MIME-Version: 1.0
In-Reply-To: <1456949376-4910-10-git-send-email-cmetcalf@ezchip.com>
References: <1456949376-4910-1-git-send-email-cmetcalf@ezchip.com> <1456949376-4910-10-git-send-email-cmetcalf@ezchip.com>
From: Andy Lutomirski <luto@amacapital.net>
Date: Wed, 2 Mar 2016 16:36:54 -0800
Message-ID: <CALCETrX6wJHC_yBGy7H6LamHTvGf8x+Fjqi6P2jxUBZ7GBp0AQ@mail.gmail.com>
Subject: Re: [PATCH v10 09/12] arch/x86: enable task isolation functionality
To: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Thomas Gleixner <tglx@linutronix.de>, Christoph Lameter <cl@linux.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Viresh Kumar <viresh.kumar@linaro.org>, Ingo Molnar <mingo@kernel.org>,
        Steven Rostedt <rostedt@goodmis.org>, Tejun Heo <tj@kernel.org>,
        Gilad Ben Yossef <giladb@ezchip.com>,
        Will Deacon <will.deacon@arm.com>, Rik van Riel <riel@redhat.com>,
        Frederic Weisbecker <fweisbec@gmail.com>,
        "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        X86 ML <x86@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>,
        Catalin Marinas <catalin.marinas@arm.com>,
        Peter Zijlstra <peterz@infradead.org>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2890
Lines: 80

On Mar 2, 2016 12:10 PM, "Chris Metcalf" <cmetcalf@ezchip.com> wrote:
>
> In prepare_exit_to_usermode(), call task_isolation_ready()
> when we are checking the thread-info flags, and after we've handled
> the other work, call task_isolation_enter() unconditionally.
>
> In syscall_trace_enter_phase1(), we add the necessary support for
> strict-mode detection of syscalls.
>
> We add strict reporting for the kernel exception types that do
> not result in signals, namely non-signalling page faults and
> non-signalling MPX fixups.
>
> Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
> ---
>  arch/x86/entry/common.c | 18 ++++++++++++++++--
>  arch/x86/kernel/traps.c |  2 ++
>  arch/x86/mm/fault.c     |  2 ++
>  3 files changed, 20 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
> index 03663740c866..27c71165416b 100644
> --- a/arch/x86/entry/common.c
> +++ b/arch/x86/entry/common.c
> @@ -21,6 +21,7 @@
>  #include <linux/context_tracking.h>
>  #include <linux/user-return-notifier.h>
>  #include <linux/uprobes.h>
> +#include <linux/isolation.h>
>
>  #include <asm/desc.h>
>  #include <asm/traps.h>
> @@ -91,6 +92,10 @@ unsigned long syscall_trace_enter_phase1(struct pt_regs *regs, u32 arch)
>          */
>         if (work & _TIF_NOHZ) {
>                 enter_from_user_mode();
> +               if (task_isolation_check_syscall(regs->orig_ax)) {
> +                       regs->orig_ax = -1;
> +                       return 0;
> +               }

This needs a comment indicating the intended semantics.

And I've still heard no explanation of why this part can't use seccomp.

>                 work &= ~_TIF_NOHZ;
>         }
>  #endif
> @@ -254,17 +259,26 @@ static void exit_to_usermode_loop(struct pt_regs *regs, u32 cached_flags)
>                 if (cached_flags & _TIF_USER_RETURN_NOTIFY)
>                         fire_user_return_notifiers();
>
> +               task_isolation_enter();
> +
>                 /* Disable IRQs and retry */
>                 local_irq_disable();
>
>                 cached_flags = READ_ONCE(pt_regs_to_thread_info(regs)->flags);
>
> -               if (!(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS))
> +               if (!(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS) &&
> +                   task_isolation_ready())
>                         break;
>
>         }
>  }
>
> +#ifdef CONFIG_TASK_ISOLATION
> +# define EXIT_TO_USERMODE_FLAGS (EXIT_TO_USERMODE_LOOP_FLAGS | _TIF_NOHZ)
> +#else
> +# define EXIT_TO_USERMODE_FLAGS EXIT_TO_USERMODE_LOOP_FLAGS
> +#endif
> +

TIF_NOHZ is already a hack and IMO this just makes it worse.  At the
very least this should have a comment.  It really ought to be either a
static_branch or a flag that's actually switched per cpu.

But this is also a confusing change.  Don't override the definition
here -- stick it in the header where it belongs.