From nobody Sat Feb 7 22:07:13 2026 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D96F23A566 for ; Thu, 27 Feb 2025 14:03:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665007; cv=none; b=shDpNq3G0Cq9bV5KO/LwhcvvAFYrLqXpE80en7wSmlYHiT2MJNmarLbCGSLEu/dtj/TVPJyPHIPp3wXDfKAfNdVSdMdNWfi3lRgjPZ3uzqIaH6TQj0X9Bado155kPeDoy/SBYWcBVt/bN5O8rVTch4KJCLTD3Dp4tILiab6OmB4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665007; c=relaxed/simple; bh=g+n3TAVbRYeopfv2thFyRpDHZ0uzmD8PYIu8wMyexJA=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=HfWsaCNxvCwZEfdWqk+q6bHs9x//NU/y7DRbrYXsawRf+aw4SrBsDEm0FiJfhce1IhpQeUii1f3cmLbkr4bW2ufPzWMFfjeqwugrjw98Tsq0TAAKxo16cIWU8Sjyad+Og/EcwgXTJNAjE7BmWFsl33/UNro4J5zuN2hlvH3RmtQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=cS21NNHT; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="cS21NNHT" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-4399c5baac3so7699945e9.2 for ; Thu, 27 Feb 2025 06:03:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740665003; x=1741269803; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=qdyNR/l9tUX5mWYlAxYoBmtPUMPfXZLm9s3JeHQDuDg=; b=cS21NNHTlT6lHaw5Wh314sITmhOcyyvtOrswP/CVG817WDfULelF0oAsOZtiuAZDkG Di0cRtBcvZm1l5UqTvCp6FXiEZ6lcXsRAUUu2PFMC0mHepJbSHqOGD3OHCLD0hlLpFIe nNUxg23qbYTCbQ7ZGlNkJUtOLgS1Ka8Yp6cIps0L7+5i13eZSEP+zkCzL9V0Zp71CFfV ZsVmBZDb23iY1Nsxd2sRXhPqcoQA5OBOceloHZUtQYcpvtXcRz4SVwHeZ+YyR9muVhtO h5s7SmjIFl6/VHTAdMjGn04wreUoXL1ja5+UhpgCO+5AoohuvLKpBVI0E77afCviBMEu K4fQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740665003; x=1741269803; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=qdyNR/l9tUX5mWYlAxYoBmtPUMPfXZLm9s3JeHQDuDg=; b=slJX6IC5RMvyIL/4tdyRf5iMiUJPpwr/aWUrP7x233OIML7FFxu1nQLcLPaGjpfTP4 0moCoyaGJu3q5l5+RcHjHzcZRbei+JemW9ohygD5Fgq9sph6LM6SrNursZjBa9LcOi48 iQaBy2HQ92s26xlCuLT2GcsezJDklm0aKDurL5WaNZiKgsPwQ3z9nLn4ymWal1K1fVKc 9acGgd4reCG2ryqarS4s+gL7gDFJ2n0K0+1+LarVOZwkOHJURQTcPipjeFbfMZVBY0ia d6xnVU8PhHvCTJ9K2cS38jtip2wmxBy0O3OdVRFsJVYwdZUW20OUTff0LuGmgsi8076n 9bEA== X-Forwarded-Encrypted: i=1; AJvYcCVYW52R0fTama+vf82Xi1yppiUlp07rJhdIrpC4cy0EZS63siOMc0zqhMRSPGVUBT94uOPyUbIrPuOmSiM=@vger.kernel.org X-Gm-Message-State: AOJu0YwhxzpOEBAM9QjShwG88lJHW3OC4WsgNkRfuplmZCL43Gc+FjgJ Kv7kNrD9FSIYLXbNWRicRSpEK5pis4X50V2OdYT0pmeuLisJcxKvg+/+Z5DY9N4Dj0VaPeUhsRi 1QWpMjw== X-Google-Smtp-Source: AGHT+IGzvaJpoX4KLT7TQbb8SqIGurpls2L2bzHwZkcN5jr6r8UyFgg+P+X6U8CeEmO0M1lNmukGM2gQma4s X-Received: from wmbjb4.prod.google.com ([2002:a05:600c:54e4:b0:439:98ca:e39d]) (user=dvyukov job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:3b13:b0:439:8bc3:a697 with SMTP id 5b1f17b1804b1-43ab8fd1f46mr68084445e9.4.1740665003383; Thu, 27 Feb 2025 06:03:23 -0800 (PST) Date: Thu, 27 Feb 2025 15:03:12 +0100 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: Subject: [PATCH v6 1/4] pkeys: add API to switch to permissive/zero pkey register From: Dmitry Vyukov To: mathieu.desnoyers@efficios.com, peterz@infradead.org, boqun.feng@gmail.com, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, aruna.ramakrishna@oracle.com, elver@google.com Cc: Dmitry Vyukov , "Paul E. McKenney" , x86@kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The API allows to switch to permissive pkey register that allows accesses to all PKEYs, and to a value that