kernel users can thus defines 'domains' of page mappings which have an extra level of protection beyond those specified in the supervisor page table entries. Define ARCH_HAS_SUPERVISOR_PKEYS to distinguish this functionality from the existing ARCH_HAS_PKEYS and then enable PKS when configured and indicated by the CPU instance. While not strictly necessary in this patch, ARCH_HAS_SUPERVISOR_PKEYS separates this functionality through the patch series so it is introduced here. Co-developed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Fenghua Yu <fenghua.yu@intel.com> --- arch/x86/Kconfig | 1 + arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/uapi/asm/processor-flags.h | 2 ++ arch/x86/kernel/cpu/common.c | 15 +++++++++++++++ mm/Kconfig | 2 ++ 5 files changed, 21 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 883da0abf779..c3ecbed2cfa0 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1872,6 +1872,7 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS depends on X86_64 && (CPU_SUP_INTEL || CPU_SUP_AMD) select ARCH_USES_HIGH_VMA_FLAGS select ARCH_HAS_PKEYS + select ARCH_HAS_SUPERVISOR_PKEYS help Memory Protection Keys provides a mechanism for enforcing page-based protections, but without requiring modification of the diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index 02dabc9e77b0..a832ed8820c0 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -351,6 +351,7 @@ #define X86_FEATURE_CLDEMOTE (16*32+25) /* CLDEMOTE instruction */ #define X86_FEATURE_MOVDIRI (16*32+27) /* MOVDIRI instruction */ #define X86_FEATURE_MOVDIR64B (16*32+28) /* MOVDIR64B instruction */ +#define X86_FEATURE_PKS (16*32+31) /* Protection Keys for Supervisor pages */ /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */ #define X86_FEATURE_OVERFLOW_RECOV (17*32+ 0) /* MCA overflow recovery support */ diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h index bcba3c643e63..191c574b2390 100644 --- a/arch/x86/include/uapi/asm/processor-flags.h +++ b/arch/x86/include/uapi/asm/processor-flags.h @@ -130,6 +130,8 @@ #define X86_CR4_SMAP _BITUL(X86_CR4_SMAP_BIT) #define X86_CR4_PKE_BIT 22 /* enable Protection Keys support */ #define X86_CR4_PKE _BITUL(X86_CR4_PKE_BIT) +#define X86_CR4_PKS_BIT 24 /* enable Protection Keys for Supervisor */ +#define X86_CR4_PKS _BITUL(X86_CR4_PKS_BIT) /* * x86-64 Task Priority Register, CR8 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 95c090a45b4b..f34bcefeda42 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1430,6 +1430,20 @@ static void validate_apic_and_package_id(struct cpuinfo_x86 *c) #endif } +/* + * PKS is independent of PKU and either or both may be supported on a CPU. + * Configure PKS if the cpu supports the feature. + */ +static void setup_pks(void) +{ + if (!IS_ENABLED(CONFIG_ARCH_HAS_SUPERVISOR_PKEYS)) + return; + if (!cpu_feature_enabled(X86_FEATURE_PKS)) + return; + + cr4_set_bits(X86_CR4_PKS); +} + /* * This does the hard work of actually picking apart the CPU stuff... */ @@ -1521,6 +1535,7 @@ static void identify_cpu(struct cpuinfo_x86 *c) x86_init_rdrand(c); setup_pku(c); + setup_pks(); /* * Clear/Set all flags overridden by options, need do it diff --git a/mm/Kconfig b/mm/Kconfig index f2104cc0d35c..e541d2c0dcac 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -826,6 +826,8 @@ config ARCH_USES_HIGH_VMA_FLAGS bool config ARCH_HAS_PKEYS bool +config ARCH_HAS_SUPERVISOR_PKEYS + bool config PERCPU_STATS bool "Collect percpu memory statistics" -- 2.28.0.rc0.12.gb6a658bd00c9 _______________________________________________ Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org To unsubscribe send an email to linux-nvdimm-leave@lists.01.org
WARNING: multiple messages have this Message-ID (diff)
