From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B03EC6379F for ; Sun, 19 Feb 2023 20:44:01 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 331D9280002; Sun, 19 Feb 2023 15:44:01 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2BAC8280001; Sun, 19 Feb 2023 15:44:01 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 15C49280002; Sun, 19 Feb 2023 15:44:01 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 00BD5280001 for ; Sun, 19 Feb 2023 15:44:00 -0500 (EST) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id D07244066B for ; Sun, 19 Feb 2023 20:44:00 +0000 (UTC) X-FDA: 80485218240.07.1791BF8 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by imf22.hostedemail.com (Postfix) with ESMTP id EA664C0014 for ; Sun, 19 Feb 2023 20:43:58 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lyB+LBtw; spf=pass (imf22.hostedemail.com: domain of keescook@chromium.org designates 209.85.216.46 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1676839439; a=rsa-sha256; cv=none; b=PjCU0RmjkufLzlHntANKmemiBCWKT7HokY6NzaoDsAY5jyzcrl9d2SmtvhmaV3r+33J+wL 3PQcMPJjuzba+scM6cj6TJGFbAHOdlHk04akNloaQzMgLuesA7MOltONELbPag9yhNEher pVoCcRGor1JsAxfX3lSk7yfHpLFGCKY= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lyB+LBtw; spf=pass (imf22.hostedemail.com: domain of keescook@chromium.org designates 209.85.216.46 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1676839439; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=fKpHzd6Tbyr33yS2bO12JJwJSKx89ozdMUK74ZvMWQY=; b=kEyl+KypQQCLGqJBW/4nOlqhjvnGSOR0rqecrPZBfYVtCw/lm4LUw3zjMu6sFv6SPHOHkQ DGVROr9r9CgsdF2NtblvnzzuEN315nAEDX7zqXMpGSwXRHLJsq9uLcgsMRMoImrR+qJvjf x/HbrL98FwGGRof1mXy2j1ZsQICbKQ0= Received: by mail-pj1-f46.google.com with SMTP id o17-20020a17090ab89100b002349a303ca5so1176424pjr.4 for ; Sun, 19 Feb 2023 12:43:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=in-reply-to:content-disposition:mime-version:references:subject:cc :to:from:date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=fKpHzd6Tbyr33yS2bO12JJwJSKx89ozdMUK74ZvMWQY=; b=lyB+LBtwPWQHHdKAlNRydMkf2elDFztWlBg6fmvpqXPnZh65qZQww0NMO+8xbYqZB7 U9nfNbftnOH17cvV3hB7fmXC1rwq6ayNMO0P2Oq/eSedQ5vAmiJMfXKM02tjgGZ1jGsy tWqFbd/xVeuocI///kXq5zK9U+wa6hiXFpVGk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:subject:cc :to:from:date:message-id:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=fKpHzd6Tbyr33yS2bO12JJwJSKx89ozdMUK74ZvMWQY=; b=hib0OpADfm+FHv2ARnZTT6eq22b6dcwClLYsiZZ7UVbPsty6F01MPLN8TQV09JwROb Ke0hIyvzsjz1AKDytSY6KS8P4JyNcgvaa/nOZVgE0SUHDbACl2G+84wEi2XGTPxx3jEo 9IqiDPWYybZVvKfrf7oGqkKupPHVWPvrC9EybQ3Dq0JuKzOzAOqAsxSVFW20HwWh7Be0 SHKPkLHshH1MuVDnHSz70KcKf++BEVzrZB++guS7aAOUw692i4vUsSGqEHjRJ3+ODsnJ P8jhTWDMD7GUJH2J7Xj4EGhnnTcF0bqzbJPf+Vfw2UAN338y5QeBRFGHYGOuLF8iJSVO TxoQ== X-Gm-Message-State: AO0yUKXhca+NZ42jiRfsvSw/0jfIPJ7ERFo5WPLYL1tlAl/CGK/RBAQN retQBadfhttPJ8qa8AGPIR8AKg== X-Google-Smtp-Source: AK7set+kcWCM2o49kDDpOvmw8Xuw/R9fB8lqTkZ5n1j58QZPck4H7MjP6asqe7McnmMIWyDzXFGOcw== X-Received: by 2002:a17:903:2305:b0:19a:a4fc:7f80 with SMTP id d5-20020a170903230500b0019aa4fc7f80mr1247862plh.26.1676839437793; Sun, 19 Feb 2023 12:43:57 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id k3-20020a170902e90300b0019a837be977sm6312881pld.271.2023.02.19.12.43.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Feb 2023 12:43:57 -0800 (PST) Message-ID: <63f28a0d.170a0220.21bf7.b03c@mx.google.com> X-Google-Original-Message-ID: <202302191243.