allows access to the 0 (default) PKEY. x86 signal delivery already uses switching to permissive PKEY register value, and rseq needs to allow access to PKEY 0 while accessing struct rseq/rseq_cs. Signed-off-by: Dmitry Vyukov Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Aruna Ramakrishna Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Mathieu Desnoyers Fixes: d7822b1e24f2 ("rseq: Introduce restartable sequences system call") --- Changes in v5: - Removed leftover dead code in enable_zero_pkey_val - Clarified commit message Changes in v4: - Added Fixes tag Changes in v3: - Renamed API functions to write_permissive_pkey_val/write_pkey_val - Added enable_zero_pkey_val for rseq - Added Reviewed-by: Mathieu Desnoyers Changes in v2: - Fixed typo in commit description --- arch/x86/Kconfig | 1 + arch/x86/include/asm/pkeys.h | 30 ++++++++++++++++++++++++++++++ arch/x86/include/asm/pkru.h | 10 +++++++--- include/linux/pkeys.h | 31 +++++++++++++++++++++++++++++++ mm/Kconfig | 2 ++ 5 files changed, 71 insertions(+), 3 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index be2c311f5118d..43af2840d098f 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1881,6 +1881,7 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS depends on X86_64 && (CPU_SUP_INTEL || CPU_SUP_AMD) select ARCH_USES_HIGH_VMA_FLAGS select ARCH_HAS_PKEYS + select ARCH_HAS_PERMISSIVE_PKEY help Memory Protection Keys provides a mechanism for enforcing page-based protections, but without requiring modification of the diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h index 2e6c04d8a45b4..614099766d5f2 100644 --- a/arch/x86/include/asm/pkeys.h +++ b/arch/x86/include/asm/pkeys.h @@ -2,6 +2,8 @@ #ifndef _ASM_X86_PKEYS_H #define _ASM_X86_PKEYS_H =20 +#include "pkru.h" + /* * If more than 16 keys are ever supported, a thorough audit * will be necessary to ensure that the types that store key @@ -123,4 +125,32 @@ static inline int vma_pkey(struct vm_area_struct *vma) return (vma->vm_flags & vma_pkey_mask) >> VM_PKEY_SHIFT; } =20 +typedef u32 pkey_reg_t; + +static inline pkey_reg_t write_permissive_pkey_val(void) +{ + return write_pkru(0); +} + +static inline pkey_reg_t enable_zero_pkey_val(void) +{ + u32 pkru; + + if (!cpu_feature_enabled(X86_FEATURE_OSPKE)) + return 0; + /* + * WRPKRU is relatively expensive compared to RDPKRU, + * avoid it if possible. + */ + pkru =3D rdpkru(); + if ((pkru & (PKRU_AD_BIT|PKRU_WD_BIT)) !=3D 0) + wrpkru(pkru & ~(PKRU_AD_BIT|PKRU_WD_BIT)); + return pkru; +} + +static inline void write_pkey_val(pkey_reg_t val) +{ + write_pkru(val); +} + #endif /*_ASM_X86_PKEYS_H */ diff --git a/arch/x86/include/asm/pkru.h b/arch/x86/include/asm/pkru.h index 74f0a2d34ffdd..b9bf9b7f2753b 100644 --- a/arch/x86/include/asm/pkru.h +++ b/arch/x86/include/asm/pkru.h @@ -39,16 +39,20 @@ static inline u32 read_pkru(void) return 0; } =20 -static inline void write_pkru(u32 pkru) +static inline u32 write_pkru(u32 pkru) { + u32 old_pkru; + if (!cpu_feature_enabled(X86_FEATURE_OSPKE)) - return; + return 0; /* * WRPKRU is relatively expensive compared to RDPKRU. * Avoid WRPKRU when it would not change the value. */ - if (pkru !=3D rdpkru()) + old_pkru =3D rdpkru(); + if (pkru !