linux-kernel - Re: [PATCH 12/16] x86/mm/pae: Populate the user page-table with user pgd's

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <df637ada-c2f6-c137-0287-0964e29fc11f@intel.com>
Date:   Tue, 16 Jan 2018 10:11:14 -0800
From:   Dave Hansen <dave.hansen@...el.com>
To:     Joerg Roedel <joro@...tes.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        "H . Peter Anvin" <hpa@...or.com>
Cc:     x86@...nel.org, linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Andy Lutomirski <luto@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Juergen Gross <jgross@...e.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Borislav Petkov <bp@...en8.de>, Jiri Kosina <jkosina@...e.cz>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Brian Gerst <brgerst@...il.com>,
        David Laight <David.Laight@...lab.com>,
        Denys Vlasenko <dvlasenk@...hat.com>,
        Eduardo Valentin <eduval@...zon.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        Will Deacon <will.deacon@....com>, aliguori@...zon.com,
        daniel.gruss@...k.tugraz.at, hughd@...gle.com, keescook@...gle.com,
        Andrea Arcangeli <aarcange@...hat.com>,
        Waiman Long <llong@...hat.com>, jroedel@...e.de
Subject: Re: [PATCH 12/16] x86/mm/pae: Populate the user page-table with user
 pgd's

On 01/16/2018 08:36 AM, Joerg Roedel wrote:
> +#ifdef CONFIG_X86_64
>  	/*
>  	 * If this is normal user memory, make it NX in the kernel
>  	 * pagetables so that, if we somehow screw up and return to
> @@ -134,10 +135,16 @@ pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
>  	 *     may execute from it
>  	 *  - we don't have NX support
>  	 *  - we're clearing the PGD (i.e. the new pgd is not present).
> +	 *  - We run on a 32 bit kernel. 2-level paging doesn't support NX at
> +	 *    all and PAE paging does not support it on the PGD level. We can
> +	 *    set it in the PMD level there in the future, but that means we
> +	 *    need to unshare the PMDs between the kernel and the user
> +	 *    page-tables.
>  	 */
>  	if ((pgd.pgd & (_PAGE_USER|_PAGE_PRESENT)) == (_PAGE_USER|_PAGE_PRESENT) &&
>  	    (__supported_pte_mask & _PAGE_NX))
>  		pgd.pgd |= _PAGE_NX;
> +#endif

Ugh.  The ghosts of PAE have come back to haunt us.

Could we do:

static inline bool pgd_supports_nx(unsigned long)
{
#ifdef CONFIG_X86_64
	return (__supported_pte_mask & _PAGE_NX);
#else
	/* No 32-bit page tables support NX at PGD level */
	return 0;
#endif
}

Nobody will ever spot the #ifdef the way you laid it out.