Received-SPF: pass (google.com: domain of linux-kernel+bounces-163031-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <9f4927cb-e8c1-4b97-b9b6-145172b469e0@zytor.com>
Date: Mon, 29 Apr 2024 13:57:00 -0700
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: x86: dynamic pt_regs pointer and kernel stack randomization
To: Kees Cook <keescook@chromium.org>
Cc: Xin Li <xin@zytor.com>, Andrew Lutomirski <luto@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
        Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        LKML <linux-kernel@vger.kernel.org>, "x86@kernel.org" <x86@kernel.org>
References: <a793c733-267d-4930-8ee2-0fc0f24c3538@zytor.com>
 <202404290859.99763AA1@keescook>
Content-Language: en-US
From: "H. Peter Anvin" <hpa@zytor.com>
In-Reply-To: <202404290859.99763AA1@keescook>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 4/29/24 09:09, Kees Cook wrote:
> 
> If I'm understanding FRED correctly, I think this exit path
> would need to call choose_random_kstack_offset() as well. (For
> syscalls, add_random_kstack_offset() is used on entry and
> choose_random_kstack_offset() is used on exit, so I think we'd want the
> same pattern for interrupt handling.)
> 

Yes, I didn't include it in here because it doesn't affect the assembly 
flow per se, since it "simply" sets up the parameters for the next entry 
and so at least logically can be executed more or less anywhere.

> Yeah, I'd like greater coverage for ring 3->0 transitions. We do want to
> double-check the original design choices, though. I *think* they still
> stand (see the comments for choose_random_kstack_offset() about entropy
> location (per-cpu area), and lifetime (across userspace execution).

Yeah, I'm not super sure of what exactly the constraints really are; 
they are written in a way that signals to me that there is implied 
context that isn't clear to me, especially the bit about "long running 
syscalls".

	-hpa