Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address caprevoke consistency check failures #2221

Open
wants to merge 9 commits into
base: dev
Choose a base branch
from
Open

Address caprevoke consistency check failures #2221

wants to merge 9 commits into from
+75 −56

Commits on Sep 13, 2024

  1. caprevoke: Make assertions in pmap_assert_consistent_clg() more useful 

    Print the PTE as well, since the debugger isn't able to retrieve it.

While here, remove an XXX comment in the arm64 implementation:
pmap_pte() returns NULL if the address is not mapped, which is a
perfectly ordinary state of affairs.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    bdccaec View commit details
    Browse the repository at this point in the history

  2. arm64: Preserve ATTR_SC when demoting l3c mappings 

    If any entry in a L3C mapping has ATTR_SC set (i.e., it is cap-dirty),
the flag must be propagated to all other entries when demoting.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    c2793d5 View commit details
    Browse the repository at this point in the history

  3. arm64: Remove an unneeded check in pmap_promote_l2() 

    We don't need to check each PTE: we already verify that the first PTE in
the run does not have CDBM set and SC clear, and in the loop we check
that the PTEs are identical in virtually all attributes.

No functional change intended.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    d6090d3 View commit details
    Browse the repository at this point in the history

  4. arm64: Avoid promoting L3C runs CDBM-set SC-clear PTEs 

    As in pmap_promote_l2(), we should avoid promotion if the mapping allows
capability stores but is not yet capability-dirty.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    1aa35d7 View commit details
    Browse the repository at this point in the history

  5. arm64: Demote L2 and L3C mappings in pmap_caploadgen_update() 

    Previously, pmap_caploadgen_update() would return PMAP_CAPLOADGEN_UNABLE,
which is overloaded to cover the case where no mapping exists at all.  In this
case, the MI machinery will look up the page via the VM object and scan it.  If
the 4KB page contains capabilities, vm_fault() is called upon to scan the page
and update the pmap, which breaks the large mapping as a side effect.

However, if the page is capability-clean, the large mapping will not be demoted,
and during a background scan the subsequent pmap_caploadgen_update() will fail
to update the CLG in the L2 or L3C PTE.  Thus, the scan will end with some PTEs
carrying the wrong CLG.  When the GCLG is incremented during a subsequent scan,
the kernel may fail to interpose load-cap operations from that mapping, which
could potentially allow revoked capabilities to be leaked.

Fix the problem by demoting the mapping as soon as it is encountered.  This is
not optimal (we end up demoting clean superpage mappings), but it fixes the
problem of overloading PMAP_CAPLOADGEN_UNABLE and removes an assumption about
pmap_enter()'s behaviour (i.e., that it'll demote L2 and L3C mappings), and
pmap_caploadgen_update() already reconstructs superpage mappings when possible.

L1 largepage mappings are left unhandled for now.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    76a160e View commit details
    Browse the repository at this point in the history

  6. arm64: Rebuild ATTR_CONTIGUOUS mappings in pmap_caploadgen_update() 

    The background scan opportunistically rebuilds L2 superpage mappings.
Do the same for L3C mappings.

Re-enable creation of read-only L3C mappings in pmap_enter_l3c().  Since
that commit appeared, upstream has implemented L3C promotion, and
pmap_caploadgen_update() now handles L3C mappings by demoting rather
than going through the fault handler.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    61c10d0 View commit details
    Browse the repository at this point in the history

  7. caprevoke: Improve the vm_cheri_assert_consistent_clg() check 

    - Use a sysctl to enable it, rather than requiring it be configured at
  compile-time
- Skip over map entries that definitely do not contain capabilities, including
  the quarantine bitmap (OBJ_NOCAP)
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    6bdce98 View commit details
    Browse the repository at this point in the history

  8. caprevoke: Avoid validating CLGs if revocation is in progress 

    When forking, the GCLG and LCLGs may be out of sync if a new revocation epoch
was opened (bumping the GCLG) but the background scan has not yet started
(background scans block fork()).  This can arise if a cheri_revoke() is called
without either of the CHERI_REVOKE_LAST_PASS and CHERI_REVOKE_ASYNC flags.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    903f7a6 View commit details
    Browse the repository at this point in the history

  9. caprevoke: Fix a buggy vm_cheri_assert_consistent_clg() call 

    vm_cheri_assert_consistent_clg() must be called with the VM map lock
held.  Also make sure to only call it after the epoch is closed, i.e.,
we have set the revocation state to CHERI_REVOKE_ST_NONE.
    @markjdb
    markjdb committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    6afefbc View commit details
    Browse the repository at this point in the history