=3D old_pkru) wrpkru(pkru); + return old_pkru; } =20 static inline void pkru_write_default(void) diff --git a/include/linux/pkeys.h b/include/linux/pkeys.h index 86be8bf27b41b..262d60f6a15f8 100644 --- a/include/linux/pkeys.h +++ b/include/linux/pkeys.h @@ -48,4 +48,35 @@ static inline bool arch_pkeys_enabled(void) =20 #endif /* ! CONFIG_ARCH_HAS_PKEYS */ =20 +#ifndef CONFIG_ARCH_HAS_PERMISSIVE_PKEY + +/* + * Common name for value of the register that controls access to PKEYs + * (called differently on different arches: PKRU, POR, AMR). + */ +typedef char pkey_reg_t; + +/* + * Sets PKEY access register to the most permissive value that allows + * accesses to all PKEYs. Returns the current value of PKEY register. + * Code should generally arrange switching back to the old value + * using write_pkey_val(old_value). + */ +static inline pkey_reg_t write_permissive_pkey_val(void) +{ + return 0; +} + +/* + * Sets PKEY access register to a value that allows access to the 0 (defau= lt) + * PKEY. Returns the current value of PKEY register. + */ +static inline pkey_reg_t enable_zero_pkey_val(void) +{ + return 0; +} + +static inline void write_pkey_val(pkey_reg_t val) {} +#endif /* ! CONFIG_ARCH_HAS_PERMISSIVE_PKEY */ + #endif /* _LINUX_PKEYS_H */ diff --git a/mm/Kconfig b/mm/Kconfig index 1b501db064172..9e874f7713a2b 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1147,6 +1147,8 @@ config ARCH_USES_HIGH_VMA_FLAGS bool config ARCH_HAS_PKEYS bool +config ARCH_HAS_PERMISSIVE_PKEY + bool =20 config ARCH_USES_PG_ARCH_2 bool --=20 2.48.1.658.g4767266eb4-goog From nobody Sat Feb 7 22:07:13 2026 Received: from mail-ed1-f74.google.com (mail-ed1-f74.google.com [209.85.208.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5971023A9A8 for ; Thu, 27 Feb 2025 14:03:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665009; cv=none; b=I9rsXQ18P3GCvqidOMCAeAzUQ3Hde4bMwONIO+6q13BUIc67g9IlzrKYxvnl56Dk6tAVELSsgytzOvoE3tzcFgebL1Rw4IuSxMxV4AEYphKnjVvxMje1U5O5Tmg7AckenuLd/9jY7MsksQkNmSd+jpZ26qKAZ07A+UEq0o9pwGU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665009; c=relaxed/simple; bh=CpsQ8gPZhCNNexBNxcXW/ScOiO2pyTQCoBkZQKi+y/U=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=WQm5oI9cfMvykHbv8eiyvUopF4Bkygw5ADODwzDyj1osfq940Fc/VNTVcQVZrp3n7xsevWleuuwPMO4zJei3nYPBsOw0Trmz1Nsr1lrxE5v1iB4VDc/zqG1m3H8TZIZ03Bj3qSkFN7eyHNF0Gm2m7SIIRBkykOioY22oJ9jrtug= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=PYeN2jNx; arc=none smtp.client-ip=209.85.208.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="PYeN2jNx" Received: by mail-ed1-f74.google.com with SMTP id 4fb4d7f45d1cf-5e067bbd3baso886445a12.3 for ; Thu, 27 Feb 2025 06:03:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740665005; x=1741269805; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=zNcMrV7t1QnfFYP1kD7TtFwTsf7x6jGURXQgshyNxRc=; b=PYeN2jNxq8l7jxLv1/NQgeD6n/gC/eDW0YLYPcw9cUyVZk9hMyoY6G3NZyYKpWgDOS bRkXvb4eg3kLaG/jH87augO/3SW3jWPdpt/a2/JN/CaPy/Cf7dMJyOdJnl8Xhp0odWS0 AT4ZB9LBzIb+mqL4N4TVDcw3l5bF8wVCiapHv1Oyo2QknfG7YY7Y/T9c2r9LNDT5G7ge vu+bSFuDlq9ewEsNW+zMIZAaSWtikqKzZgsRbK/LiAuuUldmKxu8z3k7cHX6vV6ybVlj 9Td+iuEja3+G9EEhm+PpTWSEilcqGJYQkpOw3xVysOASwKN0bMmDvCyRuhb0tdv8kudz fNEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740665005; x=1741269805; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zNcMrV7t1QnfFYP1kD7TtFwTsf7x6jGURXQgshyNxRc=; b=TBqVck2MuZoiOA6UqhKKIS6hSS5ghCjUAEQkm7l27Tfc9bR1hzsSXmu5rgh66Bjqyd