From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E793C61DA4 for ; Mon, 6 Mar 2023 18:09:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8B1FB6B0072; Mon, 6 Mar 2023 13:09:47 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 862A26B0073; Mon, 6 Mar 2023 13:09:47 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 751866B0074; Mon, 6 Mar 2023 13:09:47 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 6536A6B0072 for ; Mon, 6 Mar 2023 13:09:47 -0500 (EST) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 253C4140BCB for ; Mon, 6 Mar 2023 18:09:47 +0000 (UTC) X-FDA: 80539261614.02.A232EB3 Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by imf21.hostedemail.com (Postfix) with ESMTP id D31061C0010 for ; Mon, 6 Mar 2023 18:09:38 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=alien8.de header.s=dkim header.b=aVFGQa3S; spf=temperror (imf21.hostedemail.com: error in processing during lookup of bp@alien8.de: DNS error) smtp.mailfrom=bp@alien8.de; dmarc=pass (policy=none) header.from=alien8.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1678126182; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=bf81Sg91gg34dWGuLdg6vAArqivsg00/7Notto21iJk=; b=stLlYZFpE+SqeLhKLi/wx3XIqH6LaN9T6vtPgRAIH27CobVs30VzE0tyV0H8wX9E9Fszpm Nh6Q71w99Y7hmIOp9FVg+ACTxksPhMIydC6/UdjJsgynSXISQyeOsigTH7VmcLad0lQ3hy wLf+R04Ip2TJEXQCKpi735Cj4E+ZjQ8= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=alien8.de header.s=dkim header.b=aVFGQa3S; spf=temperror (imf21.hostedemail.com: error in processing during lookup of bp@alien8.de: DNS error) smtp.mailfrom=bp@alien8.de; dmarc=pass (policy=none) header.from=alien8.de ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1678126182; a=rsa-sha256; cv=none; b=6lWiYFsD1OKde2CgXUGiupKRUUQmE/qir/vr1X/QGrIxw9ka+f4YL5z+otbxmhgrvbFyNV Rj9pAAhhO/sD1R2g2EVJxmSV7iSgqiuW6t3Tm9FHiWUKlzZOoxxCdxFhlvbHG8o5zkdIJI /Df4vac0YLYx3gojh+QuRjah8//5cv8= Received: from zn.tnic (p5de8e9fe.dip0.t-ipconnect.de [93.232.233.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id 239611EC0662; Mon, 6 Mar 2023 19:09:35 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1678126175; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references; bh=bf81Sg91gg34dWGuLdg6vAArqivsg00/7Notto21iJk=; b=aVFGQa3SFxNOfHTNMNQ3+eYs7r3YgnqLXguwCpOySzjhXgWoBHMeoEaVsXMqZlauy6rxP4 h/cVyGnfwEOMqa1wC0bGMzhPcm7ZbkJKa40I4McX8KXtPCklAnlm++BhxseEjZ1OxzMIRD 1MUsglZCKjnVqaAKRmVkaN7PfHEpgn0= Date: Mon, 6 Mar 2023 19:09:29 +0100 From: Borislav Petkov To: Rick Edgecombe Cc: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Subject: Re: [PATCH v7 25/41] x86/mm: Introduce MAP_ABOVE4G Message-ID: References: <20230227222957.24501-1-rick.p.edgecombe@intel.com> <20230227222957.24501-26-rick.p.edgecombe@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20230227222957.24501-26-rick.p.edgecombe@intel.com> X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: D31061C0010 X-Stat-Signature: ys88rmxfo8riqfaifoc9o1bpxfn8cmkb X-Rspam-User: X-HE-Tag: 1678126178-385153 X-HE-Meta: U2FsdGVkX1/jdeSHRDKWkDwZhj5TOR+kK94489VgpHEhH9GX5wg3m8hPAf+/bHgKX161tGTkjq3vr+CJ5COzHRLOXZxEleS7cfqWO+mrQpiPuMyrxAf9+I+mL+jLPPCZS2NvKV4cKYInzQ+gyZ/K0wnCXwPj2btl+9mV3liFtezdiqa83z4IZQO6hwQMRpe+HHeePxfR/TE2mS+0SwAZuUwCFFLSUEZubnNy8g1CsMoi2JRa7QoPZU7iXzDi2zQTsu0SnYp9oteNaAIvWHQ2fVuOr5WrjDXLB5Zr3ZoN/KZN3/FZra88P1SdGhtw3FwXIbY+NafpgDf5a6A4oKoYUSz35WuF6im3IuEK2YJoXNLs1lwe/zL26ObfW6ofcmlbiwsGVD1Cb9irmF6JIbX1qpV/r1yb0lkXoaYDJDz0Rh6ZSyZ1kU0C5ZEdD4TvCrLZxqZmZVPUDarSLzKfMBlU/qKQ6/m/yKj54pYh+LOwT3daTjYNE3Q38H/R1pQagT2vn/UB84dpnyXwryRHdjgBAVvm4tWVyzaLsYktKx8zVTpDmq4CiCdLV3/gzB65qqSDhyTAyCiiL7UEzjbtlvGaJUcnBG1IeVhGAxas4GRSGC7YcnCSA9GNr5Cdb+7c3SWyrOpy1mDy6Scs/maq7K8bpKzKRlduMoOZmLKUNC+Y8aML6mn7FU5sxijAiis0UIk0LnwCUYqua/XoEUSljyNPe48YAw+eIFLtpOeiXQc420050mh7LsAOkmFjasJ3jRkDiJ4ACxkQx8D3I6dHLzMhhTejUNg0MacgDd41L6eT9Po0AwpP3C+EUMu820oQ3AecvIqsRrDb6MnSLfRN6mFk2TwCZ72JPrLZ6kHrUfn2jDgIFJErtYKH6dqzeqCqFGtS4sP05LEPREn8jDK8eonmv9hSgT3hlL6WN7MASVv3FEiJrC3OFNK9aYi7NmPzjLH+RcwdBptsHmaIBfkSguJ Lo0qBNnB O1NARl9atF2hptfqE99h/2qT0ZfnMjItL+HEKQcepSDie+p+ywUxas5o2Cs3JCdim90IevDVxkjqTBpv+i39pimmI3TdahMuj/MA4aKYG9+kNMnRyj+cE8sSp4blxLX8aZ01Izv47D3xNwRmHlIi/TZyi/LE2nu51HQNOKJP5nkhWIjYXLQeO9Poo9WqHc6LpEeSbCl2zf1xyl3rpC6aLDzdKxaPDQEoFqDQURWMhDFrXMJvqbsKfN4IMfv7DtE6g8EHIvyBh/AhlCkURqW+irZtHHv7Y1P7R5EzBqPxvjbCCGrPYsyM+0YGXdbseIxnB5wbrVROu/sLRqETLIHsujPL5CAAddE3YluN0ab0KlmZDL2GX6PjlgmBX/LU29l7ZxyQHbUxqr2NMBzB/w/g6SLj3qw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Feb 27, 2023 at 02:29:41PM -0800, Rick Edgecombe wrote: > The x86 Control-flow Enforcement Technology (CET) feature includes a new > type of memory called shadow stack. This shadow stack memory has some > unusual properties, which require some core mm changes to function > properly. > > One of the properties is that the shadow stack pointer (SSP), which is a > CPU register that points to the shadow stack like the stack pointer points > to the stack, can't be pointing outside of the 32 bit address space when > the CPU is executing in 32 bit mode. It is desirable to prevent executing > in 32 bit mode when shadow stack is enabled because the kernel can't easily > support 32 bit signals. > > On x86 it is possible to transition to 32 bit mode without any special > interaction with the kernel, by doing a "far call" to a 32 bit segment. > So the shadow stack implementation can use this address space behavior > as a feature, by enforcing that shadow stack memory is always crated ^^^^^^^ "created" and I'd say "mapped" or "allocated" here. "Created" sounds weird. > outside of the 32 bit address space. This way userspace will trigger a > general protection fault which will in turn trigger a segfault if it > tries to transition to 32 bit mode with shadow stack enabled. > > This provides a clean error generating border for the user if they try > attempt to do 32 bit mode shadow stack, rather than leave the kernel in a > half working state for userspace to be surprised by. > > So to allow future shadow stack enabling patches to map shadow stacks > out of the 32 bit address space, introduce MAP_ABOVE4G. The behavior I guess this needs to be documented in the mmap() manpage too. > is pretty much like MAP_32BIT, except that it has the opposite address > range. The are a few differences though. > > If both MAP_32BIT and MAP_ABOVE4G are provided, the kernel will use the > MAP_ABOVE4G behavior. Like MAP_32BIT, MAP_ABOVE4G is ignored in a 32 bit > syscall. > > Since the default search behavior is top down, the normal kaslr base can > be used for MAP_ABOVE4G. This is unlike MAP_32BIT which has to add it's ^^^^ "its" > own randomization in the bottom up case. ... > diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c > index 8cc653ffdccd..06378b5682c1 100644 > --- a/arch/x86/kernel/sys_x86_64.c > +++ b/arch/x86/kernel/sys_x86_64.c > @@ -193,7 +193,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, > > info.flags = VM_UNMAPPED_AREA_TOPDOWN; > info.length = len; > - info.low_limit = PAGE_SIZE; > + if (!in_32bit_syscall() && (flags & MAP_ABOVE4G)) > + info.low_limit = 0x100000000; We have a human readable define for that: SZ_4G > + else > + info.low_limit = PAGE_SIZE; > + > info.high_limit = get_mmap_base(0); > > /* -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette