From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752101AbdKZWli (ORCPT <rfc822;w@1wt.eu>);
        Sun, 26 Nov 2017 17:41:38 -0500
Received: from Galois.linutronix.de ([146.0.238.70]:52765 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751858AbdKZWlh (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Sun, 26 Nov 2017 17:41:37 -0500
Date: Sun, 26 Nov 2017 23:41:26 +0100 (CET)
From: Thomas Gleixner <tglx@linutronix.de>
To: Borislav Petkov <bp@alien8.de>
cc: Ingo Molnar <mingo@kernel.org>, linux-kernel@vger.kernel.org,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Andy Lutomirski <luto@amacapital.net>,
        "H . Peter Anvin" <hpa@zytor.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [PATCH 25/43] x86/mm/kaiser: Unmap kernel from userspace page
 tables (core patch), noexec=off
In-Reply-To: <20171126222558.wkdrsp2laxmsmoib@pd.tnic>
Message-ID: <alpine.DEB.2.20.1711262339070.2316@nanos>
References: <20171124172411.19476-1-mingo@kernel.org> <20171124172411.19476-26-mingo@kernel.org> <20171126222558.wkdrsp2laxmsmoib@pd.tnic>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
X-Linutronix-Spam-Score: -1.0
X-Linutronix-Spam-Level: -
X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required,  ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, 26 Nov 2017, Borislav Petkov wrote:
> On Fri, Nov 24, 2017 at 06:23:53PM +0100, Ingo Molnar wrote:
> > + * Take a PGD location (pgdp) and a pgd value that needs
> > + * to be set there.  Populates the shadow and returns
> > + * the resulting PGD that must be set in the kernel copy
> > + * of the page tables.
> > + */
> > +static inline pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
> > +{
> > +#ifdef CONFIG_KAISER
> > +	if (pgd_userspace_access(pgd)) {
> > +		if (pgdp_maps_userspace(pgdp)) {
> > +			/*
> > +			 * The user/shadow page tables get the full
> > +			 * PGD, accessible from userspace:
> > +			 */
> > +			kernel_to_shadow_pgdp(pgdp)->pgd = pgd.pgd;
> > +			/*
> > +			 * For the copy of the pgd that the kernel
> > +			 * uses, make it unusable to userspace.  This
> > +			 * ensures if we get out to userspace with the
> > +			 * wrong CR3 value, userspace will crash
> > +			 * instead of running.
> > +			 */
> > +			pgd.pgd |= _PAGE_NX;
> 
> Lemme hold this down here so that we don't forget (and tglx is working on it
> already... ):

A worse problem exists vs. PAGE_GLOBAL. Its enforced by KAISER
unconditionally... Fixes are posted soon as an update to the series I sent
earlier today.

> So we need to handle the case where we boot with "noexec=off" and thus
> clear _PAGE_NX from __supported_pte_mask. I'd vouch for a conservative
> solution where we warn if _PAGE_NX is not set in __supported_pte_mask
> and thus at least tell the user that she shouldn't do noexec kernels and
> expect kaiser protection...

Let me add that.

Thanks,

	tglx