linux-kernel - Re: [patch V163 27/51] x86/mm/pti: Populate user PGD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d1bc7deb-3bad-6787-5b99-6ef84f37efd0@suse.com>
Date:   Wed, 20 Dec 2017 17:26:20 +0100
From:   Juergen Gross <jgross@...e.com>
To:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Dave Hansen <dave.hansen@...el.com>,
        LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Andy Lutomirsky <luto@...nel.org>,
        Borislav Petkov <bpetkov@...e.de>,
        Greg KH <gregkh@...uxfoundation.org>, keescook@...gle.com,
        hughd@...gle.com, Brian Gerst <brgerst@...il.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Denys Vlasenko <dvlasenk@...hat.com>,
        Rik van Riel <riel@...hat.com>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        David Laight <David.Laight@...lab.com>,
        Eduardo Valentin <eduval@...zon.com>, aliguori@...zon.com,
        Will Deacon <will.deacon@....com>, daniel.gruss@...k.tugraz.at,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Borislav Petkov <bp@...e.de>, "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [patch V163 27/51] x86/mm/pti: Populate user PGD

On 20/12/17 01:22, Thomas Gleixner wrote:
> On Tue, 19 Dec 2017, Thomas Gleixner wrote:
>> On Tue, 19 Dec 2017, Ingo Molnar wrote:
>> We don't run out of space, but the 0-day robot triggered a nasty issue.
>>
>> The fixmap bottom address, which contains the early_ioremap fixmap area, is:
>>
>>     vaddr_bt = FIXADDR_TOP - FIX_BTMAP_BEGIN * PAGE_SIZE
>>
>> If that address is lower than:
>>
>>     vaddr_end = __START_KERNEL_map + KERNEL_IMAGE_SIZE;
>>
>> then cleanup_highmap() will happily 0 out the PMD entry for the PTE page of
>> FIX_BTMAP. That entry was set up earlier in early_ioremap_init().
>>
>> As a consequence the first call to __early_set_fixmap() which tries to
>> install a PTE for early_ioremap() will crash and burn.
>>
>> Below is a nasty hack which fixes the problem. Ideally we get all of this
>> cpu_entry_stuff out of the fixmap. I'll look into that later, but for now
>> the patch 'fixes' the issue.
> 
> I had a stab on moving the cpu_entry_area to some other place.
> 
> The patch below works, but:
> 
>  - it breaks i386 build because I have not yet found a way to place the
>    CPU_ENTRY_AREA_BASE without creating include recursion hell
> 
>  - it probably does not work on XEN_PV, but I'm too tired now to figure
>    that out.

The attached patch lets the system come up as XEN_PV.


Juergen

View attachment "vsyscall.patch" of type "text/x-patch" (992 bytes)