On Tue, Feb 25, 2025 at 10:22:56AM -0500, Liam R. Howlett wrote: > * jeffxu@xxxxxxxxxxxx <jeffxu@xxxxxxxxxxxx> [250224 17:52]: > > From: Jeff Xu <jeffxu@xxxxxxxxxxxx> > > > > Provide infrastructure to mseal system mappings. Establish > > two kernel configs (CONFIG_MSEAL_SYSTEM_MAPPINGS, > > ARCH_HAS_MSEAL_SYSTEM_MAPPINGS) and VM_SEALED_SYSMAP > > macro for future patches. > > > > Signed-off-by: Jeff Xu <jeffxu@xxxxxxxxxxxx> > > --- > > include/linux/mm.h | 10 ++++++++++ > > init/Kconfig | 18 ++++++++++++++++++ > > security/Kconfig | 18 ++++++++++++++++++ > > 3 files changed, 46 insertions(+) > > > > diff --git a/include/linux/mm.h b/include/linux/mm.h > > index 7b1068ddcbb7..8b800941678d 100644 > > --- a/include/linux/mm.h > > +++ b/include/linux/mm.h > > @@ -4155,4 +4155,14 @@ int arch_get_shadow_stack_status(struct task_struct *t, unsigned long __user *st > > int arch_set_shadow_stack_status(struct task_struct *t, unsigned long status); > > int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status); > > > > + > > +/* > > + * mseal of userspace process's system mappings. > > + */ > > +#ifdef CONFIG_MSEAL_SYSTEM_MAPPINGS > > +#define VM_SEALED_SYSMAP VM_SEALED > > +#else > > +#define VM_SEALED_SYSMAP VM_NONE > > +#endif > > + > > #endif /* _LINUX_MM_H */ > > diff --git a/init/Kconfig b/init/Kconfig > > index d0d021b3fa3b..07435e33f965 100644 > > --- a/init/Kconfig > > +++ b/init/Kconfig > > @@ -1882,6 +1882,24 @@ config ARCH_HAS_MEMBARRIER_CALLBACKS > > config ARCH_HAS_MEMBARRIER_SYNC_CORE > > bool > > > > +config ARCH_HAS_MSEAL_SYSTEM_MAPPINGS > > I think we said ARCH_SUPPORTS_ for software features in v5 of the series > [1]. Can we also make this change please? Jeff - I'm going to risk sounding like a typical, grumpy, kernel maintainer here (sorry! :P) but please, please do ensure that you address all prior feedback. It may be worth even, when things settle down here, putting together a list of things you intend to address in the next round and double-check you've covered everything off. Because obviously when this happens once it's probably an oversight, but it seems you've failed to address at least 4 separate things requested of you here. It's obivously s going to make this a faaar more drawn out process for al linvolved. Again, to be clear, as to allay LWN articles about 'Stoakes urging caution' or what not and related drama - my intent in saying this is purely that _I want this series to land_. So I say it merely to help expedite this! :) Cheers, Lorenzo > > ... > > Thanks, > Liam > > [1]. https://lore.kernel.org/all/202502131142.F5EE115C3A@keescook/
