From: Kees Cook <keescook@chromium.org>
To: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: x86@kernel.org, "H . Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
linux-mm@kvack.org, linux-arch@vger.kernel.org,
linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>,
Andy Lutomirski <luto@kernel.org>,
Balbir Singh <bsingharora@gmail.com>,
Borislav Petkov <bp@alien8.de>,
Cyrill Gorcunov <gorcunov@gmail.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Eugene Syromiatnikov <esyr@redhat.com>,
Florian Weimer <fweimer@redhat.com>,
"H . J . Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>,
Jonathan Corbet <corbet@lwn.net>,
Mike Kravetz <mike.kravetz@oracle.com>,
Nadav Amit <nadav.amit@gmail.com>,
Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>,
Peter Zijlstra <peterz@infradead.org>,
Randy Dunlap <rdunlap@infradead.org>,
Weijiang Yang <weijiang.yang@intel.com>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
John Allen <john.allen@amd.com>,
kcc@google.com, eranian@google.com, rppt@kernel.org,
jamorris@linux.microsoft.com, dethoma@microsoft.com,
akpm@linux-foundation.org, Andrew.Cooper3@citrix.com,
christina.schimpe@intel.com, david@redhat.com,
debug@rivosinc.com
Subject: Re: [PATCH v6 25/41] x86/mm: Introduce MAP_ABOVE4G
Date: Sun, 19 Feb 2023 12:43:56 -0800 [thread overview]
Message-ID: <63f28a0d.170a0220.21bf7.b03c@mx.google.com> (raw)
In-Reply-To: <20230218211433.26859-26-rick.p.edgecombe@intel.com>
On Sat, Feb 18, 2023 at 01:14:17PM -0800, Rick Edgecombe wrote:
> The x86 Control-flow Enforcement Technology (CET) feature includes a new
> type of memory called shadow stack. This shadow stack memory has some
> unusual properties, which require some core mm changes to function
> properly.
>
> One of the properties is that the shadow stack pointer (SSP), which is a
> CPU register that points to the shadow stack like the stack pointer points
> to the stack, can't be pointing outside of the 32 bit address space when
> the CPU is executing in 32 bit mode. It is desirable to prevent executing
> in 32 bit mode when shadow stack is enabled because the kernel can't easily
> support 32 bit signals.
>
> On x86 it is possible to transition to 32 bit mode without any special
> interaction with the kernel, by doing a "far call" to a 32 bit segment.
> So the shadow stack implementation can use this address space behavior
> as a feature, by enforcing that shadow stack memory is always crated
> outside of the 32 bit address space. This way userspace will trigger a
> general protection fault which will in turn trigger a segfault if it
> tries to transition to 32 bit mode with shadow stack enabled.
>
> This provides a clean error generating border for the user if they try
> attempt to do 32 bit mode shadow stack, rather than leave the kernel in a
> half working state for userspace to be surprised by.
>
> So to allow future shadow stack enabling patches to map shadow stacks
> out of the 32 bit address space, introduce MAP_ABOVE4G. The behavior
> is pretty much like MAP_32BIT, except that it has the opposite address
> range. The are a few differences though.
>
> If both MAP_32BIT and MAP_ABOVE4G are provided, the kernel will use the
> MAP_ABOVE4G behavior. Like MAP_32BIT, MAP_ABOVE4G is ignored in a 32 bit
> syscall.
Should the interface refuse to accept both set instead?
