From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753235AbcFTHfr (ORCPT ); Mon, 20 Jun 2016 03:35:47 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:44316 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751790AbcFTHfi (ORCPT ); Mon, 20 Jun 2016 03:35:38 -0400 X-IBM-Helo: d06dlp01.portsmouth.uk.ibm.com X-IBM-MailFrom: heiko.carstens@de.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org Date: Mon, 20 Jun 2016 09:07:24 +0200 From: Heiko Carstens To: Andy Lutomirski Cc: Nadav Amit , Kees Cook , Josh Poimboeuf , Borislav Petkov , X86 ML , "kernel-hardening@lists.openwall.com" , Brian Gerst , "linux-kernel@vger.kernel.org" , Linus Torvalds Subject: Re: [PATCH 00/13] Virtually mapped stacks with guard pages (x86, core) References: <20160616060538.GA3923@osiris> <20160617072737.GA3960@osiris> <20160620055836.GA3266@osiris> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16062007-0028-0000-0000-000001DA56E7 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16062007-0029-0000-0000-00001F4B48C8 Message-Id: <20160620070724.GB3266@osiris> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-06-20_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1606200085 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Jun 19, 2016 at 11:01:48PM -0700, Andy Lutomirski wrote: > > The tmll instruction tests if any of the higher bits within the 16k > > stackframe address are set. In this specific case that would be bits 7-15 > > (mask 0x3f80). If no bit would be set we know that only up to 128 bytes > > would be left on the stack, and thus trigger an exception. > > > > This check does of course only work if a 16k stack is also 16k aligned, > > which is always the case. > > > > Oh, interesting. How do you handle the case of a single function that > uses more than 128 bytes of stack? The compiler uses the next larger value of the stackframe size that is a power of 2 for checking. So another example with a stackframe size of 472 bytes would be the below one with a mask of 0x3e00: 0000000000392db8 : 392db8: eb 6f f0 48 00 24 stmg %r6,%r15,72(%r15) 392dbe: a7 f1 3e 00 tmll %r15,15872 392dc2: b9 04 00 ef lgr %r14,%r15 392dc6: a7 84 00 01 je 392dc8 392dca: e3 f0 fe 28 ff 71 lay %r15,-472(%r15)