From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dave Hansen Subject: Re: [PATCH 7/9] x86/mm: Shadow stack page fault error checking Date: Thu, 7 Jun 2018 09:56:36 -0700 Message-ID: <5764865a-1dd2-ec5b-c67c-1ea322aea203@linux.intel.com> References: <20180607143705.3531-1-yu-cheng.yu@intel.com> <20180607143705.3531-8-yu-cheng.yu@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org To: Andy Lutomirski , Yu-cheng Yu Cc: LKML , linux-doc@vger.kernel.org, Linux-MM , linux-arch , X86 ML , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , "H. J. Lu" , "Shanbhogue, Vedvyas" , "Ravi V. Shankar" , Jonathan Corbet , Oleg Nesterov , Arnd Bergmann , mike.kravetz@oracle.com List-Id: linux-arch.vger.kernel.org On 06/07/2018 09:26 AM, Andy Lutomirski wrote: >> >> + /* >> + * Verify X86_PF_SHSTK is within a shadow stack VMA. >> + * It is always an error if there is a shadow stack >> + * fault outside a shadow stack VMA. >> + */ >> + if (error_code & X86_PF_SHSTK) { >> + if (!(vma->vm_flags & VM_SHSTK)) >> + return 1; >> + return 0; >> + } >> + > What, if anything, would go wrong without this change? It seems like > it might be purely an optimization. If so, can you mention that in > the comment? This is a fine exercise. I'm curious what it does, too. But, I really like it being explicit in the end. If we depend on implicit behavior, I really worry that someone breaks it accidentally. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga04.intel.com ([192.55.52.120]:3591 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753088AbeFGQ57 (ORCPT ); Thu, 7 Jun 2018 12:57:59 -0400 Subject: Re: [PATCH 7/9] x86/mm: Shadow stack page fault error checking References: <20180607143705.3531-1-yu-cheng.yu@intel.com> <20180607143705.3531-8-yu-cheng.yu@intel.com> From: Dave Hansen Message-ID: <5764865a-1dd2-ec5b-c67c-1ea322aea203@linux.intel.com> Date: Thu, 7 Jun 2018 09:56:36 -0700 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: Andy Lutomirski , Yu-cheng Yu Cc: LKML , linux-doc@vger.kernel.org, Linux-MM , linux-arch , X86 ML , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , "H. J. Lu" , "Shanbhogue, Vedvyas" , "Ravi V. Shankar" , Jonathan Corbet , Oleg Nesterov , Arnd Bergmann , mike.kravetz@oracle.com Message-ID: <20180607165636.jTx6grjmIN9Ble7_IoPk7tvSQE3wmrmwSoHyNAqZH1s@z> On 06/07/2018 09:26 AM, Andy Lutomirski wrote: >> >> + /* >> + * Verify X86_PF_SHSTK is within a shadow stack VMA. >> + * It is always an error if there is a shadow stack >> + * fault outside a shadow stack VMA. >> + */ >> + if (error_code & X86_PF_SHSTK) { >> + if (!(vma->vm_flags & VM_SHSTK)) >> + return 1; >> + return 0; >> + } >> + > What, if anything, would go wrong without this change? It seems like > it might be purely an optimization. If so, can you mention that in > the comment? This is a fine exercise. I'm curious what it does, too. But, I really like it being explicit in the end. If we depend on implicit behavior, I really worry that someone breaks it accidentally.