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
next prev parent reply other threads:[~2023-02-19 20:44 UTC|newest]
Thread overview: 163+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-18 21:13 [PATCH v6 00/41] Shadow stacks for userspace Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 01/41] Documentation/x86: Add CET shadow stack description Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 02/41] x86/shstk: Add Kconfig option for shadow stack Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 03/41] x86/cpufeatures: Add CPU feature flags for shadow stacks Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 04/41] x86/cpufeatures: Enable CET CR4 bit for shadow stack Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 05/41] x86/fpu/xstate: Introduce CET MSR and XSAVES supervisor states Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 06/41] x86/fpu: Add helper for modifying xstate Rick Edgecombe
2023-02-18 21:13 ` [PATCH v6 07/41] x86: Move control protection handler to separate file Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 08/41] x86/shstk: Add user control-protection fault handler Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 09/41] x86/mm: Remove _PAGE_DIRTY from kernel RO pages Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 10/41] x86/mm: Move pmd_write(), pud_write() up in the file Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 11/41] mm: Introduce pte_mkwrite_kernel() Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-19 20:38 ` Kees Cook
2023-02-19 20:38 ` Kees Cook
2023-02-20 11:17 ` David Hildenbrand
2023-02-20 11:17 ` David Hildenbrand
2023-02-20 11:19 ` David Hildenbrand
2023-02-20 11:19 ` David Hildenbrand
2023-03-01 15:39 ` Deepak Gupta
2023-03-01 15:39 ` Deepak Gupta
2023-02-18 21:14 ` [PATCH v6 12/41] s390/mm: Introduce pmd_mkwrite_kernel() Rick Edgecombe
2023-02-19 20:39 ` Kees Cook
2023-02-20 11:21 ` David Hildenbrand
2023-02-23 12:14 ` Heiko Carstens
2023-02-23 17:59 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 13/41] mm: Make pte_mkwrite() take a VMA Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-18 21:14 ` Rick Edgecombe
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-19 20:40 ` Kees Cook
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 1:00 ` Michael Ellerman
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 21:24 ` Edgecombe, Rick P
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 11:23 ` David Hildenbrand
2023-02-20 22:56 ` Edgecombe, Rick P
2023-02-20 22:56 ` Edgecombe, Rick P
2023-02-20 22:56 ` Edgecombe, Rick P
2023-02-20 22:56 ` Edgecombe, Rick P
2023-02-20 22:56 ` Edgecombe, Rick P
2023-02-20 22:56 ` Edgecombe, Rick P
2023-02-20 22:56 ` Edgecombe, Rick P
2023-03-01 15:41 ` Deepak Gupta
2023-03-01 15:41 ` Deepak Gupta
2023-03-01 15:41 ` Deepak Gupta
2023-03-01 15:41 ` Deepak Gupta
2023-03-01 15:41 ` Deepak Gupta
2023-03-01 15:41 ` Deepak Gupta
2023-03-01 15:41 ` Deepak Gupta
2023-02-18 21:14 ` [PATCH v6 14/41] x86/mm: Introduce _PAGE_SAVED_DIRTY Rick Edgecombe
2023-02-20 11:32 ` David Hildenbrand
2023-02-20 21:38 ` Edgecombe, Rick P
2023-02-21 8:38 ` David Hildenbrand
2023-02-21 20:08 ` Edgecombe, Rick P
2023-02-21 20:13 ` Dave Hansen
2023-02-22 1:02 ` Edgecombe, Rick P
2023-02-22 9:05 ` David Hildenbrand
2023-02-22 17:23 ` Dave Hansen
2023-02-22 17:27 ` David Hildenbrand
2023-02-22 17:42 ` Kees Cook
2023-02-22 17:54 ` Dave Hansen
2023-02-22 19:39 ` Kees Cook
2023-02-18 21:14 ` [PATCH v6 15/41] x86/mm: Update ptep/pmdp_set_wrprotect() for _PAGE_SAVED_DIRTY Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 16/41] x86/mm: Start actually marking _PAGE_SAVED_DIRTY Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 17/41] mm: Move VM_UFFD_MINOR_BIT from 37 to 38 Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 18/41] mm: Introduce VM_SHADOW_STACK for shadow stack memory Rick Edgecombe
2023-02-20 12:56 ` David Hildenbrand
2023-02-20 22:08 ` Edgecombe, Rick P
2023-02-21 8:34 ` David Hildenbrand
2023-02-22 22:13 ` Deepak Gupta
2023-02-18 21:14 ` [PATCH v6 19/41] x86/mm: Check shadow stack page fault errors Rick Edgecombe
2023-02-20 12:57 ` David Hildenbrand
2023-02-22 23:07 ` Edgecombe, Rick P
2023-02-23 12:55 ` David Hildenbrand
2023-02-18 21:14 ` [PATCH v6 20/41] x86/mm: Teach pte_mkwrite() about stack memory Rick Edgecombe
2023-02-19 20:41 ` Kees Cook
2023-02-20 22:52 ` Edgecombe, Rick P
2023-03-01 15:42 ` Deepak Gupta