K2jaCs2SElDf9Ji0rPIRIvGEfQgxeyVvvjsR+u9Jrx1X66XIXizZHQ0iqhxBiesRdJH1 ei3ElfZ7w5fdTjEeREqnZJvROZohbg0K5mH7QnwiNI6J0EjdFYsHP8rj9XKPJAF0jVum QitPCfwosPG5tDdyvq5wzwb2Kk/jrQWqN2mTVzfF6qGn9vpFUsl8vSmaHyhkvDGdY10K bH9zjr0b7p1U4xjsrh7O9jEqncAIAl8vw3QUMSJEHNELFABwZ7Axnq84/JzTDVBBzsms /3Kg== X-Forwarded-Encrypted: i=1; AJvYcCVQ8s2VZDqTNCATp3b10Uj/kpdP9rYJfLSMSG1XU90+Rw0q3vN2CfRyw1rTyhZ/XKz83hGvpjaExTM4anw=@vger.kernel.org X-Gm-Message-State: AOJu0YyAObjYFzpseGFkfJNRBNOpLZrxZuHF03PgKh03Oho0f/8XC2CH kjCAOEv/+gQTHjFbRnTJs29rmovT6ggRjChojQNRAJcUyA+8kyn6UqAmgtjOKtjPRmBfWSEH3ow 1RZai+Q== X-Google-Smtp-Source: AGHT+IECnDVAUP/qesMVuEzS6Zlg9/xWdmrOeegb9HOJzOIDXshJAI6t0Db6uyA/R2Zo0JsDUzdzaRhPLSfQ X-Received: from edbio9.prod.google.com ([2002:a05:6402:2189:b0:5de:61a6:f3b9]) (user=dvyukov job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:5508:b0:5dc:cc02:5d25 with SMTP id 4fb4d7f45d1cf-5e4a0d71d15mr9506998a12.11.1740665005693; Thu, 27 Feb 2025 06:03:25 -0800 (PST) Date: Thu, 27 Feb 2025 15:03:13 +0100 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: <6873fab2d09be6a4254201391872daf0c455b5cd.1740664852.git.dvyukov@google.com> Subject: [PATCH v6 2/4] x86/signal: Use write_permissive_pkey_val() helper From: Dmitry Vyukov To: mathieu.desnoyers@efficios.com, peterz@infradead.org, boqun.feng@gmail.com, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, aruna.ramakrishna@oracle.com, elver@google.com Cc: Dmitry Vyukov , "Paul E. McKenney" , x86@kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Use the new switch_to_permissive_pkey_reg() helper instead of the custom code. No functional changes intended. Signed-off-by: Dmitry Vyukov Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Aruna Ramakrishna Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org --- Changes in v3: - restore sig_prepare_pkru with the large comment and make it call the new write_permissive_pkey_val --- arch/x86/kernel/signal.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index 5f441039b5725..27a66a0697dd2 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -28,6 +28,7 @@ #include #include #include +#include =20 #include #include @@ -72,10 +73,7 @@ static inline int is_x32_frame(struct ksignal *ksig) */ static inline u32 sig_prepare_pkru(void) { - u32 orig_pkru =3D read_pkru(); - - write_pkru(0); - return orig_pkru; + return write_permissive_pkey_val(); } =20 /* --=20 2.48.1.658.g4767266eb4-goog From nobody Sat Feb 7 22:07:13 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB85123BF9E for ; Thu, 27 Feb 2025 14:03:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665011; cv=none; b=C9TDdSs4PpzYot1bAuNQHN/wYzH2U8qC6x4NRhcEy1i51KUGz+IVMNqALdXQHM6ye3VAKS/Lz1I5PdktYcjuht8D5zM9dRv1n8+kPxn7Agj92fWMmMNec3Z/L7HtNpvMkEqkZ73X6Y2jWd/xnyb5qpT/CM3GukG3FCGwjDsgtj4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665011; c=relaxed/simple; bh=tEYzJCTiKzF2LYVQgmRQQO5J+znKSKUm4lTw0Foc0rI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=SUEhb4QJdAWdN+tLdHsvalH8stSLSUnvHyauLOO2nw5VrZxjhJk4Bzcff78FhJ18PuZm1yockoZWSHSLRZTkTiWG5Q3W87YnHlDe+5wdjoP0zj1bSwO+1vjA9Asgd8r+0j6bKmxuZhhyV+ahswgOouCLssTgg0l/18Bh7APvojs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=RCxIQVf2; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RCxIQVf2" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-4399a5afcb3so8917085e9.3 