From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752320AbdLLQBd (ORCPT ); Tue, 12 Dec 2017 11:01:33 -0500 Received: from mail-wm0-f52.google.com ([74.125.82.52]:44771 "EHLO mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751688AbdLLQB3 (ORCPT ); Tue, 12 Dec 2017 11:01:29 -0500 X-Google-Smtp-Source: ACJfBovV97pQGMTG50OMqlO5vV8Nz8BjB2V+A3Fjbv2cyYiDKhC3PGlUesqlWBKNjyg1fet5kZPZGA== Date: Tue, 12 Dec 2017 19:01:26 +0300 From: "Kirill A. Shutemov" To: Andy Lutomirski Cc: X86 ML , "linux-kernel@vger.kernel.org" , Borislav Petkov , Brian Gerst , David Laight , Kees Cook , Peter Zijlstra Subject: Re: [PATCH PTI v2 0/6] Clean up pgd handling and fix VSYSCALL and LDT Message-ID: <20171212160126.kqsymv66wvee4oy7@node.shutemov.name> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20171027 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Dec 10, 2017 at 10:54:38PM -0800, Andy Lutomirski wrote: > On Sun, Dec 10, 2017 at 10:47 PM, Andy Lutomirski wrote: > > I'm getting reasonably happy with this. It still needs more testing, > > but I want to get it out there. > > > > The main things that need testing are the 5-level case for the both > > vsyscalls and the LDT. I'm getting a double-fault in ldt_gdt_64, > > but I haven't checked whether it's a bug in this series, and it > > kind of looks like it isn't. I'll figure it out in the morning. > > The docs also want updating for the 5 level case. > > > > The actual failure looks a lot like the ESPFIX stacks aren't mapped in > the usermode tables, which reinforces my old belief that this bit of > code is bogus: > > /* > * Just copy the top-level PGD that is mapping the espfix area to > * ensure it is mapped into the user page tables. > * > * For 5-level paging, the espfix pgd was populated when > * pti_init() pre-populated all the pgd entries. The above > * p4d_alloc() would never do anything and the p4d_populate() would > * be done to a p4d already mapped in the userspace pgd. > */ > #ifdef CONFIG_PAGE_TABLE_ISOLATION > if (CONFIG_PGTABLE_LEVELS <= 4) { > set_pgd(kernel_to_user_pgdp(pgd), > __pgd(_KERNPG_TABLE | (p4d_pfn(*p4d) << PAGE_SHIFT))); > } > #endif > > Of course, the comment is even more wrong with this series applied, > but I think it's been wrong all along. > > I'll fix it in the morning if no one beats me to it. > > (Hint: this can be tested in QEMU with -machine accel=tcg -cpu qemu64,+la57) I thought something like patch below would help (for both paging modes). It indeed made sigreturn_64 run a bit longer in 5-level paging mode, but it still double faults in the end. Maybe it's another bug. I don't know. I don't have time right now to look into. BTW, sigreturn_64 reports FAILS in 4-level paging mode. t a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c index 1c44e72ed1bc..0725c04b2d3f 100644 --- a/arch/x86/kernel/espfix_64.c +++ b/arch/x86/kernel/espfix_64.c @@ -129,20 +129,11 @@ void __init init_espfix_bsp(void) p4d = p4d_alloc(&init_mm, pgd, ESPFIX_BASE_ADDR); p4d_populate(&init_mm, p4d, espfix_pud_page); - /* - * Just copy the top-level PGD that is mapping the espfix area to - * ensure it is mapped into the user page tables. - * - * For 5-level paging, the espfix pgd was populated when - * pti_init() pre-populated all the pgd entries. The above - * p4d_alloc() would never do anything and the p4d_populate() would - * be done to a p4d already mapped in the userspace pgd. - */ #ifdef CONFIG_PAGE_TABLE_ISOLATION - if (CONFIG_PGTABLE_LEVELS <= 4) { - set_pgd(kernel_to_user_pgdp(pgd), - __pgd(_KERNPG_TABLE | (p4d_pfn(*p4d) << PAGE_SHIFT))); - } + /* Install the espfix pud into user space page tables too */ + pgd = kernel_to_user_pgdp(pgd); + p4d = p4d_alloc(&init_mm, pgd, ESPFIX_BASE_ADDR); + p4d_populate(&init_mm, p4d, espfix_pud_page); #endif /* Randomize the locations */ -- Kirill A. Shutemov