From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75FC4C433EF for ; Tue, 8 Feb 2022 09:31:43 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 002E06B0075; Tue, 8 Feb 2022 04:31:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id EF47D6B007B; Tue, 8 Feb 2022 04:31:42 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DE3D16B007D; Tue, 8 Feb 2022 04:31:42 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0103.hostedemail.com [216.40.44.103]) by kanga.kvack.org (Postfix) with ESMTP id CD9D96B0075 for ; Tue, 8 Feb 2022 04:31:42 -0500 (EST) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 81ED9181CB2C0 for ; Tue, 8 Feb 2022 09:31:42 +0000 (UTC) X-FDA: 79119095244.07.F01DCDE Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by imf26.hostedemail.com (Postfix) with ESMTP id EBD5E14000A for ; Tue, 8 Feb 2022 09:31:41 +0000 (UTC) From: Thomas Gleixner DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1644312700; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=H/6XqdlLk396Y2QV/u0CviHdgHbavtEEfHO99e5VpJc=; b=CmLoRoLkw9ZPal5/x5vYmdWovEEjkL22TdXDf3Bz5mlZfXlyt/sMLDc0uEJIVAodf+LWrE HgkJZludL/EhO9uJA0YLtM8QVA4heoIJNY1NefW+kfLlckpXfiAP7lO2Dcku6F66XMwMRq o/wVlYgTrmhT2C5SWnBcyAqQGVrrJDAOWdLCmZSb+M5A0ReRjGX/poGxnMwDe8HlVuOzfG HsvCPtALHi0fb0j4MvIFLzL//G/nsR0nxEgLhD0plKyEHHOHFo0+X8BOqt7BaP8TvXZcXA E63QNZ+qJ51B7WlphbW+fJCrUi5OW8k3WD42qk3vQ1PqWrlOfX4PK0b65cozlA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1644312700; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=H/6XqdlLk396Y2QV/u0CviHdgHbavtEEfHO99e5VpJc=; b=bHhv8L+M3WgmMTbcDFVYRJHeq1WUkvHtzrNL3+LG8QxP8fqsZV0dX9MvnHHnd0sc5AgSIO Oga7MeFeLvO8DpDg== To: Andy Lutomirski , "Edgecombe, Rick P" , "hjl.tools@gmail.com" , "David.Laight@aculab.com" , Adrian Reber , Cyrill Gorcunov , Eugene Syromiatnikov , Dmitry Safonov <0x7f454c46@gmail.com> Cc: "bsingharora@gmail.com" , "hpa@zytor.com" , "Syromiatnikov, Eugene" , "peterz@infradead.org" , "rdunlap@infradead.org" , "keescook@chromium.org" , "Eranian, Stephane" , "kirill.shutemov@linux.intel.com" , "dave.hansen@linux.intel.com" , "linux-mm@kvack.org" , "fweimer@redhat.com" , "nadav.amit@gmail.com" , "jannh@google.com" , "kcc@google.com" , "linux-arch@vger.kernel.org" , "pavel@ucw.cz" , "oleg@redhat.com" , "Yang, Weijiang" , "bp@alien8.de" , "arnd@arndb.de" , "Moreira, Joao" , "mike.kravetz@oracle.com" , "x86@kernel.org" , "linux-doc@vger.kernel.org" , "Dave.Martin@arm.com" , "john.allen@amd.com" , "mingo@redhat.com" , "Shankar, Ravi V" , "corbet@lwn.net" , "linux-kernel@vger.kernel.org" , "linux-api@vger.kernel.org" , "gorcunov@gmail.com" Subject: Re: [PATCH 00/35] Shadow stacks for userspace In-Reply-To: <6ba06196-0756-37a4-d6c4-2e47e6601dcd@kernel.org> References: <87fsozek0j.ffs@tglx> <3421da7fc8474b6db0e265b20ffd28d0@AcuMS.aculab.com> <9f948745435c4c9273131146d50fe6f328b91a78.camel@intel.com> <6ba06196-0756-37a4-d6c4-2e47e6601dcd@kernel.org> Date: Tue, 08 Feb 2022 10:31:39 +0100 Message-ID: <87mtj1vh50.ffs@tglx> MIME-Version: 1.0 Content-Type: text/plain X-Rspamd-Queue-Id: EBD5E14000A X-Stat-Signature: cb6c7nox3g9w1mx3817qqxq6ye7b7uf4 Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=linutronix.de header.s=2020 header.b=CmLoRoLk; dkim=pass header.d=linutronix.de header.s=2020e header.b=bHhv8L+M; dmarc=pass (policy=none) header.from=linutronix.de; spf=pass (imf26.hostedemail.com: domain of tglx@linutronix.de designates 193.142.43.55 as permitted sender) smtp.mailfrom=tglx@linutronix.de X-Rspamd-Server: rspam06 X-Rspam-User: X-HE-Tag: 1644312701-778777 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Feb 07 2022 at 17:31, Andy Lutomirski wrote: > So this leaves altshadowstack. If we want to allow userspace to handle > a shstk overflow, I think we need altshadowstack. And I can easily > imagine signal handling in a coroutine or user-threading evironment (Go? > UMCG or whatever it's called?) wanting this. As noted, this obnoxious > Andy person didn't like putting any shstk-related extensions in the FPU > state. > > For better or for worse, altshadowstack is (I think) fundamentally a new > API. No amount of ucontext magic is going to materialize an entire > shadow stack out of nowhere when someone calls sigaltstack(). So the > questions are: should we support altshadowstack from day one and, if so, > what should it look like? I think we should support them from day one. > So I don't have a complete or even almost complete design in mind, but I > think we do need to make a conscious decision either to design this > right or to skip it for v1. Skipping it might create a fundamental design fail situation as it might require changes to the shadow stack signal handling in general which becomes a nightmare once a non-altstack API is exposed. > As for CRIU, I don't think anyone really expects a new kernel, running > new userspace that takes advantage of features in the new kernel, to > work with old CRIU. Yes, CRIU needs updates, but what ensures that CRIU managed user space does not use SHSTK if CRIU is not updated yet? > Upgrading to a SHSTK kernel should still allow using CRIU with > non-SHSTK userspace, but I don't see how it's possible for CRIU to > handle SHSTK without updates. We should certainly do our best to make > CRIU's life easy, though. Handling CRIU with SHSTK enabled has to be part of the overall design otherwise we'll either end up with horrible hacks or with a requirement to change the V1 UAPI.... Thanks, tglx