From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752352AbdLHUVw (ORCPT ); Fri, 8 Dec 2017 15:21:52 -0500 Received: from mga02.intel.com ([134.134.136.20]:55369 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750908AbdLHUVt (ORCPT ); Fri, 8 Dec 2017 15:21:49 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,378,1508828400"; d="scan'208,223";a="16680794" Subject: Re: [RFC PTI 1/3] x86/pti: Vastly simplify pgd synchronization To: Andy Lutomirski , x86@kernel.org References: <66878233e09ff325b018e1bc5a521e9b20c58214.1512763129.git.luto@kernel.org> Cc: linux-kernel@vger.kernel.org, Borislav Petkov , Brian Gerst , David Laight , Kees Cook , Peter Zijlstra From: Dave Hansen Message-ID: <155be67c-e0b8-2416-8631-91936284216a@intel.com> Date: Fri, 8 Dec 2017 12:17:34 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <66878233e09ff325b018e1bc5a521e9b20c58214.1512763129.git.luto@kernel.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >>From a high level, what finally allowed this to happen? Because kpti_add_user_map() all went away, including the LDT one? > + if (pgdp_maps_userspace(pgdp)) { > /* > + * The user page tables get the full PGD, > + * accessible from userspace: > */ > + kernel_to_user_pgdp(pgdp)->pgd = pgd.pgd; > + > + /* > + * If this is normal user memory, make it NX in the kernel > + * pagetables so that, if we somehow screw up and return to > + * usermode with the kernel CR3 loaded, we'll get a page > + * fault instead of allowing user code to execute with > + * the wrong CR3. > + * > + * As exceptions, we don't set NX if: > + * - this is EFI or similar, the kernel may execute from it > + * - we don't have NX support > + * - we're clearing the PGD (i.e. pgd.pgd == 0). > + */ > + if ((pgd.pgd & _PAGE_USER) && (__supported_pte_mask & _PAGE_NX)) > + pgd.pgd |= _PAGE_NX; I scratched my head for a sec to realize why you didn't need an explicit pgd.pgd==0 check. It's part of the _PAGE_USER check, which is a bit confusing. Could we do: if ((pgd.pgd & (_PAGE_USER|_PAGE_PRESENT)) && (__supported_pte_mask & _PAGE_NX)) And change the comment: * As exceptions, we don't set NX fo: * - PGDs without _PAGE_USER: Assume this is for a weird in-kernel * user like EFI from which we may need to execute. * - PGDs withoout _PAGE_PRESENT: PGD is being cleared, must * not set _PAGE_NX * - we don't have NX support > } else { > /* > + * Changes to the high (kernel) portion of the kernelmode > + * page tables are not automatically propagated to the > + * usermode tables. > + * > + * Users should keep in mind that, unlike the kernelmode > + * tables, there is no vmalloc_fault equivalent for the > + * usermode tables. Top-level entries added to init_mm's > + * usermode pgd after boot will not be automatically > + * propagated to other mms. > */ > - WARN_ON_ONCE(system_state == SYSTEM_RUNNING); > } > #endif How does the VSYSCALL page get into the user page tables now?