From: Yang Shi <yang@os.amperecomputing.com> To: Catalin Marinas <catalin.marinas@arm.com> Cc: will@kernel.org, scott@os.amperecomputing.com, cl@gentwo.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] arm64: mm: force write fault for atomic RMW instructions Date: Mon, 13 May 2024 21:19:39 -0600 [thread overview] Message-ID: <f1049f13-53e4-470e-89e5-d99d7e171d39@os.amperecomputing.com> (raw) In-Reply-To: <Zj4O8q9-bliXE435@arm.com> >> + >> + if (get_user(insn, (unsigned int __user *) instruction_pointer(regs))) { >> + pagefault_enable(); >> + goto continue_fault; >> + } >> + >> + if (aarch64_insn_is_class_atomic(insn)) { >> + vm_flags = VM_WRITE; >> + mm_flags |= FAULT_FLAG_WRITE; >> + } > The above would need to check if the fault is coming from a 64-bit user > mode, otherwise the decoding wouldn't make sense: > > if (!user_mode(regs) || compat_user_mode(regs)) > return false; > > (assuming a separate function that checks the above and returns a bool; > you'd need to re-enable the page faults) > > You also need to take care of endianness since the instructions are > always little-endian. We use a similar pattern in user_insn_read(): > > u32 instr; > __le32 instr_le; > if (get_user(instr_le, (__le32 __user *)instruction_pointer(regs))) > return false; > instr = le32_to_cpu(instr_le); > ... > > That said, I'm not keen on this kernel workaround. If openjdk decides to > improve some security and goes for PROT_EXEC-only mappings of its text > sections, the above trick will no longer work. I noticed futex does replace insns. IIUC, the below sequence should can do the trick for exec-only, right? disable privileged read insn with ldxr enable privileged >
WARNING: multiple messages have this Message-ID (diff)
From: Yang Shi <yang@os.amperecomputing.com> To: Catalin Marinas <catalin.marinas@arm.com> Cc: will@kernel.org, scott@os.amperecomputing.com, cl@gentwo.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] arm64: mm: force write fault for atomic RMW instructions Date: Mon, 13 May 2024 21:19:39 -0600 [thread overview] Message-ID: <f1049f13-53e4-470e-89e5-d99d7e171d39@os.amperecomputing.com> (raw) In-Reply-To: <Zj4O8q9-bliXE435@arm.com> >> + >> + if (get_user(insn, (unsigned int __user *) instruction_pointer(regs))) { >> + pagefault_enable(); >> + goto continue_fault; >> + } >> + >> + if (aarch64_insn_is_class_atomic(insn)) { >> + vm_flags = VM_WRITE; >> + mm_flags |= FAULT_FLAG_WRITE; >> + } > The above would need to check if the fault is coming from a 64-bit user > mode, otherwise the decoding wouldn't make sense: > > if (!user_mode(regs) || compat_user_mode(regs)) > return false; > > (assuming a separate function that checks the above and returns a bool; > you'd need to re-enable the page faults) > > You also need to take care of endianness since the instructions are > always little-endian. We use a similar pattern in user_insn_read(): > > u32 instr; > __le32 instr_le; > if (get_user(instr_le, (__le32 __user *)instruction_pointer(regs))) > return false; > instr = le32_to_cpu(instr_le); > ... > > That said, I'm not keen on this kernel workaround. If openjdk decides to > improve some security and goes for PROT_EXEC-only mappings of its text > sections, the above trick will no longer work. I noticed futex does replace insns. IIUC, the below sequence should can do the trick for exec-only, right? disable privileged read insn with ldxr enable privileged > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2024-05-14 3:19 UTC|newest] Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-05-07 22:35 [PATCH] arm64: mm: force write fault for atomic RMW instructions Yang Shi 2024-05-07 22:35 ` Yang Shi 2024-05-07 22:42 ` Christoph Lameter (Ampere) 2024-05-08 6:45 ` Anshuman Khandual 2024-05-08 6:45 ` Anshuman Khandual 2024-05-08 17:15 ` Christoph Lameter (Ampere) 2024-05-08 17:15 ` Christoph Lameter (Ampere) 2024-05-09 4:23 ` Anshuman Khandual 2024-05-09 4:23 ` Anshuman Khandual 2024-05-13 22:39 ` Christoph Lameter (Ampere) 2024-05-13 22:39 ` Christoph Lameter (Ampere) 2024-05-08 18:37 ` Yang Shi 2024-05-08 18:37 ` Yang Shi 2024-05-09 4:31 ` Anshuman Khandual 2024-05-09 4:31 ` Anshuman Khandual 2024-05-09 21:46 ` Yang Shi 2024-05-09 21:46 ` Yang Shi 2024-05-10 4:28 ` Anshuman Khandual 2024-05-10 4:28 ` Anshuman Khandual 2024-05-10 16:37 ` Yang Shi 2024-05-10 16:37 ` Yang Shi 2024-05-10 12:11 ` Catalin Marinas 2024-05-10 12:11 ` Catalin Marinas 2024-05-10 17:13 ` Yang Shi 2024-05-10 17:13 ` Yang Shi 2024-05-13 22:41 ` Christoph Lameter (Ampere) 2024-05-13 22:41 ` Christoph Lameter (Ampere) 2024-05-14 10:39 ` Catalin Marinas 2024-05-14 10:39 ` Catalin Marinas 2024-05-14 15:57 ` David Hildenbrand 2024-05-14 15:57 ` David Hildenbrand 2024-05-17 16:30 ` Yang Shi 2024-05-17 16:30 ` Yang Shi 2024-05-17 17:25 ` Catalin Marinas 2024-05-17 17:25 ` Catalin Marinas 2024-05-17 17:35 ` Yang Shi 2024-05-17 17:35 ` Yang Shi 2024-05-14 3:19 ` Yang Shi [this message] 2024-05-14 3:19 ` Yang Shi 2024-05-14 10:53 ` Catalin Marinas 2024-05-14 10:53 ` Catalin Marinas 2024-05-17 16:10 ` Yang Shi 2024-05-17 16:10 ` Yang Shi
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=f1049f13-53e4-470e-89e5-d99d7e171d39@os.amperecomputing.com \ --to=yang@os.amperecomputing.com \ --cc=catalin.marinas@arm.com \ --cc=cl@gentwo.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=scott@os.amperecomputing.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.