From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA922C433FE for ; Tue, 15 Nov 2022 19:38:42 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 77F9E6B0071; Tue, 15 Nov 2022 14:38:42 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 757A56B0072; Tue, 15 Nov 2022 14:38:42 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 645F18E0001; Tue, 15 Nov 2022 14:38:42 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 535036B0071 for ; Tue, 15 Nov 2022 14:38:42 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 2B91AC01BF for ; Tue, 15 Nov 2022 19:38:42 +0000 (UTC) X-FDA: 80136688884.05.84C46F8 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf29.hostedemail.com (Postfix) with ESMTP id 64C3C120013 for ; Tue, 15 Nov 2022 19:38:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=QQkajeEpoN84cJxFGz64eHjqDfcA7nBybGgFO0D93eo=; b=EytyFFGBO97UFkfGRJWHbOAzTY B5D16bY6oC9pjvUTguztKlVv7VolOys1CugodVjDbj6id1r4v9Ph9I9ICK1UXbKx/TYCjlqtWD78K bbL9certGUcllrnzt90Qe5wBuaNxqar0ZRxRGtQUz4u8rhr8NK8KkUCu9SauwlpzKD5iZZrWC3ADk qIEr5jToB2/IhLsw7fOuz4BxHpGeE4jV78P4NrC5kVg4b+JT0zSr7R66PxdXP2BVvI07Dvx59uLXD 1fcFLFjCmZvkhc7U7o/h/UpZ7pyiR58BwmX3T6aWwt1wFeqzSeLsATngHULAXetyjuODnIxTkH6/l 4QfxOGfw==; Received: from j130084.upc-j.chello.nl ([24.132.130.84] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1ov1lT-00GYBk-0h; Tue, 15 Nov 2022 19:38:35 +0000 Received: from hirez.programming.kicks-ass.net (hirez.programming.kicks-ass.net [192.168.1.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by noisy.programming.kicks-ass.net (Postfix) with ESMTPS id 8978D3010ED; Tue, 15 Nov 2022 14:03:57 +0100 (CET) Received: by hirez.programming.kicks-ass.net (Postfix, from userid 1000) id 6980020162835; Tue, 15 Nov 2022 14:03:57 +0100 (CET) Date: Tue, 15 Nov 2022 14:03:57 +0100 From: Peter Zijlstra To: Rick Edgecombe Cc: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Randy Dunlap , "Ravi V . Shankar" , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Mark Rutland , Will Deacon , broonie@kernel.org Subject: Re: [PATCH v3 24/37] x86: Introduce userspace API for CET enabling Message-ID: References: <20221104223604.29615-1-rick.p.edgecombe@intel.com> <20221104223604.29615-25-rick.p.edgecombe@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1668541121; a=rsa-sha256; cv=none; b=rwZOPYypK98L1rsPww90ZiPRxcsQU5GSpta8/NssHdnWek3mzYUv2d88xOtOvWPWrn1330 Ppyvu2DjQ5yGAqsuFm0scc+3qa5d7T3jSDZN+4/3od4ufR4N9cxsbp5vnRj4TBqu2QZMSd DwISuwvcbfP70UZ+yCilyZdEsJ7FpGg= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=EytyFFGB; dmarc=none; spf=none (imf29.hostedemail.com: domain of peterz@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=peterz@infradead.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1668541121; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=QQkajeEpoN84cJxFGz64eHjqDfcA7nBybGgFO0D93eo=; b=ncD43N3rUVeMeuGbbIPWz4rcbMR2yFsyZn19Rm438E4o5eCNH7h5OwUIcIHRLG4YUmLFj7 AGriHXF8Tzkq0jvlU7FhFrkoIaL+jKPbA6syN7NwjmQCnyLdbi7RMWNTOIy/j4COnTDSW8 1FjJGFmZYgyeswS0yY/AdT4ZsACMvE4= X-Rspamd-Queue-Id: 64C3C120013 Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=EytyFFGB; dmarc=none; spf=none (imf29.hostedemail.com: domain of peterz@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=peterz@infradead.org X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: dxaxy96gqiqeisdjcekbff76w9ufxazg X-HE-Tag: 1668541121-99979 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 15, 2022 at 01:26:23PM +0100, Peter Zijlstra wrote: > On Fri, Nov 04, 2022 at 03:35:51PM -0700, Rick Edgecombe wrote: > > From: "Kirill A. Shutemov" > > > > Add three new arch_prctl() handles: > > > > - ARCH_CET_ENABLE/DISABLE enables or disables the specified > > feature. Returns 0 on success or an error. > > > > - ARCH_CET_LOCK prevents future disabling or enabling of the > > specified feature. Returns 0 on success or an error > > > > The features are handled per-thread and inherited over fork(2)/clone(2), > > but reset on exec(). > > > > This is preparation patch. It does not implement any features. > > Urgh... so much for sharing with other architectures I suppose :/ > > The ARM64 BTI thing is very similar to IBT (except I think their > approach to the legacy bitmap is much saner). > > Given that IBT isn't supported and needs the whole legacy bitmap mess, > do we really want to call this CET ? Why not just make a Shadow Stack > API and tackle IBT independently. On that; ARM64 exposes PROT_BTI (to be used by mprotect()) and have an ELF_ARM64_BTI note for the loader to bootstrap things. We could co-opt that same interface and instead of flipping actual PTE bits, have this thing manage the legacy bitmap -- basically have the legacy bitmap function as an external PTE bit array (in inverse). Basically, have every page mapped PROT_EXEC set the bit in the legacy bitmap while every page mapped PROT_EXEC|PROT_BTI will have the legacy bitmap bit to 0. And as long as there is a single 0 in the bitmap, the feature is enabled. (obviously we can delay allocating the bitmap until the first PROT_EXEC mapping that lacks PROT_BTI)