lkml.org 
[lkml]   [2017]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 41/43] x86/mm/kaiser: Un-poison PGDs at runtime
    Date
    From: Dave Hansen <dave.hansen@linux.intel.com>

    With KAISER Kernel PGDs that map userspace are "poisoned" with
    the NX bit. This ensures that if a kernel->user CR3 switch is
    missed, userspace crashes instead of running in an unhardened
    state.

    This code will be needed in a moment when KAISER is turned
    on and off at runtime.

    Note that an __ASSEMBLY__ #ifdef is now required since kaiser.h
    is indirectly included into assembly.

    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Daniel Gruss <daniel.gruss@iaik.tugraz.at>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Kees Cook <keescook@google.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Michael Schwarz <michael.schwarz@iaik.tugraz.at>
    Cc: Moritz Lipp <moritz.lipp@iaik.tugraz.at>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Richard Fellner <richard.fellner@student.tugraz.at>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-mm@kvack.org
    Link: http://lkml.kernel.org/r/20171123003521.A90AC3AF@viggo.jf.intel.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    ---
    arch/x86/include/asm/pgtable_64.h | 16 +++++++++++++++-
    arch/x86/mm/kaiser.c | 38 ++++++++++++++++++++++++++++++++++++++
    include/linux/kaiser.h | 3 ++-
    3 files changed, 55 insertions(+), 2 deletions(-)

    diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
    index c239839e92bd..89bde2091af1 100644
    --- a/arch/x86/include/asm/pgtable_64.h
    +++ b/arch/x86/include/asm/pgtable_64.h
    @@ -3,6 +3,7 @@
    #define _ASM_X86_PGTABLE_64_H

    #include <linux/const.h>
    +#include <linux/kaiser.h>
    #include <asm/pgtable_64_types.h>

    #ifndef __ASSEMBLY__
    @@ -199,6 +200,18 @@ static inline bool pgd_userspace_access(pgd_t pgd)
    return pgd.pgd & _PAGE_USER;
    }

    +static inline void kaiser_poison_pgd(pgd_t *pgd)
    +{
    + if (pgd->pgd & _PAGE_PRESENT)
    + pgd->pgd |= _PAGE_NX;
    +}
    +
    +static inline void kaiser_unpoison_pgd(pgd_t *pgd)
    +{
    + if (pgd->pgd & _PAGE_PRESENT)
    + pgd->pgd &= ~_PAGE_NX;
    +}
    +
    /*
    * Take a PGD location (pgdp) and a pgd value that needs
    * to be set there. Populates the shadow and returns
    @@ -222,7 +235,8 @@ static inline pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
    * wrong CR3 value, userspace will crash
    * instead of running.
    */
    - pgd.pgd |= _PAGE_NX;
    + if (kaiser_active())
    + kaiser_poison_pgd(&pgd);
    }
    } else if (pgd_userspace_access(*pgdp)) {
    /*
    diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
    index 968d5b62d597..06966b111280 100644
    --- a/arch/x86/mm/kaiser.c
    +++ b/arch/x86/mm/kaiser.c
    @@ -501,6 +501,9 @@ static ssize_t kaiser_enabled_write_file(struct file *file,
    if (enable > 1)
    return -EINVAL;

    + if (kaiser_enabled == enable)
    + return count;
    +
    WRITE_ONCE(kaiser_enabled, enable);
    return count;
    }
    @@ -518,3 +521,38 @@ static int __init create_kaiser_enabled(void)
    return 0;
    }
    late_initcall(create_kaiser_enabled);
    +
    +enum poison {
    + KAISER_POISON,
    + KAISER_UNPOISON
    +};
    +void kaiser_poison_pgd_page(pgd_t *pgd_page, enum poison do_poison)
    +{
    + int i = 0;
    +
    + for (i = 0; i < PTRS_PER_PGD; i++) {
    + pgd_t *pgd = &pgd_page[i];
    +
    + /* Stop once we hit kernel addresses: */
    + if (!pgdp_maps_userspace(pgd))
    + break;
    +
    + if (do_poison == KAISER_POISON)
    + kaiser_poison_pgd(pgd);
    + else
    + kaiser_unpoison_pgd(pgd);
    + }
    +
    +}
    +
    +void kaiser_poison_pgds(enum poison do_poison)
    +{
    + struct page *page;
    +
    + spin_lock(&pgd_lock);
    + list_for_each_entry(page, &pgd_list, lru) {
    + pgd_t *pgd = (pgd_t *)page_address(page);
    + kaiser_poison_pgd_page(pgd, do_poison);
    + }
    + spin_unlock(&pgd_lock);
    +}
    diff --git a/include/linux/kaiser.h b/include/linux/kaiser.h
    index a3d28d00d555..83d465599646 100644
    --- a/include/linux/kaiser.h
    +++ b/include/linux/kaiser.h
    @@ -4,7 +4,7 @@
    #ifdef CONFIG_KAISER
    #include <asm/kaiser.h>
    #else
    -
    +#ifndef __ASSEMBLY__
    /*
    * These stubs are used whenever CONFIG_KAISER is off, which
    * includes architectures that support KAISER, but have it
    @@ -33,5 +33,6 @@ static inline bool kaiser_active(void)
    {
    return 0;
    }
    +#endif /* __ASSEMBLY__ */
    #endif /* !CONFIG_KAISER */
    #endif /* _INCLUDE_KAISER_H */
    --
    2.14.1
    \
     
     \ /
      Last update: 2017-11-24 10:21    [W:3.285 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site