Address caprevoke consistency check failures #2221
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
markjdb
force-pushed
the
dev-caprevoke-superpage
branch
from
6afefbc to
7665985
Compare
|
The latest push updates riscv as well. |
|
Could anyone with easy VPN access tell me what the riscv failures are? cheribsdtest passes for me in QEMU. |
--cheribsd/build-bench-kernels to include the -NODEBUG kernels locally (somewhat poorly named option thanks to what the kernel configs were called for CHERI-MIPS). |
|
Though I don't know why only the -NODEBUG kernels see that error, the shadowing happens regardless... |
Print the PTE as well, since the debugger isn't able to retrieve it. While here, remove an XXX comment in the arm64 implementation: pmap_pte() returns NULL if the address is not mapped, which is a perfectly ordinary state of affairs.
If any entry in a L3C mapping has ATTR_SC set (i.e., it is cap-dirty), the flag must be propagated to all other entries when demoting.
We don't need to check each PTE: we already verify that the first PTE in the run does not have CDBM set and SC clear, and in the loop we check that the PTEs are identical in virtually all attributes. No functional change intended.
As in pmap_promote_l2(), we should avoid promotion if the mapping allows capability stores but is not yet capability-dirty.
Previously, pmap_caploadgen_update() would return PMAP_CAPLOADGEN_UNABLE, which is overloaded to cover the case where no mapping exists at all. In this case, the MI machinery will look up the page via the VM object and scan it. If the 4KB page contains capabilities, vm_fault() is called upon to scan the page and update the pmap, which breaks the large mapping as a side effect. However, if the page is capability-clean, the large mapping will not be demoted, and during a background scan the subsequent pmap_caploadgen_update() will fail to update the CLG in the L2 or L3C PTE. Thus, the scan will end with some PTEs carrying the wrong CLG. When the GCLG is incremented during a subsequent scan, the kernel may fail to interpose load-cap operations from that mapping, which could potentially allow revoked capabilities to be leaked. Fix the problem by demoting the mapping as soon as it is encountered. This is not optimal (we end up demoting clean superpage mappings), but it fixes the problem of overloading PMAP_CAPLOADGEN_UNABLE and removes an assumption about pmap_enter()'s behaviour (i.e., that it'll demote L2 and L3C mappings), and pmap_caploadgen_update() already reconstructs superpage mappings when possible. L1 largepage mappings are left unhandled for now.
The background scan opportunistically rebuilds L2 superpage mappings. Do the same for L3C mappings. Re-enable creation of read-only L3C mappings in pmap_enter_l3c(). Since that commit appeared, upstream has implemented L3C promotion, and pmap_caploadgen_update() now handles L3C mappings by demoting rather than going through the fault handler.
- Use a sysctl to enable it, rather than requiring it be configured at compile-time - Skip over map entries that definitely do not contain capabilities, including the quarantine bitmap (OBJ_NOCAP)
When forking, the GCLG and LCLGs may be out of sync if a new revocation epoch was opened (bumping the GCLG) but the background scan has not yet started (background scans block fork()). This can arise if a cheri_revoke() is called without either of the CHERI_REVOKE_LAST_PASS and CHERI_REVOKE_ASYNC flags.
vm_cheri_assert_consistent_clg() must be called with the VM map lock held. Also make sure to only call it after the epoch is closed, i.e., we have set the revocation state to CHERI_REVOKE_ST_NONE.
This is required when promoting or demoting superpages, both of which may be done here.
markjdb
force-pushed
the
dev-caprevoke-superpage
branch
from
88254ab to
9e7f370
Compare
Thank you. Indeed, I'm quite surprised that I didn't get a warning when building locally. |
bsdjhb
approved these changes
Oct 16, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The main changes here are the commits which modify pmap_caploadgen_update() to avoid skipping superpages. With these, I can run a desktop session with the assert_consistent_clg checks enabled.
The patches are a bit incomplete:
I have some plans to further improve superpage handling, but present the PR as-is since it should be sufficient to address the panics observed in syzkaller.