linux-kernel - [PATCH RFC v2 0/6] x86: Disabling PTI in compatibility mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Feb 2018 08:35:56 -0800
From:   Nadav Amit <namit@...are.com>
To:     Ingo Molnar <mingo@...hat.com>
CC:     Thomas Gleixner <tglx@...utronix.de>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Willy Tarreau <w@....eu>, Nadav Amit <nadav.amit@...il.com>,
        <x86@...nel.org>, <linux-kernel@...r.kernel.org>,
        Nadav Amit <namit@...are.com>
Subject: [PATCH RFC v2 0/6] x86: Disabling PTI in compatibility mode

Compatibility mode should be safe of Meltdown, since the pointers are only
32-bit long.  This can allow us to disable PTI selectively as long as x86-32
processes are running and to enable global pages throughout this time. These
patches may also be a basis for later disabling PTI selectively for "trusted"
processes.

The patches are marked as an RFC since they (specifically the last one) do not
coexist with Dave Hansen's enabling of global pages, and might have conflicts
with Joerg's work on 32-bit (although in this case, it should be easily
resolvable). They are also based on Linux 4.15.

I removed the PTI disabling while SMEP is unsupported, although I must admit I
did not fully understand why it is required. IIUC, Intel's indirect branch
prediction only predicts the low 32-bits of the target, which would still not
allow to manipulate the kernel to jump to userspace code through Spectre v2.

RFC v1 -> RFC v2:
- Handling the use of CS64 in compatibility mode (Andy)
- Holding the PTI disable indication per mm and not task (Andy)
- No PTI disabling if SMEP is unsupported (Dave, Ingo)
- Self-test and cleanup
- Enabling global pages while running in compatibility mode

Nadav Amit (6):
  x86: Skip PTI when disable indication is set
  x86: Save pti_disable for each mm_context
  x86: Switching page-table isolation
  x86: Disable PTI on compatibility mode
  x86: Use global pages when PTI is disabled
  selftest: x86: test using CS64 on compatibility-mode

 arch/x86/entry/calling.h              |  33 ++++++++
 arch/x86/include/asm/mmu.h            |   3 +
 arch/x86/include/asm/pti.h            |  70 +++++++++++++++++
 arch/x86/include/asm/tlbflush.h       |  35 ++++++++-
 arch/x86/kernel/asm-offsets.c         |   1 +
 arch/x86/kernel/process_64.c          |  13 +++-
 arch/x86/kernel/traps.c               |  23 +++++-
 arch/x86/mm/init.c                    |  14 ++--
 arch/x86/mm/pgtable.c                 |   4 +-
 arch/x86/mm/pti.c                     | 139 +++++++++++++++++++++++++++++++++-
 arch/x86/mm/tlb.c                     |  28 ++++++-
 tools/testing/selftests/x86/ldt_gdt.c |  41 ++++++++++
 12 files changed, 386 insertions(+), 18 deletions(-)

-- 
2.14.1