Messages in this thread | | | From | Nadav Amit <> | Subject | Re: [RFC] x86: Avoid CR3 load on compatibility mode with PTI | Date | Mon, 15 Jan 2018 17:42:04 +0000 |
| |
Andy Lutomirski <luto@amacapital.net> wrote:
> >> On Jan 14, 2018, at 12:13 PM, Nadav Amit <namit@vmware.com> wrote: >> >> Currently, when page-table isolation is on to prevent the Meltdown bug >> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt. >> >> However, it appears that this is an unnecessary measure when programs >> run in compatibility mode. In this mode only 32-bit registers are >> available, which means that there *should* be no way for the CPU to >> access, even speculatively, memory that belongs to the kernel, which >> sits in high addresses. > > You're assuming that TIF_IA32 prevents the execution of 64-bit code. It doesn't. > > I've occasionally considered adding an opt-in hardening mechanism to enforce 32-bit or 64-bit execution, but we don't have this now.
I noticed it doesn’t. I thought the removing/restoring the __USER_CS descriptor on context switch, based on TIF_IA32, would be enough. modify_ldt() always keeps the descriptor l-bit clear. I will review the other GDT descriptors, and if needed, create two GDTs. Let me know if I missed anything else.
> Anything like this would also need to spend on SMEP, I think -- the pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I think.
If SMEP is not supported, compatibility mode would still require page-table isolation.
Thanks for the feedback. I still look for an ack for the basic idea of disabling page-table isolation on compatibility mode.
Regards, Nadav | |