linux-kernel - Re: [PATCH 04/30] x86, kaiser: disable global pages by default with KAISER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Nov 2017 14:38:45 -0500
From:   Rik van Riel <riel@...hat.com>
To:     Dave Hansen <dave.hansen@...ux.intel.com>,
        linux-kernel@...r.kernel.org
Cc:     linux-mm@...ck.org, bp@...e.de, tglx@...utronix.de,
        moritz.lipp@...k.tugraz.at, daniel.gruss@...k.tugraz.at,
        michael.schwarz@...k.tugraz.at, richard.fellner@...dent.tugraz.at,
        luto@...nel.org, torvalds@...ux-foundation.org,
        keescook@...gle.com, hughd@...gle.com, x86@...nel.org
Subject: Re: [PATCH 04/30] x86, kaiser: disable global pages by default with
 KAISER

On Fri, 2017-11-10 at 11:31 -0800, Dave Hansen wrote:
> From: Dave Hansen <dave.hansen@...ux.intel.com>
> 
> Global pages stay in the TLB across context switches.  Since all
> contexts
> share the same kernel mapping, these mappings are marked as global
> pages
> so kernel entries in the TLB are not flushed out on a context switch.
> 
> But, even having these entries in the TLB opens up something that an
> attacker can use [1].
> 
> That means that even when KAISER switches page tables on return to
> user
> space the global pages would stay in the TLB cache.
> 
> Disable global pages so that kernel TLB entries can be flushed before
> returning to user space. This way, all accesses to kernel addresses
> from
> userspace result in a TLB miss independent of the existence of a
> kernel
> mapping.
> 
> Replace _PAGE_GLOBAL by __PAGE_KERNEL_GLOBAL and keep _PAGE_GLOBAL
> available so that it can still be used for a few selected kernel
> mappings
> which must be visible to userspace, when KAISER is enabled, like the
> entry/exit code and data.

Nice changelog.

Why am I pointing this out?

> +++ b/arch/x86/include/asm/pgtable_types.h	2017-11-10
> 11:22:06.626244956 -0800
> @@ -179,8 +179,20 @@ enum page_cache_mode {
>  #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT |
> _PAGE_USER |	\
>  					 _PAGE_ACCESSED)
>  
> +/*
> + * Disable global pages for anything using the default
> + * __PAGE_KERNEL* macros.  PGE will still be enabled
> + * and _PAGE_GLOBAL may still be used carefully.
> + */
> +#ifdef CONFIG_KAISER
> +#define __PAGE_KERNEL_GLOBAL	0
> +#else
> +#define __PAGE_KERNEL_GLOBAL	_PAGE_GLOBAL
> +#endif
> +					

The comment above could use a little more info
on why things are done that way, though :)

-- 
All rights reversed
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)