@keescook> Date: Sun, 19 Feb 2023 12:43:56 -0800 From: Kees Cook To: Rick Edgecombe Cc: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Subject: Re: [PATCH v6 25/41] x86/mm: Introduce MAP_ABOVE4G References: <20230218211433.26859-1-rick.p.edgecombe@intel.com> <20230218211433.26859-26-rick.p.edgecombe@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230218211433.26859-26-rick.p.edgecombe@intel.com> X-Rspam-User: X-Rspamd-Queue-Id: EA664C0014 X-Rspamd-Server: rspam01 X-Stat-Signature: ap41zcsgsquq96sbbpg8g4wznf84c1n7 X-HE-Tag: 1676839438-602784 X-HE-Meta: U2FsdGVkX1+B3qXTo5SU7piQYzTY1/9kF73JFnhUjx2vMx8SHDh7BOxzCbyxli3Kg8zCth3VRdtw6cMMc19mVUyDznUPGaZOh4S2MkuuBTxbrzLixY6CuAG8wTuR9dJh0Aj2xkmDZeOgTTX812xfFs38nUBlIpu04WKvx5gxGR9pSGpmKR6ZKbRuqZCbkfdSIvWeph4ebkhiWGSORESHagjCcIDUUvdmy83fUSjzBwlpUrqJS+wejjeSZsClTXvLOOn9o/+b8qNNrIVFdRWM8nkiXwzF4b8AFKRcmHJyk8Nlo12A8skz9X7W0Se2hbRjr84CwESrbMlH/99e4FdFGIrz7GEX62nN/dg7jz4TNwxXI7IBQTwmxdizzoIDGmwsGNYBz7pmiEJv3EthTrdfVeMDHgEL6WU+CMEi+UbeP5DpSdUidQaWDu6XHzwBuIHN6nAXr0h3afYn5Kqe52WzU8eyKVzd1yTip41kslmetecZh+oXj5IJFC6xSRVYNyN078WFaxQfn1ja+SqQzGDsk2NReo+fLfMll/bAo2gn3E1M7QcWq4JdmdLsttcViAdn3rvaMT6KojybMRCPoEUzxQJwxgPzNKMk2E4un4UdvnJujL0iPQXQbylCfrnqTYBiug2zsVG0EhdHasu5Ky99EKiALgVmiEppT2bkv9ZQqBcOskNO/8e0Xz0LM/POAjMAAkpZ6mpdea3C/rBl2skSl9moWtoevSmM2bL0HEUH/S1jrdjZwxwA+JewnF2hEu8s38YlfNmkX+1cXlTd9wA8lOy6GCCpMTSczlOcHqMJPlYwOVrVe7ArO0aSP5yWFVs57ViUDvBcACeSqhpfI+0paiXI01kOdLF+74+WGPHUTYvblqH94GMlJkdeqKmP15BCWaRSgT0iHCuS6Lo4byLQwUW25lkj2zFj8RkMfUFgU9GxADhNSIvwF5rRsYA1HBWHflV5oYJtF6PjhSJHW67 CS8KpzAn KiL7LqY3iZB5k1a4hiYW74DykHO5DrzsnUl9XaZGHEzMZJRciUA9SOImotiY4OOwd10dkK736wAwJ32esBMKZvGqQTScoPDp3twzgPSWWOcVQlwINx1f9QOxfBvXvKdfXEEWdy5iZl7dUO3iLJn9zvYueEu0q4j6B3GtIFlEqPJx2fk+w+qnfYYFFUOEJ80ddbSVGRrUYQyRnfaNN5wjTCaWKiJgS7pZzOdKoaDUh42g11vmET49N/+3Rust2S88XIYEAvMO0pUYYhFOhhJ6CJ0vWqV2d4qwtaTRd3djhm3q9jSxY+RqE+98i+9fG96FoheAiYmyxiwlzYoGHzix/aJsrldV0N9u8aGt9WB+pBNZrmqUueZ3ZF2Qw3y1ffoXUU5+XHAxkSmD4vC1H5SFoEGYwOASZshb3VJN0xmYirKTzjb/ZlX+QgrjvFSxvRyAnyod62VFlh7RfpzGGzH32MpAnUH3TIolwzBm8yakIM499BwMzdwRd8kIsTOYebGuV7QAp X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Feb 18, 2023 at 01:14:17PM -0800, Rick Edgecombe wrote: > The x86 Control-flow Enforcement Technology (CET) feature includes a new > type of memory called shadow stack. This shadow stack memory has some > unusual properties, which require some core mm changes to function > properly. > > One of the properties is that the shadow stack pointer (SSP), which is a > CPU register that points to the shadow stack like the stack pointer points > to the stack, can't be pointing outside of the 32 bit address space when > the CPU is executing in 32 bit mode. It is desirable to prevent executing > in 32 bit mode when shadow stack is enabled because the kernel can't easily > support 32 bit signals. > > On x86 it is possible to transition to 32 bit mode without any special > interaction with the kernel, by doing a "far call" to a 32 bit segment. > So the shadow stack implementation can use this address space behavior > as a feature, by enforcing that shadow stack memory is always crated > outside of the 32 bit address space. This way userspace will trigger a > general protection fault which will in turn trigger a segfault if it > tries to transition to 32 bit mode with shadow stack enabled. > > This provides a clean error generating border for the user if they try > attempt to do 32 bit mode shadow stack, rather than leave the kernel in a > half working state for userspace to be surprised by. > > So to allow future shadow stack enabling patches to map shadow stacks > out of the 32 bit address space, introduce MAP_ABOVE4G. The behavior > is pretty much like MAP_32BIT, except that it has the opposite address > range. The are a few differences though. > > If both MAP_32BIT and MAP_ABOVE4G are provided, the kernel will use the > MAP_ABOVE4G behavior. Like MAP_32BIT, MAP_ABOVE4G is ignored in a 32 bit > syscall. Should the interface refuse to accept both set instead? Reviewed-by: Kees Cook -- Kees Cook