for ; Thu, 27 Feb 2025 06:03:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740665008; x=1741269808; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=UERrY3gBSSj6jqgnpUhhnhNURH28RQ/gzb1aJd+BElY=; b=RCxIQVf2TR8+mwFImbw6l59LvRKXpw5erPd9Cv9YWlqKocgh80eu5+gjVqORvfR8HG iDJ9lYTvhq2X4YKPwGH3mk/JdcYsXKg+TnwO7b5fvM7C9Usezhk0oh362XHJYieIqqtc lhW936th2L1Q+Ki/DK7DEhOPqWRvEz+X1Y3IrQLRX8sgc2z8Kfy6kNgFBR1sI1GQpbx3 BI9De0HgsUlZxdjdzqb6+pNisMEnV8Nv2c+WWFehq/BwgYY1qJroeiezypYR3wUQl9yz jlD7u5aMPrkUCNPLLAqzMqo901l7RWNBvxJzqQD7LPZetej7gCdr+u3vo6gKQwb3fU+5 W88A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740665008; x=1741269808; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=UERrY3gBSSj6jqgnpUhhnhNURH28RQ/gzb1aJd+BElY=; b=jKiXv2uDhRNqC3y+r7WqmhSX+t5GOha0LVc6WcEEJc0j3jkpqYSp1Lq0RW7CxDNyrB KEdJOO2531XoRxRiCgKeNpVtx/tjHMc+8rJcPUG7KEheXG9OQ041HJVUpOfF0+5o2uka 32gLCFhaFAhqxa/p6yjJzPJZHKkKs/CId76cRTqDLFU6nSh+VrYIDzqN4m2to2X+FNlA ZQunK7lRJVUEu6brzA8LVZmgb1NQ/zJQTHtTUm1WN48pucga3A+yITnwz74F0ikwdque qG37/7Osf+D+RF77y45iGsPuu67oBcOOLKP2J5BX5/Toe5SGnV19zpd88SUctXc/oNdx ZRSw== X-Forwarded-Encrypted: i=1; AJvYcCUsShb/zjyu6FHCHO9BLel35ESMlBtZIGfuLzIzQLI+OBWH42r97TyYdKgqdwPKGgtRtYUbIiXi3XNKtG0=@vger.kernel.org X-Gm-Message-State: AOJu0YzCmT+G3kAE/xL4c9ZxZfs1ZuSOwMAHXwbLmiPw1eKu2wekGZAy wdMESFZRpAwBKFiQmYzcXUG01qy+BjJePp5Jv5f1fPXfg+JJ9g+JRe4Sib3YSAGZz0Xwwu22XY2 PF+mK8Q== X-Google-Smtp-Source: AGHT+IGELPmTJWOnBa0OmWHIZY2PvlDBv7UKitIGSs6BatAfX6oWrFx6LdmrVg2XeAUP6GEID5iXeu8ZKecv X-Received: from wmbg8.prod.google.com ([2002:a05:600c:a408:b0:439:88bc:d27d]) (user=dvyukov job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:5117:b0:439:86fb:7325 with SMTP id 5b1f17b1804b1-43ab0f8dd49mr129858495e9.31.1740665008218; Thu, 27 Feb 2025 06:03:28 -0800 (PST) Date: Thu, 27 Feb 2025 15:03:14 +0100 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: Subject: [PATCH v6 3/4] rseq: Make rseq work with protection keys From: Dmitry Vyukov To: mathieu.desnoyers@efficios.com, peterz@infradead.org, boqun.feng@gmail.com, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, aruna.ramakrishna@oracle.com, elver@google.com Cc: Dmitry Vyukov , "Paul E. McKenney" , x86@kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If an application registers rseq, and ever switches to another pkey protection (such that the rseq becomes inaccessible), then any context switch will cause failure in __rseq_handle_notify_resume() attempting to read/write struct rseq and/or rseq_cs. Since context switches are asynchronous and are outside of the application control (not part of the restricted code scope), temporarily switch to pkey value that allows access to the 0 (default) PKEY. Signed-off-by: Dmitry Vyukov Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Aruna Ramakrishna Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Fixes: d7822b1e24f2 ("rseq: Introduce restartable sequences system call") Reviewed-by: Mathieu Desnoyers --- Changes in v6: - Added a comment to struct rseq with MPK rules Changes in v4: - Added Fixes tag Changes in v3: - simplify control flow to always enable access to 0 pkey Changes in v2: - fixed typos and