[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <451AD6CB-74AA-4869-8CB1-8175126C3F0D@vmware.com>
Date: Mon, 15 Jan 2018 17:42:04 +0000
From: Nadav Amit <namit@...are.com>
To: Andy Lutomirski <luto@...capital.net>
CC: LKML <linux-kernel@...r.kernel.org>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Andy Lutomirski <luto@...nel.org>,
"Thomas Gleixner" <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>,
"H. Peter Anvin" <hpa@...or.com>,
the arch/x86 maintainers <x86@...nel.org>,
"w@....eu" <w@....eu>
Subject: Re: [RFC] x86: Avoid CR3 load on compatibility mode with PTI
Andy Lutomirski <luto@...capital.net> wrote:
>
>> On Jan 14, 2018, at 12:13 PM, Nadav Amit <namit@...are.com> wrote:
>>
>> Currently, when page-table isolation is on to prevent the Meltdown bug
>> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt.
>>
>> However, it appears that this is an unnecessary measure when programs
>> run in compatibility mode. In this mode only 32-bit registers are
>> available, which means that there *should* be no way for the CPU to
>> access, even speculatively, memory that belongs to the kernel, which
>> sits in high addresses.
>
> You're assuming that TIF_IA32 prevents the execution of 64-bit code. It doesn't.
>
> I've occasionally considered adding an opt-in hardening mechanism to enforce 32-bit or 64-bit execution, but we don't have this now.
I noticed it doesn’t. I thought the removing/restoring the __USER_CS
descriptor on context switch, based on TIF_IA32, would be enough.
modify_ldt() always keeps the descriptor l-bit clear. I will review the
other GDT descriptors, and if needed, create two GDTs. Let me know if I
missed anything else.
> Anything like this would also need to spend on SMEP, I think -- the pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I think.
If SMEP is not supported, compatibility mode would still require page-table
isolation.
Thanks for the feedback. I still look for an ack for the basic idea of
disabling page-table isolation on compatibility mode.
Regards,
Nadav
Powered by blists - more mailing lists