From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757131AbdLQLJi (ORCPT ); Sun, 17 Dec 2017 06:09:38 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:36153 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751398AbdLQLJh (ORCPT ); Sun, 17 Dec 2017 06:09:37 -0500 X-Google-Smtp-Source: ACJfBotq2LPebCnQeRkm6G16PnpQ8EfQnDfYCkZto3iSh1rkKPUhc7UCf+wUUjnudLh7UCLqcDIAOA== Date: Sun, 17 Dec 2017 14:09:34 +0300 From: "Kirill A. Shutemov" To: Thomas Gleixner Cc: LKML , x86@kernel.org, Linus Torvalds , Andy Lutomirsky , Peter Zijlstra , Dave Hansen , Borislav Petkov , Greg KH , keescook@google.com, hughd@google.com, Brian Gerst , Josh Poimboeuf , Denys Vlasenko , Rik van Riel , Boris Ostrovsky , Juergen Gross , David Laight , Eduardo Valentin , aliguori@amazon.com, Will Deacon , daniel.gruss@iaik.tugraz.at, Kees Cook , Borislav Petkov Subject: Re: [patch V149 38/50] x86/pti: Put the LDT in its own PGD if PTI is on Message-ID: <20171217110934.f34h6i6yht5vpe4f@node.shutemov.name> References: <20171216212354.120930222@linutronix.de> <20171216213139.549001406@linutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171216213139.549001406@linutronix.de> User-Agent: NeoMutt/20171208 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Dec 16, 2017 at 10:24:32PM +0100, Thomas Gleixner wrote: > From: Andy Lutomirski > > With PTI enabled, the LDT must be mapped in the usermode tables somewhere. > The LDT is per process, i.e. per mm. > > An earlier approach mapped the LDT on context switch into a fixmap area, > but that's a big overhead and exhausted the fixmap space when NR_CPUS got > big. > > Take advantage of the fact that there is an address space hole which > provides a completely unused pgd. Use this pgd to manage per-mm LDT > mappings. > > This has a down side: the LDT isn't (currently) randomized, and an attack > that can write the LDT is instant root due to call gates (thanks, AMD, for > leaving call gates in AMD64 but designing them wrong so they're only useful > for exploits). This can be mitigated by making the LDT read-only or > randomizing the mapping, either of which is strightforward on top of this > patch. > > This will significantly slow down LDT users, but that shouldn't matter for > important workloads -- the LDT is only used by DOSEMU(2), Wine, and very > old libc implementations. > > [ tglx: Decrapified it ] > > Signed-off-by: Andy Lutomirski > Signed-off-by: Thomas Gleixner > Cc: Kees Cook > Cc: Peter Zijlstra > Cc: Brian Gerst > Cc: Dave Hansen > Cc: David Laight > Cc: Borislav Petkov > Cc: "Kirill A. Shutemov" > > --- > Documentation/x86/x86_64/mm.txt | 3 > arch/x86/include/asm/mmu_context.h | 55 +++++++++++- > arch/x86/include/asm/pgtable_64_types.h | 4 > arch/x86/include/asm/processor.h | 23 +++-- > arch/x86/kernel/ldt.c | 139 +++++++++++++++++++++++++++++++- > arch/x86/mm/dump_pagetables.c | 12 ++ > 6 files changed, 219 insertions(+), 17 deletions(-) > > --- a/Documentation/x86/x86_64/mm.txt > +++ b/Documentation/x86/x86_64/mm.txt > @@ -12,6 +12,7 @@ ffffea0000000000 - ffffeaffffffffff (=40 > ... unused hole ... > ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB) > ... unused hole ... > +fffffe8000000000 - fffffeffffffffff (=39 bits) LDT remap for PTI > ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks > ... unused hole ... > ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space > @@ -28,7 +29,7 @@ ffffffffffe00000 - ffffffffffffffff (=2 > hole caused by [56:63] sign extension > ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor > ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory > -ff90000000000000 - ff9fffffffffffff (=52 bits) hole > +ff90000000000000 - ff9fffffffffffff (=49 bits) LDT remap for PTI +ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI -- Kirill A. Shutemov