reworded the comment --- include/uapi/linux/rseq.h | 4 ++++ kernel/rseq.c | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/include/uapi/linux/rseq.h b/include/uapi/linux/rseq.h index c233aae5eac90..019fd248cf749 100644 --- a/include/uapi/linux/rseq.h +++ b/include/uapi/linux/rseq.h @@ -58,6 +58,10 @@ struct rseq_cs { * contained within a single cache-line. * * A single struct rseq per thread is allowed. + * + * If struct rseq or struct rseq_cs is used with Memory Protection Keys, + * then the assigned pkey should either be accessible whenever these struc= ts + * are registered/installed, or they should be protected with pkey 0. */ struct rseq { /* diff --git a/kernel/rseq.c b/kernel/rseq.c index 2cb16091ec0ae..9d9c976d3b78c 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -10,6 +10,7 @@ =20 #include #include +#include #include #include #include @@ -402,11 +403,19 @@ static int rseq_ip_fixup(struct pt_regs *regs) void __rseq_handle_notify_resume(struct ksignal *ksig, struct pt_regs *reg= s) { struct task_struct *t =3D current; + pkey_reg_t saved_pkey; int ret, sig; =20 if (unlikely(t->flags & PF_EXITING)) return; =20 + /* + * Enable access to the default (0) pkey in case the thread has + * currently disabled access to it and struct rseq/rseq_cs has + * 0 pkey assigned (the only supported value for now). + */ + saved_pkey =3D enable_zero_pkey_val(); + /* * regs is NULL if and only if the caller is in a syscall path. Skip * fixup and leave rseq_cs as is so that rseq_sycall() will detect and @@ -419,9 +428,11 @@ void __rseq_handle_notify_resume(struct ksignal *ksig,= struct pt_regs *regs) } if (unlikely(rseq_update_cpu_node_id(t))) goto error; + write_pkey_val(saved_pkey); return; =20 error: + write_pkey_val(saved_pkey); sig =3D ksig ? ksig->sig : 0; force_sigsegv(sig); } --=20 2.48.1.658.g4767266eb4-goog From nobody Sat Feb 7 22:07:13 2026 Received: from mail-ed1-f74.google.com (mail-ed1-f74.google.com [209.85.208.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E87623E23D for ; Thu, 27 Feb 2025 14:03:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665014; cv=none; b=qbSno3dI59rUd+10GbrAngiosm5W87ADanWMN6LC8n1yxNmXm96fr0qIX21+EZgGmf5udWZsU08WxEotZt1HxE/S6v+fUZ8voCw9J9Q9Ei2ukIX7jSWOAIpS59MGM/e+9ej6Wn8NoHCqqA/O1nsC9gK69n8l0Qhs9QuZR4pR1rc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740665014; c=relaxed/simple; bh=yRnlyHY5sj0nPolyHcCX0W1VmtYMVBh6HOo3S9R4zcs=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=u43OoarrrKZC7CseQPtwHGbrZ7Cnhsc/oCnTfAjl7eK5k6czHpbluGD3pbdKUBgD2AeJEdj4gkHPdhAb3nQiKLQZ+VEOhQyQj2EqYyzL7NKoqorHxGqrjIJlJYHXZXIQU1s98VCjmk2F65yMmH5sxDjn7/phP5+b1SkJfaqv82w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Fdirh3ZE; arc=none smtp.client-ip=209.85.208.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--dvyukov.