[GIT PULL] Protection Keys (pkeys) support

From: Ingo Molnar
Date: Thu Mar 17 2016 - 04:44:39 EST

Next message: Heiko Carstens: "Re: [PATCH] s390: disable postinit-readonly for now"
Previous message: yassinjaffer: "[PATCH] clk: sunxi: Add CSI (camera's Sensors Interface) module clock driver for sun[457]i"
Next in thread: Linus Torvalds: "Re: [GIT PULL] Protection Keys (pkeys) support"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Linus,

Please pull the latest mm-pkeys-for-linus git tree from:

git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git mm-pkeys-for-linus

# HEAD: 0d47638f80a02b15869f1fe1fc09e5bf996750fd x86/mm/pkeys: Fix mismerge of protection keys CPUID bits

This tree adds support for a new memory protection hardware feature that is
available in upcoming Intel CPUs: 'protection keys' (pkeys).

There's a background article at LWN.net:

https://lwn.net/Articles/643797/

The gist is that protection keys allow the encoding of user-controllable
permission masks in the pte. So instead of having a fixed protection mask in the
pte (which needs a system call to change and works on a per page basis), the user
can map a (handful of) protection mask variants and can change the masks runtime
relatively cheaply, without having to change every single page in the affected
virtual memory range.

This allows the dynamic switching of the protection bits of large amounts of
virtual memory, via user-space instructions. It also allows more precise control
of MMU permission bits: for example the executable bit is separate from the read
bit (see more about that below).

This tree adds the MM infrastructure and low level x86 glue needed for that, plus
it adds a high level API to make use of protection keys - if a user-space
application calls:

mmap(..., PROT_EXEC);
or
mprotect(ptr, sz, PROT_EXEC);

(note PROT_EXEC-only, without PROT_READ/WRITE), the kernel will notice this
special case, and will set a special protection key on this memory range. It also
sets the appropriate bits in the Protection Keys User Rights (PKRU) register so
that the memory becomes unreadable and unwritable.

So using protection keys the kernel is able to implement 'true' PROT_EXEC on x86
CPUs: without protection keys PROT_EXEC implies PROT_READ as well. Unreadable
executable mappings have security advantages: they cannot be read via information
leaks to figure out ASLR details, nor can they be scanned for ROP gadgets - and
they cannot be used by exploits for data purposes either.

We know about no user-space code that relies on pure PROT_EXEC mappings today, but
binary loaders could start making use of this new feature to map binaries and
libraries in a more secure fashion.

There is other pending pkeys work that offers more high level system call APIs to
manage protection keys - but those are not part of this pull request.

Right now there's a Kconfig that controls this feature
(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) that is default enabled (like most x86
CPU feature enablement code that has no runtime overhead), but it's not
user-configurable at the moment. If there's any serious problem with this then we
can make it configurable and/or flip the default.

Thanks,

Ingo

---{ shortlog and diffstat generated manually }--------------->

Dave Hansen (38):
mm/gup: Introduce get_user_pages_remote()
mm/gup: Overload get_user_pages() functions
mm/gup: Switch all callers of get_user_pages() to not pass tsk/mm
x86/fpu: Add placeholder for 'Processor Trace' XSAVE state
x86/mm/pkeys: Add Kconfig option
x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions
x86/cpu, x86/mm/pkeys: Define new CR4 bit
x86/fpu, x86/mm/pkeys: Add PKRU xsave fields and data structures
x86/mm/pkeys: Add PTE bits for storing protection key
x86/mm/pkeys: Add new 'PF_PK' page fault error code bit
mm/core, x86/mm/pkeys: Store protection bits in high VMA flags
x86/mm/pkeys: Add arch-specific VMA protection bits
x86/mm/pkeys: Pass VMA down in to fault signal generation code
signals, ia64, mips: Update arch-specific siginfos with pkeys field
signals, pkeys: Notify userspace about protection key faults
x86/mm/pkeys: Fill in pkey field in siginfo
x86/mm/pkeys: Add functions to fetch PKRU
mm/gup: Factor out VMA fault permission checking
x86/mm/gup: Simplify get_user_pages() PTE bit handling
mm/gup, x86/mm/pkeys: Check VMAs and PTEs for protection keys
um, pkeys: Add UML arch_*_access_permitted() methods
mm/core: Do not enforce PKEY permissions on remote mm access
x86/mm/pkeys: Optimize fault handling in access_error()
mm/core, x86/mm/pkeys: Differentiate instruction fetches
x86/mm/pkeys: Dump PKRU with other kernel registers
x86/mm/pkeys: Dump pkey from VMA in /proc/pid/smaps
x86/mm/pkeys: Add Kconfig prompt to existing config option
x86/mm/pkeys: Actually enable Memory Protection Keys in the CPU
mm/core, arch, powerpc: Pass a protection key in to calc_vm_flag_bits()
mm/core, x86/mm/pkeys: Add arch_validate_pkey()
x86/mm: Factor out LDT init from context init
x86/fpu: Allow setting of XSAVE state
x86/mm/pkeys: Allow kernel to modify user pkey rights register
x86/mm/pkeys: Create an x86 arch_calc_vm_prot_bits() for VMA flags
mm/core, x86/mm/pkeys: Add execute-only protection keys support
x86/mm/pkeys: Fix access_error() denial of writes to write-only VMA
mm/pkeys: Fix siginfo ABI breakage caused by new u64 field
x86/mm/pkeys: Fix mismerge of protection keys CPUID bits

