lkml.org 
[lkml]   [2018]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC] x86: Avoid CR3 load on compatibility mode with PTI
From
Date


> On Jan 15, 2018, at 9:42 AM, Nadav Amit <namit@vmware.com> wrote:
>
> Andy Lutomirski <luto@amacapital.net> wrote:
>
>>
>>> On Jan 14, 2018, at 12:13 PM, Nadav Amit <namit@vmware.com> wrote:
>>>
>>> Currently, when page-table isolation is on to prevent the Meltdown bug
>>> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt.
>>>
>>> However, it appears that this is an unnecessary measure when programs
>>> run in compatibility mode. In this mode only 32-bit registers are
>>> available, which means that there *should* be no way for the CPU to
>>> access, even speculatively, memory that belongs to the kernel, which
>>> sits in high addresses.
>>
>> You're assuming that TIF_IA32 prevents the execution of 64-bit code. It doesn't.
>>
>> I've occasionally considered adding an opt-in hardening mechanism to enforce 32-bit or 64-bit execution, but we don't have this now.
>
> I noticed it doesn’t. I thought the removing/restoring the __USER_CS
> descriptor on context switch, based on TIF_IA32, would be enough.
> modify_ldt() always keeps the descriptor l-bit clear. I will review the
> other GDT descriptors, and if needed, create two GDTs. Let me know if I
> missed anything else.

There world need to be some opt-in control, I think, for CRIU if nothing else.

Also, on Xen PV, it's a complete nonstarter. We don't have enough control over the GDT unless someone knows otherwise. But there's no PTI on Xen PV either.

>
>> Anything like this would also need to spend on SMEP, I think -- the pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I think.
>
> If SMEP is not supported, compatibility mode would still require page-table
> isolation.
>
> Thanks for the feedback. I still look for an ack for the basic idea of
> disabling page-table isolation on compatibility mode.
>

I'm still not really convinced this is worth it. It will send a bad message and get people to run critical stuff compiled for 32-bit, which has its own downsides.

> Regards,
> Nadav

\
 
 \ /
  Last update: 2018-01-15 18:45    [W:0.079 / U:4.480 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site