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Fdirh3ZE" Received: by mail-ed1-f74.google.com with SMTP id 4fb4d7f45d1cf-5e04de6583bso1450661a12.1 for ; Thu, 27 Feb 2025 06:03:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1740665010; x=1741269810; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=i4/DXlVSjcMlIzI08dLupqZQFFeRwmRS51ToDVNdHuU=; b=Fdirh3ZEdalV0+7wHuajlCXKzTze1SRSXpZfh4JVKYSmOPwQkzBdwSZOwZIx6880aN 5pvnkAeoShu7fw5MzU9lkkrrez9Q9m0eZvhgO5DbrajHlb62mz/JO3U52vEyFHrXQiD2 p0+M6WngNCYlR6FyTSpIMNnIMBVtVnpnktCSb7R+cag2qb663s7b+eF+p+KNuyN21X+R 8mAf9FZvpJOyzLXtyTunmVNNIcsVCyIcp/vUXEhYEbjsfQ1Oe3+U/kIRhCL1dX4gcWWd xXQRlU3dLgPF+qr0PZI7zl1ULuAW8ixGvPM5J2/T6CKCA/4AXMuHYE/r0iDhKeNgEUCG QzCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740665010; x=1741269810; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=i4/DXlVSjcMlIzI08dLupqZQFFeRwmRS51ToDVNdHuU=; b=IS1EcszletEs+KfIx5rT10On9hqlWDUkHjfQuF0gc/ncwocxHA9nHg8A6NKPkGzT3m jtjgrmy3jgCImcEiZOrxAC6OBOeOVjlsR0abB2KBU4WR/jB4Iwb1qmwpsyf4NoItvdhm ZuJOetMQERGhEppVbz6XOnej/xXIrCCmInZmscij2zuFtcd7L7nJPT0plKXb/7l20ZbJ +o9y4fVY3WoqjNG2lQ+QR9dkXHsAo68iTUCWE+/FKJSOE9VporsUIJmDC314/7a0hLDo EVFhxpBSwpk1Tw33/+R4M9KCoPNsjnvEUEfgwvv9uWfD+daorLZo9OO0QgzcModJQiwF AjJA== X-Forwarded-Encrypted: i=1; AJvYcCUFwh6BRbp7SPVVZT8qxkV0iE81jW9FvYZitLvwzzTOS35WR76eLm6NdF6s4PCr7ghkwDjGyHyHcOxMS24=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+iDPbe6q5VoWQSZ9B9jC6/RbTppspnRFvJfJcseBWVJEDL0ZQ duOOTaaZ4Gp0UvYzFE6+qrQ3v/e8pq7Cl6zH/MQaLpe+6DiwWtDGPG572BtKPgnBSTXMMxI9vR9 tiF0Lkg== X-Google-Smtp-Source: AGHT+IG0xgR9ZRyvJrlvb/HM8gvFnR13Z1NNItBXO7n+rEkXDOXpyEY7OA8LY4SlIHAbtZuRHfhGeU1RPkhp X-Received: from edbes14.prod.google.com ([2002:a05:6402:380e:b0:5e4:cd36:2ddf]) (user=dvyukov job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:1ece:b0:5e0:3447:f6b7 with SMTP id 4fb4d7f45d1cf-5e4455c2e30mr13256002a12.8.1740665010631; Thu, 27 Feb 2025 06:03:30 -0800 (PST) Date: Thu, 27 Feb 2025 15:03:15 +0100 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.48.1.658.g4767266eb4-goog Message-ID: <9a98ed5d655e9a0d66027779c75c3ba67601e1bf.1740664852.git.dvyukov@google.com> Subject: [PATCH v6 4/4] selftests/rseq: Add test for rseq+pkeys From: Dmitry Vyukov To: mathieu.desnoyers@efficios.com, peterz@infradead.org, boqun.feng@gmail.com, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, aruna.ramakrishna@oracle.com, elver@google.com Cc: Dmitry Vyukov , "Paul E. McKenney" , x86@kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a test that ensures that PKEY-protected struct rseq_cs works and does not lead to process kills. Signed-off-by: Dmitry Vyukov Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Boqun Feng Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Aruna Ramakrishna Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Acked-by: Dave Hansen Fixes: d7822b1e24f2 ("rseq: Introduce restartable sequences system call") --- Changes in v5: - Use static for variables/functions - Use RSEQ_READ/WRITE_ONCE instead of volatile Changes in v4: - Added Fixes tag Changes in v3: - added Acked-by: Dave Hansen - rework the test to work when only pkey 0 is supported for rseq Changes in v2: - change test to install protected rseq_cs instead of rseq --- tools/testing/selftests/rseq/Makefile | 2 +- tools/testing/selftests/rseq/pkey_test.c | 98 ++++++++++++++++++++++++ tools/testing/selftests/rseq/rseq.h | 1 + 3 files changed, 100 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/rseq/Makefile b/tools/testing/selftest= s/rseq/Makefile index 5a3432fceb586..9111d25fea3af 100644 --- a/tools/testing/selftests/rseq/Makefile +++ b/tools/testing/selftests/rseq/Makefile @@ -16,7 +16,7 @@ OVERRIDE_TARGETS =3D 1 =20 TEST_GEN_PROGS =3D basic_test basic_percpu_ops_test