mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
fe3d197f84
This is really the meat of the MPX patch set. If there is one patch to review in the entire series, this is the one. There is a new ABI here and this kernel code also interacts with userspace memory in a relatively unusual manner. (small FAQ below). Long Description: This patch adds two prctl() commands to provide enable or disable the management of bounds tables in kernel, including on-demand kernel allocation (See the patch "on-demand kernel allocation of bounds tables") and cleanup (See the patch "cleanup unused bound tables"). Applications do not strictly need the kernel to manage bounds tables and we expect some applications to use MPX without taking advantage of this kernel support. This means the kernel can not simply infer whether an application needs bounds table management from the MPX registers. The prctl() is an explicit signal from userspace. PR_MPX_ENABLE_MANAGEMENT is meant to be a signal from userspace to require kernel's help in managing bounds tables. PR_MPX_DISABLE_MANAGEMENT is the opposite, meaning that userspace don't want kernel's help any more. With PR_MPX_DISABLE_MANAGEMENT, the kernel won't allocate and free bounds tables even if the CPU supports MPX. PR_MPX_ENABLE_MANAGEMENT will fetch the base address of the bounds directory out of a userspace register (bndcfgu) and then cache it into a new field (->bd_addr) in the 'mm_struct'. PR_MPX_DISABLE_MANAGEMENT will set "bd_addr" to an invalid address. Using this scheme, we can use "bd_addr" to determine whether the management of bounds tables in kernel is enabled. Also, the only way to access that bndcfgu register is via an xsaves, which can be expensive. Caching "bd_addr" like this also helps reduce the cost of those xsaves when doing table cleanup at munmap() time. Unfortunately, we can not apply this optimization to #BR fault time because we need an xsave to get the value of BNDSTATUS. ==== Why does the hardware even have these Bounds Tables? ==== MPX only has 4 hardware registers for storing bounds information. If MPX-enabled code needs more than these 4 registers, it needs to spill them somewhere. It has two special instructions for this which allow the bounds to be moved between the bounds registers and some new "bounds tables". They are similar conceptually to a page fault and will be raised by the MPX hardware during both bounds violations or when the tables are not present. This patch handles those #BR exceptions for not-present tables by carving the space out of the normal processes address space (essentially calling the new mmap() interface indroduced earlier in this patch set.) and then pointing the bounds-directory over to it. The tables *need* to be accessed and controlled by userspace because the instructions for moving bounds in and out of them are extremely frequent. They potentially happen every time a register pointing to memory is dereferenced. Any direct kernel involvement (like a syscall) to access the tables would obviously destroy performance. ==== Why not do this in userspace? ==== This patch is obviously doing this allocation in the kernel. However, MPX does not strictly *require* anything in the kernel. It can theoretically be done completely from userspace. Here are a few ways this *could* be done. I don't think any of them are practical in the real-world, but here they are. Q: Can virtual space simply be reserved for the bounds tables so that we never have to allocate them? A: As noted earlier, these tables are *HUGE*. An X-GB virtual area needs 4*X GB of virtual space, plus 2GB for the bounds directory. If we were to preallocate them for the 128TB of user virtual address space, we would need to reserve 512TB+2GB, which is larger than the entire virtual address space today. This means they can not be reserved ahead of time. Also, a single process's pre-popualated bounds directory consumes 2GB of virtual *AND* physical memory. IOW, it's completely infeasible to prepopulate bounds directories. Q: Can we preallocate bounds table space at the same time memory is allocated which might contain pointers that might eventually need bounds tables? A: This would work if we could hook the site of each and every memory allocation syscall. This can be done for small, constrained applications. But, it isn't practical at a larger scale since a given app has no way of controlling how all the parts of the app might allocate memory (think libraries). The kernel is really the only place to intercept