From: ira.weiny@intel.com To: Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>, Andy Lutomirski <luto@kernel.org>, Peter Zijlstra <peterz@infradead.org> Cc: Fenghua Yu <fenghua.yu@intel.com>, Ira Weiny <ira.weiny@intel.com>, x86@kernel.org, Dave Hansen <dave.hansen@linux.intel.com>, Dan Williams <dan.j.williams@intel.com>, Vishal Verma <vishal.l.verma@intel.com>, Andrew Morton <akpm@linux-foundation.org>, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-nvdimm@lists.01.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org Subject: [PATCH RFC V2 03/17] x86/pks: Enable Protection Keys Supervisor (PKS) Date: Fri, 17 Jul 2020 00:20:42 -0700 [thread overview] Message-ID: <20200717072056.73134-4-ira.weiny@intel.com> (raw) In-Reply-To: <20200717072056.73134-1-ira.weiny@intel.com> From: Fenghua Yu <fenghua.yu@intel.com> Protection Keys for Supervisor pages (PKS) enables fast, hardware thread specific, manipulation of permission restrictions on supervisor page mappings. It uses the same mechanism of Protection Keys as those on User mappings but applies that mechanism to supervisor mappings using a supervisor specific MSR. Kernel users can thus defines 'domains' of page mappings which have an extra level of protection beyond those specified in the supervisor page table entries. Define ARCH_HAS_SUPERVISOR_PKEYS to distinguish this functionality from the existing ARCH_HAS_PKEYS and then enable PKS when configured and indicated by the CPU instance. While not strictly necessary in this patch, ARCH_HAS_SUPERVISOR_PKEYS separates this functionality through the patch series so it is introduced here. Co-developed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Fenghua Yu <fenghua.yu@intel.com> --- arch/x86/Kconfig | 1 + arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/uapi/asm/processor-flags.h | 2 ++ arch/x86/kernel/cpu/common.c | 15 +++++++++++++++ mm/Kconfig | 2 ++ 5 files changed, 21 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 883da0abf779..c3ecbed2cfa0 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1872,6 +1872,7 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS depends on X86_64 && (CPU_SUP_INTEL || CPU_SUP_AMD) select ARCH_USES_HIGH_VMA_FLAGS select ARCH_HAS_PKEYS + select ARCH_HAS_SUPERVISOR_PKEYS help Memory Protection Keys provides a mechanism for enforcing page-based protections, but without requiring modification of the diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index 02dabc9e77b0..a832ed8820c0 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -351,6 +351,7 @@ #define X86_FEATURE_CLDEMOTE (16*32+25) /* CLDEMOTE instruction */ #define X86_FEATURE_MOVDIRI (16*32+27) /* MOVDIRI instruction */ #define X86_FEATURE_MOVDIR64B (16*32+28) /* MOVDIR64B instruction */ +#define X86_FEATURE_PKS (16*32+31) /* Protection Keys for Supervisor pages */ /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */ #define X86_FEATURE_OVERFLOW_RECOV (17*32+ 0) /* MCA overflow recovery support */ diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h index bcba3c643e63..191c574b2390 100644 --- a/arch/x86/include/uapi/asm/processor-flags.h +++ b/arch/x86/include/uapi/asm/processor-flags.h @@ -130,6 +130,8 @@ #define X86_CR4_SMAP _BITUL(X86_CR4_SMAP_BIT) #define X86_CR4_PKE_BIT 22 /* enable Protection Keys support */ #define X86_CR4_PKE _BITUL(X86_CR4_PKE_BIT) +#define X86_CR4_PKS_BIT 24 /* enable Protection Keys for Supervisor */ +#define X86_CR4_PKS _BITUL(X86_CR4_PKS_BIT) /* * x86-64 Task Priority Register, CR8 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 95c090a45b4b..f34bcefeda42 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1430,6 +1430,20 @@ static void validate_apic_and_package_id(struct cpuinfo_x86 *c) #endif } +/* + * PKS is independent of PKU and either or both may be supported on a CPU. + * Configure PKS if the cpu supports the