linux-kernel - Re: [PATCH v10 09/12] arch/x86: enable task isolation functionality

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 2 Mar 2016 16:36:54 -0800
From:	Andy Lutomirski <luto@...capital.net>
To:	Chris Metcalf <cmetcalf@...hip.com>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Christoph Lameter <cl@...ux.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Viresh Kumar <viresh.kumar@...aro.org>,
	Ingo Molnar <mingo@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Tejun Heo <tj@...nel.org>,
	Gilad Ben Yossef <giladb@...hip.com>,
	Will Deacon <will.deacon@....com>,
	Rik van Riel <riel@...hat.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	X86 ML <x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
	Catalin Marinas <catalin.marinas@....com>,
	Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH v10 09/12] arch/x86: enable task isolation functionality

On Mar 2, 2016 12:10 PM, "Chris Metcalf" <cmetcalf@...hip.com> wrote:
>
> In prepare_exit_to_usermode(), call task_isolation_ready()
> when we are checking the thread-info flags, and after we've handled
> the other work, call task_isolation_enter() unconditionally.
>
> In syscall_trace_enter_phase1(), we add the necessary support for
> strict-mode detection of syscalls.
>
> We add strict reporting for the kernel exception types that do
> not result in signals, namely non-signalling page faults and
> non-signalling MPX fixups.
>
> Signed-off-by: Chris Metcalf <cmetcalf@...hip.com>
> ---
>  arch/x86/entry/common.c | 18 ++++++++++++++++--
>  arch/x86/kernel/traps.c |  2 ++
>  arch/x86/mm/fault.c     |  2 ++
>  3 files changed, 20 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
> index 03663740c866..27c71165416b 100644
> --- a/arch/x86/entry/common.c
> +++ b/arch/x86/entry/common.c
> @@ -21,6 +21,7 @@
>  #include <linux/context_tracking.h>
>  #include <linux/user-return-notifier.h>
>  #include <linux/uprobes.h>
> +#include <linux/isolation.h>
>
>  #include <asm/desc.h>
>  #include <asm/traps.h>
> @@ -91,6 +92,10 @@ unsigned long syscall_trace_enter_phase1(struct pt_regs *regs, u32 arch)
>          */
>         if (work & _TIF_NOHZ) {
>                 enter_from_user_mode();
> +               if (task_isolation_check_syscall(regs->orig_ax)) {
> +                       regs->orig_ax = -1;
> +                       return 0;
> +               }

This needs a comment indicating the intended semantics.

And I've still heard no explanation of why this part can't use seccomp.

>                 work &= ~_TIF_NOHZ;
>         }
>  #endif
> @@ -254,17 +259,26 @@ static void exit_to_usermode_loop(struct pt_regs *regs, u32 cached_flags)
>                 if (cached_flags & _TIF_USER_RETURN_NOTIFY)
>                         fire_user_return_notifiers();
>
> +               task_isolation_enter();
> +
>                 /* Disable IRQs and retry */
>                 local_irq_disable();
>
>                 cached_flags = READ_ONCE(pt_regs_to_thread_info(regs)->flags);
>
> -               if (!(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS))
> +               if (!(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS) &&
> +                   task_isolation_ready())
>                         break;
>
>         }
>  }
>
> +#ifdef CONFIG_TASK_ISOLATION
> +# define EXIT_TO_USERMODE_FLAGS (EXIT_TO_USERMODE_LOOP_FLAGS | _TIF_NOHZ)
> +#else
> +# define EXIT_TO_USERMODE_FLAGS EXIT_TO_USERMODE_LOOP_FLAGS
> +#endif
> +

TIF_NOHZ is already a hack and IMO this just makes it worse.  At the
very least this should have a comment.  It really ought to be either a
static_branch or a flag that's actually switched per cpu.

But this is also a confusing change.  Don't override the definition
here -- stick it in the header where it belongs.