Ingo Molnar (1):
Merge branches 'x86/fpu', 'x86/mm' and 'x86/asm' into x86/pkeys

Documentation/kernel-parameters.txt | 3 +++
arch/cris/arch-v32/drivers/cryptocop.c | 8 ++----
arch/ia64/include/uapi/asm/siginfo.h | 13 +++++++---
arch/ia64/kernel/err_inject.c | 3 +--
arch/mips/include/uapi/asm/siginfo.h | 13 +++++++---
arch/mips/mm/gup.c | 3 +--
arch/powerpc/include/asm/mman.h | 5 ++--
arch/powerpc/include/asm/mmu_context.h | 12 +++++++++
arch/s390/include/asm/mmu_context.h | 12 +++++++++
arch/s390/mm/gup.c | 4 +--
arch/sh/mm/gup.c | 2 +-
arch/sparc/mm/gup.c | 2 +-
arch/um/include/asm/mmu_context.h | 14 ++++++++++
arch/unicore32/include/asm/mmu_context.h | 12 +++++++++
arch/x86/Kconfig | 16 ++++++++++++
arch/x86/include/asm/cpufeature.h | 55 +++++++++++++++++++++++++--------------
arch/x86/include/asm/cpufeatures.h | 6 ++++-
arch/x86/include/asm/disabled-features.h | 15 +++++++++++
arch/x86/include/asm/fpu/internal.h | 2 ++
arch/x86/include/asm/fpu/types.h | 12 +++++++++
arch/x86/include/asm/fpu/xstate.h | 3 ++-
arch/x86/include/asm/mmu_context.h | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++----
arch/x86/include/asm/pgtable.h | 38 +++++++++++++++++++++++++++
arch/x86/include/asm/pgtable_types.h | 39 ++++++++++++++++++++++++----
arch/x86/include/asm/pkeys.h | 34 ++++++++++++++++++++++++
arch/x86/include/asm/required-features.h | 7 +++++
arch/x86/include/asm/special_insns.h | 22 ++++++++++++++++
arch/x86/include/uapi/asm/mman.h | 22 ++++++++++++++++
arch/x86/include/uapi/asm/processor-flags.h | 2 ++
arch/x86/kernel/cpu/common.c | 44 +++++++++++++++++++++++++++++++
arch/x86/kernel/fpu/core.c | 63 ++++++++++++++++++++++++++++++++++++++++++++
arch/x86/kernel/fpu/xstate.c | 185 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---
arch/x86/kernel/ldt.c | 4 +--
arch/x86/kernel/process_64.c | 2 ++
arch/x86/kernel/setup.c | 9 +++++++
arch/x86/mm/Makefile | 2 ++
arch/x86/mm/fault.c | 150 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------
arch/x86/mm/gup.c | 45 ++++++++++++++++++++------------
arch/x86/mm/mpx.c | 4 +--
arch/x86/mm/pkeys.c | 101 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
drivers/char/agp/frontend.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +--
drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++---
drivers/gpu/drm/i915/i915_gem_userptr.c | 10 +++----
drivers/gpu/drm/radeon/radeon_ttm.c | 3 +--
drivers/gpu/drm/via/via_dmablit.c | 3 +--
drivers/infiniband/core/umem.c | 2 +-
drivers/infiniband/core/umem_odp.c | 8 +++---
drivers/infiniband/hw/mthca/mthca_memfree.c | 3 +--
drivers/infiniband/hw/qib/qib_user_pages.c | 3 +--
drivers/infiniband/hw/usnic/usnic_uiom.c | 2 +-
drivers/iommu/amd_iommu_v2.c | 1 +
drivers/media/pci/ivtv/ivtv-udma.c | 4 +--
drivers/media/pci/ivtv/ivtv-yuv.c | 10 +++----
drivers/media/v4l2-core/videobuf-dma-sg.c | 3 +--
drivers/misc/mic/scif/scif_rma.c | 2 --
drivers/misc/sgi-gru/grufault.c | 3 +--
drivers/scsi/st.c | 2 --
drivers/staging/android/ashmem.c | 4 +--
drivers/video/fbdev/pvr2fb.c | 4 +--
drivers/virt/fsl_hypervisor.c | 5 ++--
fs/exec.c | 8 ++++--
fs/proc/task_mmu.c | 14 ++++++++++
include/asm-generic/mm_hooks.h | 12 +++++++++
include/linux/mm.h | 99 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------
include/linux/mman.h | 6 ++---
include/linux/pkeys.h | 33 ++++++++++++++++++++++++
include/uapi/asm-generic/siginfo.h | 17 ++++++++----
kernel/events/uprobes.c | 10 +++++--
kernel/signal.c | 4 +++
mm/Kconfig | 5 ++++
mm/frame_vector.c | 2 +-
mm/gup.c | 127 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------------
mm/ksm.c | 12 ++++++---
mm/memory.c | 8 +++++-
mm/mempolicy.c | 6 ++---
mm/mmap.c | 10 ++++++-
mm/mprotect.c | 8 +++---
mm/nommu.c | 66 +++++++++++++++++++++++++++++++++--------------
mm/process_vm_access.c | 11 +++++---
mm/util.c | 4 +--
net/ceph/pagevec.c | 2 +-
security/tomoyo/domain.c | 9 ++++++-
virt/kvm/async_pf.c | 8 +++++-
virt/kvm/kvm_main.c | 10 +++----
85 files changed, 1406 insertions(+), 241 deletions(-)
create mode 100644 arch/x86/include/asm/pkeys.h
create mode 100644 arch/x86/mm/pkeys.c
create mode 100644 include/linux/pkeys.h

Next message: Heiko Carstens: "Re: [PATCH] s390: disable postinit-readonly for now"
Previous message: yassinjaffer: "[PATCH] clk: sunxi: Add CSI (camera's Sensors Interface) module clock driver for sun[457]i"
Next in thread: Linus Torvalds: "Re: [GIT PULL] Protection Keys (pkeys) support"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]