Received: by 2002:ac0:a5a6:0:0:0:0:0 with SMTP id m35-v6csp647509imm; Wed, 29 Aug 2018 08:42:49 -0700 (PDT) X-Google-Smtp-Source: ANB0VdZ2foZzi0avFG6MqUiACnW69i/pbpxHT834OKq4moGmxtWFGeVd83AIFsR5B9evus5MbzkV X-Received: by 2002:a63:881:: with SMTP id 123-v6mr5711790pgi.244.1535557369460; Wed, 29 Aug 2018 08:42:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1535557369; cv=none; d=google.com; s=arc-20160816; b=jQnS2cFpmCHJHG2wX8qsTzWS2aqL0/qOxhObV8r6fUYF8lavg1dZBj+cxbytLRWfMX MYPlXy8dgAiJ9iXPI2EVB0Ci3cA9IoJCSZ+g+KNHvV+XMJIusHa6CQxWjbyGKEOcA/JC bHxsBuRdMrWW7+HqOU0rNpOBxbjve3Op1oY+ojYXBn/V+TW12StDEOSzZn5XjM7FgKqE syBE6KUFxlxB9/fj8Ld33BlUWroDT3usc/+yGFnCEwJSgJVxZ4YznkRZz1MXtMJnVE1k +0KnYNeZy1kS3YgUWYHQKi0YAxjXy9XX7fP6LSTDLPAW0ngOUKfDS1hvKA/7bTpwB88N RIpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :references:in-reply-to:mime-version:dkim-signature :arc-authentication-results; bh=wSD5fEcnXFgPgo0+n66GCj9eq5zRDfLVfVyVbAzB2p8=; b=yBSSIPj7PFXaXiSjpWRbk2Rs8YG21sYIQPYPhBvcacNROO0aaen7TyAjgjDt6iroGT 4lGSunQN0bBP4o4kfMLQpah42LOpMbS+PY2hAvq540hrCT6PpK93QxGaUWwsUsPR9woe iLY1FQzvrASeyj7Vbk5m4crv5BU7jrp0IfEpsNBEmG2TmMwkHSCDnM/ovroRvb5dx4Ns H+E6rW8fsSQaeM/3GVJ7/LheHuCcLL7OUhVc/AAzNnENV7VMeTBf328V/CwcLafInHF0 2neHxx/IECnhoZi1pMrPc+CxuM8EqUULa95Ng6CoBOsBFJTcDAKf1u+1S+kHaJJGpZYD 2lkg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=ckSluf2L; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l9-v6si3983443pgg.622.2018.08.29.08.42.34; Wed, 29 Aug 2018 08:42:49 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=ckSluf2L; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729148AbeH2Tiy (ORCPT + 99 others); Wed, 29 Aug 2018 15:38:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:38858 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728979AbeH2Tiy (ORCPT ); Wed, 29 Aug 2018 15:38:54 -0400 Received: from mail-wm0-f54.google.com (mail-wm0-f54.google.com [74.125.82.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EADCD20657 for ; Wed, 29 Aug 2018 15:41:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1535557283; bh=J606gdsmgQKnwfuPsG1tL/3EsYA8BWhdz7evHDIlJcQ=; h=In-Reply-To:References:From:Date:Subject:To:Cc:From; b=ckSluf2LGBfreaLXx42jcWHBBoGoGN7F5JgQaiJ31gMmPNsrmFI9IelDu3NWsgEdj sazTPwSH9PNXLpT3I5qFnvYFgA4yUozYg+iItjZ1yjuVovS2R8/4NfRybo4bopgEGb 0TS+95wSeT6D8DLEK/2TxR5deYJuLz9G3uzm8CS4= Received: by mail-wm0-f54.google.com with SMTP id b19-v6so5768184wme.3 for ; Wed, 29 Aug 2018 08:41:22 -0700 (PDT) X-Gm-Message-State: APzg51Aw5/GTna6FHSfW850CRw88SzYt2WS7iff952Hdu5Y2bRdXZJgW BoB6EwUM6bfElSKp38cNnY91zjAQvzBnTIdgCdT7SQ== X-Received: by 2002:a1c:8313:: with SMTP id f19-v6mr4376166wmd.144.1535557281428; Wed, 29 Aug 2018 08:41:21 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a1c:548:0:0:0:0:0 with HTTP; Wed, 29 Aug 2018 08:41:00 -0700 (PDT) In-Reply-To: <20180829184925.64caee4dadf705080373f84f@kernel.org> References: <20180829081147.184610-1-namit@vmware.com> <20180829081147.184610-3-namit@vmware.com> <20180829184925.64caee4dadf705080373f84f@kernel.org> From: Andy Lutomirski Date: Wed, 29 Aug 2018 08:41:00 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC PATCH 2/6] x86/mm: temporary mm struct To: Masami Hiramatsu Cc: Nadav Amit , Thomas Gleixner , LKML , Ingo Molnar , X86 ML , Arnd Bergmann , linux-arch , Andy Lutomirski , Kees Cook , Peter Zijlstra Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Aug 29, 2018 at 2:49 AM, Masami Hiramatsu wrote: > On Wed, 29 Aug 2018 01:11:43 -0700 > Nadav Amit wrote: > >> From: Andy Lutomirski >> >> Sometimes we want to set a temporary page-table entries (PTEs) in one of >> the cores, without allowing other cores to use - even speculatively - >> these mappings. There are two benefits for doing so: >> >> (1) Security: if sensitive PTEs are set, temporary mm prevents their use >> in other cores. This hardens the security as it prevents exploding a >> dangling pointer to overwrite sensitive data using the sensitive PTE. >> >> (2) Avoiding TLB shootdowns: the PTEs do not need to be flushed in >> remote page-tables. >> >> To do so a temporary mm_struct can be used. Mappings which are private >> for this mm can be set in the userspace part of the address-space. >> During the whole time in which the temporary mm is loaded, interrupts >> must be disabled. >> >> The first use-case for temporary PTEs, which will follow, is for poking >> the kernel text. >> >> [ Commit message was written by Nadav ] >> >> Cc: Andy Lutomirski >> Cc: Masami Hiramatsu >> Cc: Kees Cook >> Cc: Peter Zijlstra >> Signed-off-by: Nadav Amit >> --- >> arch/x86/include/asm/mmu_context.h | 20 ++++++++++++++++++++ >> 1 file changed, 20 insertions(+) >> >> diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h >> index eeeb9289c764..96afc8c0cf15 100644 >> --- a/arch/x86/include/asm/mmu_context.h >> +++ b/arch/x86/include/asm/mmu_context.h >> @@ -338,4 +338,24 @@ static inline unsigned long __get_current_cr3_fast(void) >> return cr3; >> } >> >> +typedef struct { >> + struct mm_struct *prev; >> +} temporary_mm_state_t; >> + >> +static inline temporary_mm_state_t use_temporary_mm(struct mm_struct *mm) >> +{ >> + temporary_mm_state_t state; >> + >> + lockdep_assert_irqs_disabled(); >> + state.prev = this_cpu_read(cpu_tlbstate.loaded_mm); >> + switch_mm_irqs_off(NULL, mm, current); >> + return state; >> +} > > Hmm, why don't we return mm_struct *prev directly? I did it this way to make it easier to add future debugging stuff later. Also, when I first wrote this, I stashed the old CR3 instead of the old mm_struct, and it seemed like callers should be insulated from details like this.