Re: [PATCH 00/12] [RFC] x86: Memory Protection Keys

[Dr. David Alan Gilbert]

* Vlastimil Babka (vbabka@xxxxxxx) wrote:
> On 05/07/2015 08:09 PM, Dave Hansen wrote:
> >On 05/07/2015 10:57 AM, Ingo Molnar wrote:
> >>>>There are two new instructions (RDPKRU/WRPKRU) for reading and
> >>>>writing to the new register.  The feature is only available in
> >>>>64-bit mode, even though there is theoretically space in the PAE
> >>>>PTEs.  These permissions are enforced on data access only and have
> >>>>no effect on instruction fetches.
> >>So I'm wondering what the primary usecases are for this feature?
> >>Could you outline applications/workloads/libraries that would
> >>benefit from this?
> >
> >There are lots of things that folks would _like_ to mprotect(), but end
> >up not being feasible because of the overhead of going and mucking with
> >thousands of PTEs and shooting down remote TLBs every time you want to
> >change protections.
> >
> >Data structures like logs or journals that are only written to in very
> >limited code paths, but that you want to protect from "stray" writes.
> >
> >Maybe even a database where a query operation will never need to write
> >to memory, but an insert would.  You could keep the data R/O during the
> >entire operation except when an insert is actually in progress.  It
> >narrows the window where data might be corrupted.  This becomes even
> >more valuable if a stray write to memory is guaranteed to hit storage...
> >like with persistent memory.
> >
> >Someone mentioned to me that valgrind does lots of mprotect()s and might
> >benefit from this.
> >
> >We could keep heap metadata as R/O and only make it R/W inside of
> >malloc() itself to catch corruption more quickly.
> 
> But that metadata is typically within the same page as the data
> itself (for small objects at least), no?
> 
> >More crazy ideas welcome. :)
> 
> Since you asked :) I wonder if the usefulness could be extended by
> making it possible for a thread to revoke its access to WRPKRU (it's
> not privileged, right?). Then I could imagine some extra security
> for sandbox/bytecode/JIT code so it doesn't interfere with the
> runtime. But since it doesn't block instruction fetches, then maybe
> it wouldn't make much difference...

Even without revoking a threads ability to change it, it would still
be useful just to restrict what data your JITd code can get to; if a JIT
generated the code it would know it's not generating any code that change
the keys and so as long as it bounds the code that's accessible, it could
use this to stop the generated code getting to JIT data structures.
I can see it also being useful for things like NaCl that supposedly bound
what the code can contain.

Dave

> >--
> >To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> >the body of a message to majordomo@xxxxxxxxxxxxxxx
> >More majordomo info at  http://vger.kernel.org/majordomo-info.html
> >Please read the FAQ at  http://www.tux.org/lkml/
> >
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
-- 
 -----Open up your eyes, open up your mind, open up your code -------   
/ Dr. David Alan Gilbert    |       Running GNU/Linux       | Happy  \ 
\ gro.gilbert @ treblig.org |                               | In Hex /
 \ _________________________|_____ http://www.treblig.org   |_______/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/