these calls. Q: Could a bounds fault be handed to userspace and the tables allocated there in a signal handler instead of in the kernel? A: (thanks to tglx) mmap() is not on the list of safe async handler functions and even if mmap() would work it still requires locking or nasty tricks to keep track of the allocation state there. Having ruled out all of the userspace-only approaches for managing bounds tables that we could think of, we create them on demand in the kernel. Based-on-patch-by: Qiaowei Ren <qiaowei.ren@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: linux-mm@kvack.org Cc: linux-mips@linux-mips.org Cc: Dave Hansen <dave@sr71.net> Link: http://lkml.kernel.org/r/20141114151829.AD4310DE@viggo.jf.intel.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
189 lines
6.1 KiB
C
189 lines
6.1 KiB
C
#ifndef _LINUX_PRCTL_H
|
|
#define _LINUX_PRCTL_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
/* Values to pass as first argument to prctl() */
|
|
|
|
#define PR_SET_PDEATHSIG 1 /* Second arg is a signal */
|
|
#define PR_GET_PDEATHSIG 2 /* Second arg is a ptr to return the signal */
|
|
|
|
/* Get/set current->mm->dumpable */
|
|
#define PR_GET_DUMPABLE 3
|
|
#define PR_SET_DUMPABLE 4
|
|
|
|
/* Get/set unaligned access control bits (if meaningful) */
|
|
#define PR_GET_UNALIGN 5
|
|
#define PR_SET_UNALIGN 6
|
|
# define PR_UNALIGN_NOPRINT 1 /* silently fix up unaligned user accesses */
|
|
# define PR_UNALIGN_SIGBUS 2 /* generate SIGBUS on unaligned user access */
|
|
|
|
/* Get/set whether or not to drop capabilities on setuid() away from
|
|
* uid 0 (as per security/commoncap.c) */
|
|
#define PR_GET_KEEPCAPS 7
|
|
#define PR_SET_KEEPCAPS 8
|
|
|
|
/* Get/set floating-point emulation control bits (if meaningful) */
|
|
#define PR_GET_FPEMU 9
|
|
#define PR_SET_FPEMU 10
|
|
# define PR_FPEMU_NOPRINT 1 /* silently emulate fp operations accesses */
|
|
# define PR_FPEMU_SIGFPE 2 /* don't emulate fp operations, send SIGFPE instead */
|
|
|
|
/* Get/set floating-point exception mode (if meaningful) */
|
|
#define PR_GET_FPEXC 11
|
|
#define PR_SET_FPEXC 12
|
|
# define PR_FP_EXC_SW_ENABLE 0x80 /* Use FPEXC for FP exception enables */
|
|
# define PR_FP_EXC_DIV 0x010000 /* floating point divide by zero */
|
|
# define PR_FP_EXC_OVF 0x020000 /* floating point overflow */
|
|
# define PR_FP_EXC_UND 0x040000 /* floating point underflow */
|
|
# define PR_FP_EXC_RES 0x080000 /* floating point inexact result */
|
|
# define PR_FP_EXC_INV 0x100000 /* floating point invalid operation */
|
|
# define PR_FP_EXC_DISABLED 0 /* FP exceptions disabled */
|
|
# define PR_FP_EXC_NONRECOV 1 /* async non-recoverable exc. mode */
|
|
# define PR_FP_EXC_ASYNC 2 /* async recoverable exception mode */
|
|
# define PR_FP_EXC_PRECISE 3 /* precise exception mode */
|
|
|
|
/* Get/set whether we use statistical process timing or accurate timestamp
|
|
* based process timing */
|
|
#define PR_GET_TIMING 13
|
|
#define PR_SET_TIMING 14
|
|
# define PR_TIMING_STATISTICAL 0 /* Normal, traditional,
|
|
statistical process timing */
|
|
# define PR_TIMING_TIMESTAMP 1 /* Accurate timestamp based
|
|
process timing */
|
|
|
|
#define PR_SET_NAME 15 /* Set process name */
|
|
#define PR_GET_NAME 16 /* Get process name */
|
|
|
|
/* Get/set process endian */
|
|
#define PR_GET_ENDIAN 19
|
|
#define PR_SET_ENDIAN 20
|
|
# define PR_ENDIAN_BIG 0
|
|
# define PR_ENDIAN_LITTLE 1 /* True little endian mode */
|
|
# define PR_ENDIAN_PPC_LITTLE 2 /* "PowerPC" pseudo little endian */
|
|
|
|
/* Get/set process seccomp mode */
|
|
#define PR_GET_SECCOMP 21
|
|
#define PR_SET_SECCOMP 22
|
|
|
|
/* Get/set the capability bounding set (as per security/commoncap.c) */
|
|
#define PR_CAPBSET_READ 23
|
|
#define PR_CAPBSET_DROP 24
|
|
|
|
/* Get/set the process' ability to use the timestamp counter instruction */
|
|
#define PR_GET_TSC 25
|
|
#define PR_SET_TSC 26
|
|
# define PR_TSC_ENABLE 1 /* allow the use of the timestamp counter */
|
|
# define PR_TSC_SIGSEGV 2 /* throw a SIGSEGV instead of reading the TSC */
|
|
|
|
/* Get/set securebits (as per security/commoncap.c) */
|
|
#define PR_GET_SECUREBITS 27
|
|
#define PR_SET_SECUREBITS 28
|
|
|
|
/*
|
|
* Get/set the timerslack as used by poll/select/nanosleep
|
|
* A value of 0 means "use default"
|
|
*/
|
|
#define PR_SET_TIMERSLACK 29
|
|
#define PR_GET_TIMERSLACK 30
|
|
|
|
#define PR_TASK_PERF_EVENTS_DISABLE 31
|
|
#define PR_TASK_PERF_EVENTS_ENABLE 32
|
|
|
|
/*
|
|
* Set early/late kill mode for hwpoison memory corruption.