feature. + */ +static void setup_pks(void) +{ + if (!IS_ENABLED(CONFIG_ARCH_HAS_SUPERVISOR_PKEYS)) + return; + if (!cpu_feature_enabled(X86_FEATURE_PKS)) + return; + + cr4_set_bits(X86_CR4_PKS); +} + /* * This does the hard work of actually picking apart the CPU stuff... */ @@ -1521,6 +1535,7 @@ static void identify_cpu(struct cpuinfo_x86 *c) x86_init_rdrand(c); setup_pku(c); + setup_pks(); /* * Clear/Set all flags overridden by options, need do it diff --git a/mm/Kconfig b/mm/Kconfig index f2104cc0d35c..e541d2c0dcac 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -826,6 +826,8 @@ config ARCH_USES_HIGH_VMA_FLAGS bool config ARCH_HAS_PKEYS bool +config ARCH_HAS_SUPERVISOR_PKEYS + bool config PERCPU_STATS bool "Collect percpu memory statistics" -- 2.28.0.rc0.12.gb6a658bd00c9
next prev parent reply other threads:[~2020-07-17 7:21 UTC|newest] Thread overview: 157+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-07-17 7:20 [PATCH RFC V2 00/17] PKS: Add Protection Keys Supervisor (PKS) support ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 01/17] x86/pkeys: Create pkeys_internal.h ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 02/17] x86/fpu: Refactor arch_set_user_pkey_access() for PKS support ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 8:54 ` Peter Zijlstra 2020-07-17 8:54 ` Peter Zijlstra 2020-07-17 20:52 ` Ira Weiny 2020-07-17 20:52 ` Ira Weiny 2020-07-20 9:14 ` Peter Zijlstra 2020-07-20 9:14 ` Peter Zijlstra 2020-07-17 22:36 ` Dave Hansen 2020-07-17 22:36 ` Dave Hansen 2020-07-20 9:13 ` Peter Zijlstra 2020-07-20 9:13 ` Peter Zijlstra 2020-07-17 7:20 ` ira.weiny [this message] 2020-07-17 7:20 ` [PATCH RFC V2 03/17] x86/pks: Enable Protection Keys Supervisor (PKS) ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 04/17] x86/pks: Preserve the PKRS MSR on context switch ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 8:31 ` Peter Zijlstra 2020-07-17 8:31 ` Peter Zijlstra 2020-07-17 21:39 ` Ira Weiny 2020-07-17 21:39 ` Ira Weiny 2020-07-17 8:59 ` Peter Zijlstra 2020-07-17 8:59 ` Peter Zijlstra 2020-07-17 22:34 ` Ira Weiny 2020-07-17 22:34 ` Ira Weiny 2020-07-20 9:15 ` Peter Zijlstra 2020-07-20 9:15 ` Peter Zijlstra 2020-07-20 18:35 ` Ira Weiny 2020-07-20 18:35 ` Ira Weiny 2020-07-17 7:20 ` [PATCH RFC V2 05/17] x86/pks: Add PKS kernel API ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 06/17] x86/pks: Add a debugfs file for allocated PKS keys ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 07/17] Documentation/pkeys: Update documentation for kernel pkeys ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 08/17] x86/pks: Add PKS Test code ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 09/17] memremap: Convert devmap static branch to {inc,dec} ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 10/17] fs/dax: Remove unused size parameter ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 11/17] drivers/dax: Expand lock scope to cover the use of addresses ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 12/17] memremap: Add zone device access protection ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 9:10 ` Peter Zijlstra 2020-07-17 9:10 ` Peter Zijlstra 2020-07-18 5:06 ` Ira Weiny 2020-07-18 5:06 ` Ira Weiny 2020-07-20 9:16 ` Peter Zijlstra 2020-07-20 9:16 ` Peter Zijlstra 2020-07-17 9:17 ` Peter Zijlstra 2020-07-17 9:17 ` Peter Zijlstra 2020-07-18 5:51 ` Ira Weiny 2020-07-18 5:51 ` Ira Weiny 2020-07-17 9:20 ` Peter Zijlstra 2020-07-17 9:20 ` Peter Zijlstra 2020-07-17 7:20 ` [PATCH RFC V2 13/17] kmap: Add stray write protection for device pages ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 9:21 ` Peter Zijlstra 2020-07-17 9:21 ` Peter Zijlstra 2020-07-19 4:13 ` Ira Weiny 2020-07-19 4:13 ` Ira Weiny 2020-07-20 9:17 ` Peter Zijlstra 2020-07-20 