basic_percpu_ops_mm_ci= d_test param_test \ param_test_benchmark param_test_compare_twice param_test_mm_cid \ - param_test_mm_cid_benchmark param_test_mm_cid_compare_twice + param_test_mm_cid_benchmark param_test_mm_cid_compare_twice pkey_test =20 TEST_GEN_PROGS_EXTENDED =3D librseq.so =20 diff --git a/tools/testing/selftests/rseq/pkey_test.c b/tools/testing/selft= ests/rseq/pkey_test.c new file mode 100644 index 0000000000000..cc4dd98190942 --- /dev/null +++ b/tools/testing/selftests/rseq/pkey_test.c @@ -0,0 +1,98 @@ +// SPDX-License-Identifier: LGPL-2.1 +/* + * Ensure that rseq works when rseq data is inaccessible due to PKEYs. + */ + +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "rseq.h" +#include "rseq-abi.h" + +static int pkey; +static ucontext_t ucp0, ucp1; + +static void coroutine(void) +{ + int i, orig_pk0, old_pk0, old_pk1, pk0, pk1; + /* + * When we disable access to pkey 0, globals and TLS become + * inaccessible too, so we need to tread carefully. + * Pkey is global so we need to copy it onto the stack. + */ + int pk =3D RSEQ_READ_ONCE(pkey); + struct timespec ts; + + orig_pk0 =3D pkey_get(0); + if (pkey_set(0, PKEY_DISABLE_ACCESS)) + err(1, "pkey_set failed"); + old_pk0 =3D pkey_get(0); + old_pk1 =3D pkey_get(pk); + + /* + * Prevent compiler from initializing it by loading a 16-global. + */ + RSEQ_WRITE_ONCE(ts.tv_sec, 0); + RSEQ_WRITE_ONCE(ts.tv_nsec, 10 * 1000); + /* + * If the kernel misbehaves, context switches in the following loop + * will terminate the process with SIGSEGV. + * Trigger preemption w/o accessing TLS. + * Note that glibc's usleep touches errno always. + */ + for (i =3D 0; i < 10; i++) + syscall(SYS_clock_nanosleep, CLOCK_MONOTONIC, 0, &ts, NULL); + + pk0 =3D pkey_get(0); + pk1 =3D pkey_get(pk); + if (pkey_set(0, orig_pk0)) + err(1, "pkey_set failed"); + + /* + * Ensure that the kernel has restored the previous value of pkeys + * register after changing them. + */ + if (old_pk0 !=3D pk0) + errx(1, "pkey 0 changed %d->%d", old_pk0, pk0); + if (old_pk1 !=3D pk1) + errx(1, "pkey 1 changed %d->%d", old_pk1, pk1); + + swapcontext(&ucp1, &ucp0); + abort(); +} + +int main(int argc, char **argv) +{ + pkey =3D pkey_alloc(0, 0); + if (pkey =3D=3D -1) { + printf("[SKIP]\tKernel does not support PKEYs: %s\n", + strerror(errno)); + return 0; + } + + if (rseq_register_current_thread()) + err(1, "rseq_register_current_thread failed"); + + if (getcontext(&ucp1)) + err(1, "getcontext failed"); + ucp1.uc_stack.ss_size =3D getpagesize() * 4; + ucp1.uc_stack.ss_sp =3D mmap(NULL, ucp1.uc_stack.ss_size, + PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); + if (ucp1.uc_stack.ss_sp =3D=3D MAP_FAILED) + err(1, "mmap failed"); + if (pkey_mprotect(ucp1.uc_stack.ss_sp, ucp1.uc_stack.ss_size, + PROT_READ | PROT_WRITE, pkey)) + err(1, "pkey_mprotect failed"); + makecontext(&ucp1, coroutine, 0); + if (swapcontext(&ucp0, &ucp1)) + err(1, "swapcontext failed"); + return 0; +} diff --git a/tools/testing/selftests/rseq/rseq.h b/tools/testing/selftests/= rseq/rseq.h index ba424ce80a719..65da4a727c550 100644 --- a/tools/testing/selftests/rseq/rseq.h +++ b/tools/testing/selftests/rseq/rseq.h @@ -8,6 +8,7 @@ #ifndef RSEQ_H #define RSEQ_H =20 +#include #include #include #include --=20 2.48.1.658.g4767266eb4-goog