From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7350C43464 for ; Fri, 18 Sep 2020 21:21:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 48A0722208 for ; Fri, 18 Sep 2020 21:21:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 48A0722208 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C62DB6B0093; Fri, 18 Sep 2020 17:21:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id BEC598E0001; Fri, 18 Sep 2020 17:21:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ABCDC6B0096; Fri, 18 Sep 2020 17:21:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0078.hostedemail.com [216.40.44.78]) by kanga.kvack.org (Postfix) with ESMTP id 917256B0093 for ; Fri, 18 Sep 2020 17:21:35 -0400 (EDT) Received: from smtpin02.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 4E2D5181AEF23 for ; Fri, 18 Sep 2020 21:21:35 +0000 (UTC) X-FDA: 77277453750.02.day59_52045762712e Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin02.hostedemail.com (Postfix) with ESMTP id 33FD91010FA3C for ; Fri, 18 Sep 2020 21:21:35 +0000 (UTC) X-HE-Tag: day59_52045762712e X-Filterd-Recvd-Size: 4070 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Fri, 18 Sep 2020 21:21:33 +0000 (UTC) IronPort-SDR: /nSUfKL9eez79POgR5xQc2w6DQ7QI/sRWicNWgGMjKKP7BMEprsXbQxA/icnn8U17qTaMbPRbn WzxnJ/o0puSw== X-IronPort-AV: E=McAfee;i="6000,8403,9748"; a="159351091" X-IronPort-AV: E=Sophos;i="5.77,274,1596524400"; d="scan'208";a="159351091" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Sep 2020 14:21:24 -0700 IronPort-SDR: cqPmBsZP+6LCDOndU195386/Bgju5YHVNwiypFk5BMbPE9dJG8qo+zu4vjlHNtpOUfjRfXM7d/ s8nIq35e4evA== X-IronPort-AV: E=Sophos;i="5.77,274,1596524400"; d="scan'208";a="381051016" Received: from yyu32-mobl1.amr.corp.intel.com (HELO [10.212.0.248]) ([10.212.0.248]) by orsmga001-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Sep 2020 14:21:13 -0700 Subject: Re: [PATCH v12 8/8] x86: Disallow vsyscall emulation when CET is enabled To: Pavel Machek , Dave Hansen Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang References: <20200918192312.25978-1-yu-cheng.yu@intel.com> <20200918192312.25978-9-yu-cheng.yu@intel.com> <20200918210026.GC4304@duo.ucw.cz> From: "Yu, Yu-cheng" Message-ID: <862eef02-eba2-e13f-ed67-f915f749ebca@intel.com> Date: Fri, 18 Sep 2020 14:21:10 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0 MIME-Version: 1.0 In-Reply-To: <20200918210026.GC4304@duo.ucw.cz> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 9/18/2020 2:00 PM, Pavel Machek wrote: > On Fri 2020-09-18 12:32:57, Dave Hansen wrote: >> On 9/18/20 12:23 PM, Yu-cheng Yu wrote: >>> Emulation of the legacy vsyscall page is required by some programs >>> built before 2013. Newer programs after 2013 don't use it. >>> Disable vsyscall emulation when Control-flow Enforcement (CET) is >>> enabled to enhance security. >> >> How does this "enhance security"? >> >> What is the connection between vsyscall emulation and CET? > > Boom. > > We don't break compatibility by default, and you should not tell > people to enable CET by default if you plan to do this. I would revise the wording if there is another version. What this patch does is: If an application is compiled for CET and the system supports it, then the application cannot do vsyscall emulation. Earlier we allow the emulation, and had a patch that fixes the shadow stack and endbr for the emulation code. Since newer programs mostly do no do the emulation, we changed the patch do block it when attempted. This patch would not block any legacy applications or any applications on older machines. Yu-cheng