From: Andy Lutomirski <luto@amacapital.net>
To: Nadav Amit <namit@vmware.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Andy Lutomirski <luto@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
the arch/x86 maintainers <x86@kernel.org>, "w@1wt.eu" <w@1wt.eu>
Subject: Re: [RFC] x86: Avoid CR3 load on compatibility mode with PTI
Date: Mon, 15 Jan 2018 09:45:04 -0800 [thread overview]
Message-ID: <3A5624D6-3D7B-4C32-BF97-27A78CBEE14E@amacapital.net> (raw)
In-Reply-To: <451AD6CB-74AA-4869-8CB1-8175126C3F0D@vmware.com>
> On Jan 15, 2018, at 9:42 AM, Nadav Amit <namit@vmware.com> wrote:
>
> Andy Lutomirski <luto@amacapital.net> wrote:
>
>>
>>> On Jan 14, 2018, at 12:13 PM, Nadav Amit <namit@vmware.com> wrote:
>>>
>>> Currently, when page-table isolation is on to prevent the Meltdown bug
>>> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt.
>>>
>>> However, it appears that this is an unnecessary measure when programs
>>> run in compatibility mode. In this mode only 32-bit registers are
>>> available, which means that there *should* be no way for the CPU to
>>> access, even speculatively, memory that belongs to the kernel, which
>>> sits in high addresses.
>>
>> You're assuming that TIF_IA32 prevents the execution of 64-bit code. It doesn't.
>>
>> I've occasionally considered adding an opt-in hardening mechanism to enforce 32-bit or 64-bit execution, but we don't have this now.
>
> I noticed it doesn’t. I thought the removing/restoring the __USER_CS
> descriptor on context switch, based on TIF_IA32, would be enough.
> modify_ldt() always keeps the descriptor l-bit clear. I will review the
> other GDT descriptors, and if needed, create two GDTs. Let me know if I
> missed anything else.
There world need to be some opt-in control, I think, for CRIU if nothing else.
Also, on Xen PV, it's a complete nonstarter. We don't have enough control over the GDT unless someone knows otherwise. But there's no PTI on Xen PV either.
>
>> Anything like this would also need to spend on SMEP, I think -- the pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I think.
>
> If SMEP is not supported, compatibility mode would still require page-table
> isolation.
>
> Thanks for the feedback. I still look for an ack for the basic idea of
> disabling page-table isolation on compatibility mode.
>
I'm still not really convinced this is worth it. It will send a bad message and get people to run critical stuff compiled for 32-bit, which has its own downsides.
> Regards,
> Nadav
next prev parent reply other threads:[~2018-01-15 17:45 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-14 20:13 [RFC] x86: Avoid CR3 load on compatibility mode with PTI Nadav Amit
2018-01-15 17:20 ` Andy Lutomirski
2018-01-15 17:42 ` Nadav Amit
2018-01-15 17:45 ` Andy Lutomirski [this message]
2018-01-15 17:50 ` Nadav Amit
2018-01-15 18:04 ` Andy Lutomirski
2018-01-15 18:50 ` Nadav Amit
2018-01-15 19:49 ` Dave Hansen
2018-01-15 19:52 ` Willy Tarreau
2018-01-15 20:09 ` Nadav Amit
2018-01-16 0:41 ` Ingo Molnar
2018-01-16 3:49 ` Nadav Amit
2018-01-20 14:26 ` Ingo Molnar
2018-01-20 16:31 ` Willy Tarreau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3A5624D6-3D7B-4C32-BF97-27A78CBEE14E@amacapital.net \
--to=luto@amacapital.net \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=namit@vmware.com \
--cc=tglx@linutronix.de \
--cc=w@1wt.eu \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).