9:17 ` Peter Zijlstra 2020-07-21 16:31 ` Ira Weiny 2020-07-21 16:31 ` Ira Weiny 2020-07-17 7:20 ` [PATCH RFC V2 14/17] dax: Stray write protection for dax_direct_access() ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 9:22 ` Peter Zijlstra 2020-07-17 9:22 ` Peter Zijlstra 2020-07-19 4:41 ` Ira Weiny 2020-07-19 4:41 ` Ira Weiny 2020-07-17 7:20 ` [PATCH RFC V2 15/17] nvdimm/pmem: Stray write protection for pmem->virt_addr ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 7:20 ` [PATCH RFC V2 16/17] [dax|pmem]: Enable stray write protection ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 9:25 ` Peter Zijlstra 2020-07-17 9:25 ` Peter Zijlstra 2020-07-17 7:20 ` [PATCH RFC V2 17/17] x86/entry: Preserve PKRS MSR across exceptions ira.weiny 2020-07-17 7:20 ` ira.weiny 2020-07-17 9:30 ` Peter Zijlstra 2020-07-17 9:30 ` Peter Zijlstra 2020-07-21 18:01 ` Ira Weiny 2020-07-21 18:01 ` Ira Weiny 2020-07-21 19:11 ` Peter Zijlstra 2020-07-21 19:11 ` Peter Zijlstra 2020-07-17 9:34 ` Peter Zijlstra 2020-07-17 9:34 ` Peter Zijlstra 2020-07-17 10:06 ` Peter Zijlstra 2020-07-17 10:06 ` Peter Zijlstra 2020-07-22 5:27 ` Ira Weiny 2020-07-22 5:27 ` Ira Weiny 2020-07-22 9:48 ` Peter Zijlstra 2020-07-22 9:48 ` Peter Zijlstra 2020-07-22 21:24 ` Ira Weiny 2020-07-22 21:24 ` Ira Weiny 2020-07-23 20:08 ` Thomas Gleixner 2020-07-23 20:08 ` Thomas Gleixner 2020-07-23 20:15 ` Thomas Gleixner 2020-07-23 20:15 ` Thomas Gleixner 2020-07-24 17:23 ` Ira Weiny 2020-07-24 17:23 ` Ira Weiny 2020-07-24 17:29 ` Andy Lutomirski 2020-07-24 17:29 ` Andy Lutomirski 2020-07-24 19:43 ` Ira Weiny 2020-07-24 19:43 ` Ira Weiny 2020-07-22 16:21 ` Andy Lutomirski 2020-07-22 16:21 ` Andy Lutomirski 2020-07-22 16:21 ` Andy Lutomirski 2020-07-23 16:18 ` Fenghua Yu 2020-07-23 16:18 ` Fenghua Yu 2020-07-23 16:18 ` Fenghua Yu 2020-07-23 16:23 ` Dave Hansen 2020-07-23 16:23 ` Dave Hansen 2020-07-23 16:23 ` Dave Hansen 2020-07-23 16:52 ` Fenghua Yu 2020-07-23 16:52 ` Fenghua Yu 2020-07-23 16:52 ` Fenghua Yu 2020-07-23 17:08 ` Andy Lutomirski 2020-07-23 17:08 ` Andy Lutomirski 2020-07-23 17:08 ` Andy Lutomirski 2020-07-23 17:30 ` Dave Hansen 2020-07-23 17:30 ` Dave Hansen 2020-07-23 17:30 ` Dave Hansen 2020-07-23 20:23 ` Thomas Gleixner 2020-07-23 20:23 ` Thomas Gleixner 2020-07-23 20:23 ` Thomas Gleixner 2020-07-23 20:22 ` Thomas Gleixner 2020-07-23 20:22 ` Thomas Gleixner 2020-07-23 20:22 ` Thomas Gleixner 2020-07-23 21:30 ` Andy Lutomirski 2020-07-23 21:30 ` Andy Lutomirski 2020-07-23 21:30 ` Andy Lutomirski 2020-07-23 22:14 ` Thomas Gleixner 2020-07-23 22:14 ` Thomas Gleixner 2020-07-23 22:14 ` Thomas Gleixner 2020-07-23 19:53 ` Thomas Gleixner 2020-07-23 19:53 ` Thomas Gleixner 2020-07-23 22:04 ` Ira Weiny 2020-07-23 22:04 ` Ira Weiny 2020-07-23 23:41 ` Thomas Gleixner 2020-07-23 23:41 ` Thomas Gleixner 2020-07-24 21:24 ` Thomas Gleixner 2020-07-24 21:24 ` Thomas Gleixner 2020-07-24 21:31 ` Thomas Gleixner 2020-07-24 21:31 ` Thomas Gleixner 2020-07-25 0:09 ` Andy Lutomirski 2020-07-25 0:09 ` Andy Lutomirski 2020-07-25 0:09 ` Andy Lutomirski 2020-07-27 20:59 ` Ira Weiny 2020-07-27 20:59 ` Ira Weiny 2020-07-24 22:19 ` [PATCH RFC V2 00/17] PKS: Add Protection Keys Supervisor (PKS) support Kees Cook 2020-07-24 22:19 ` Kees Cook
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200717072056.73134-4-ira.weiny@intel.com \ --to=ira.weiny@intel.com \ --cc=akpm@linux-foundation.org \ --cc=bp@alien8.de \ --cc=dave.hansen@linux.intel.com \ --cc=fenghua.yu@intel.com \ --cc=linux-doc@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-kselftest@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-nvdimm@lists.01.org \ --cc=luto@kernel.org \ --cc=mingo@redhat.com \ --cc=peterz@infradead.org \ --cc=tglx@linutronix.de \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.