|
|
* This influences when the process gets killed on a memory corruption.
|
|
*/
|
|
#define PR_MCE_KILL 33
|
|
# define PR_MCE_KILL_CLEAR 0
|
|
# define PR_MCE_KILL_SET 1
|
|
|
|
# define PR_MCE_KILL_LATE 0
|
|
# define PR_MCE_KILL_EARLY 1
|
|
# define PR_MCE_KILL_DEFAULT 2
|
|
|
|
#define PR_MCE_KILL_GET 34
|
|
|
|
/*
|
|
* Tune up process memory map specifics.
|
|
*/
|
|
#define PR_SET_MM 35
|
|
# define PR_SET_MM_START_CODE 1
|
|
# define PR_SET_MM_END_CODE 2
|
|
# define PR_SET_MM_START_DATA 3
|
|
# define PR_SET_MM_END_DATA 4
|
|
# define PR_SET_MM_START_STACK 5
|
|
# define PR_SET_MM_START_BRK 6
|
|
# define PR_SET_MM_BRK 7
|
|
# define PR_SET_MM_ARG_START 8
|
|
# define PR_SET_MM_ARG_END 9
|
|
# define PR_SET_MM_ENV_START 10
|
|
# define PR_SET_MM_ENV_END 11
|
|
# define PR_SET_MM_AUXV 12
|
|
# define PR_SET_MM_EXE_FILE 13
|
|
# define PR_SET_MM_MAP 14
|
|
# define PR_SET_MM_MAP_SIZE 15
|
|
|
|
/*
|
|
* This structure provides new memory descriptor
|
|
* map which mostly modifies /proc/pid/stat[m]
|
|
* output for a task. This mostly done in a
|
|
* sake of checkpoint/restore functionality.
|
|
*/
|
|
struct prctl_mm_map {
|
|
__u64 start_code; /* code section bounds */
|
|
__u64 end_code;
|
|
__u64 start_data; /* data section bounds */
|
|
__u64 end_data;
|
|
__u64 start_brk; /* heap for brk() syscall */
|
|
__u64 brk;
|
|
__u64 start_stack; /* stack starts at */
|
|
__u64 arg_start; /* command line arguments bounds */
|
|
__u64 arg_end;
|
|
__u64 env_start; /* environment variables bounds */
|
|
__u64 env_end;
|
|
__u64 *auxv; /* auxiliary vector */
|
|
__u32 auxv_size; /* vector size */
|
|
__u32 exe_fd; /* /proc/$pid/exe link file */
|
|
};
|
|
|
|
/*
|
|
* Set specific pid that is allowed to ptrace the current task.
|
|
* A value of 0 mean "no process".
|
|
*/
|
|
#define PR_SET_PTRACER 0x59616d61
|
|
# define PR_SET_PTRACER_ANY ((unsigned long)-1)
|
|
|
|
#define PR_SET_CHILD_SUBREAPER 36
|
|
#define PR_GET_CHILD_SUBREAPER 37
|
|
|
|
/*
|
|
* If no_new_privs is set, then operations that grant new privileges (i.e.
|
|
* execve) will either fail or not grant them. This affects suid/sgid,
|
|
* file capabilities, and LSMs.
|
|
*
|
|
* Operations that merely manipulate or drop existing privileges (setresuid,
|
|
* capset, etc.) will still work. Drop those privileges if you want them gone.
|
|
*
|
|
* Changing LSM security domain is considered a new privilege. So, for example,
|
|
* asking selinux for a specific new context (e.g. with runcon) will result
|
|
* in execve returning -EPERM.
|
|
*
|
|
* See Documentation/prctl/no_new_privs.txt for more details.
|
|
*/
|
|
#define PR_SET_NO_NEW_PRIVS 38
|
|
#define PR_GET_NO_NEW_PRIVS 39
|
|
|
|
#define PR_GET_TID_ADDRESS 40
|
|
|
|
#define PR_SET_THP_DISABLE 41
|
|
#define PR_GET_THP_DISABLE 42
|
|
|
|
/*
|
|
* Tell the kernel to start/stop helping userspace manage bounds tables.
|
|
*/
|
|
#define PR_MPX_ENABLE_MANAGEMENT 43
|
|
#define PR_MPX_DISABLE_MANAGEMENT 44
|
|
|
|
#endif /* _LINUX_PRCTL_H */
|