2023-02-18 21:14 ` [PATCH v6 21/41] mm: Add guard pages around a shadow stack Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 22/41] mm/mmap: Add shadow stack pages to memory accounting Rick Edgecombe
2023-02-20 12:58 ` David Hildenbrand
2023-02-20 22:44 ` Edgecombe, Rick P
2023-02-21 8:31 ` David Hildenbrand
2023-02-22 0:06 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 23/41] mm: Re-introduce vm_flags to do_mmap() Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 24/41] mm: Don't allow write GUPs to shadow stack memory Rick Edgecombe
2023-02-21 8:42 ` David Hildenbrand
2023-02-21 20:02 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 25/41] x86/mm: Introduce MAP_ABOVE4G Rick Edgecombe
2023-02-19 20:43 ` Kees Cook [this message]
2023-02-20 22:38 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 26/41] mm: Warn on shadow stack memory in wrong vma Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 27/41] x86/mm: Warn if create Write=0,Dirty=1 with raw prot Rick Edgecombe
2023-02-19 20:45 ` Kees Cook
2023-02-20 22:32 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 28/41] x86: Introduce userspace API for shadow stack Rick Edgecombe
2023-02-24 12:20 ` Borislav Petkov
2023-02-24 18:37 ` Edgecombe, Rick P
2023-02-28 10:58 ` Borislav Petkov
2023-02-28 22:35 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 29/41] x86/shstk: Add user-mode shadow stack support Rick Edgecombe
2023-02-24 12:22 ` Borislav Petkov
2023-02-24 18:25 ` Edgecombe, Rick P
2023-02-24 18:33 ` Borislav Petkov
2023-02-18 21:14 ` [PATCH v6 30/41] x86/shstk: Handle thread shadow stack Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 31/41] x86/shstk: Introduce routines modifying shstk Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 32/41] x86/shstk: Handle signals for shadow stack Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 33/41] x86/shstk: Introduce map_shadow_stack syscall Rick Edgecombe
2023-02-23 0:03 ` Deepak Gupta
2023-02-23 1:11 ` Edgecombe, Rick P
2023-02-23 21:20 ` Deepak Gupta
2023-02-23 23:42 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 34/41] x86/shstk: Support WRSS for userspace Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 35/41] x86: Expose thread features in /proc/$PID/status Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 36/41] x86/shstk: Wire in shadow stack interface Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 37/41] selftests/x86: Add shadow stack test Rick Edgecombe
2023-02-19 20:47 ` Kees Cook
2023-02-21 8:48 ` David Hildenbrand
2023-02-21 20:02 ` Edgecombe, Rick P
2023-02-23 13:47 ` Borislav Petkov
2023-02-23 17:54 ` Edgecombe, Rick P
2023-02-24 11:45 ` Borislav Petkov
2023-02-24 18:39 ` Edgecombe, Rick P
2023-02-18 21:14 ` [PATCH v6 38/41] x86/fpu: Add helper for initing features Rick Edgecombe
2023-02-19 20:48 ` Kees Cook
2023-02-18 21:14 ` [PATCH v6 39/41] x86: Add PTRACE interface for shadow stack Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 40/41] x86/shstk: Add ARCH_SHSTK_UNLOCK Rick Edgecombe
2023-02-18 21:14 ` [PATCH v6 41/41] x86/shstk: Add ARCH_SHSTK_STATUS Rick Edgecombe
2023-02-20 3:42 ` [PATCH v6 00/41] Shadow stacks for userspace Kees Cook
2023-02-20 22:54 ` Edgecombe, Rick P
2023-02-20 6:50 ` Mike Rapoport
2023-02-20 21:23 ` Edgecombe, Rick P
2023-02-20 20:22 ` John Allen
2023-02-21 2:38 ` Pengfei Xu
2023-02-22 19:28 ` Borislav Petkov
2023-02-22 19:31 ` Edgecombe, Rick P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=63f28a0d.170a0220.21bf7.b03c@mx.google.com \
--to=keescook@chromium.org \
--cc=Andrew.Cooper3@citrix.com \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=bp@alien8.de \
--cc=bsingharora@gmail.com \
--cc=christina.schimpe@intel.com \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=david@redhat.com \
--cc=debug@rivosinc.com \
--cc=dethoma@microsoft.com \
--cc=eranian@google.com \
--cc=esyr@redhat.com \
--cc=fweimer@redhat.com \
--cc=gorcunov@gmail.com \
--cc=hjl.tools@gmail.com \
--cc=hpa@zytor.com \
--cc=jamorris@linux.microsoft.com \
--cc=jannh@google.com \
--cc=john.allen@amd.com \
--cc=kcc@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mike.kravetz@oracle.com \
--cc=mingo@redhat.com \
--cc=nadav.amit@gmail.com \
--cc=oleg@redhat.com \
--cc=pavel@ucw.cz \
--cc=peterz@infradead.org \
--cc=rdunlap@infradead.org \
--cc=rick.p.edgecombe@intel.com \
--cc=rppt@kernel.org \
--cc=tglx@linutronix.de \
--cc=weijiang.yang@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.