From: Andy Lutomirski <luto@kernel.org>
To: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
richard.fellner@student.tugraz.at, moritz.lipp@iaik.tugraz.at,
Daniel Gruss <daniel.gruss@iaik.tugraz.at>,
michael.schwarz@iaik.tugraz.at,
Linus Torvalds <torvalds@linux-foundation.org>,
Kees Cook <keescook@google.com>, Hugh Dickins <hughd@google.com>,
X86 ML <x86@kernel.org>
Subject: Re: [PATCH 05/23] x86, kaiser: unmap kernel from userspace page tables (core patch)
Date: Sun, 26 Nov 2017 08:10:31 -0800 [thread overview]
Message-ID: <CALCETrXqcB_2oBktvLTc2k1z_O65mTs2rDF5ZMYnFvhs2Kh3Ng@mail.gmail.com> (raw)
In-Reply-To: <CALCETrUx-3bXEsZSuaSBkEf7r+MmGoOb9fM8A3eGQpwq0qc2HA@mail.gmail.com>
On Wed, Nov 22, 2017 at 8:07 PM, Andy Lutomirski <luto@kernel.org> wrote:
> On Wed, Nov 22, 2017 at 4:34 PM, Dave Hansen
> <dave.hansen@linux.intel.com> wrote:
>>
>> These actions when dealing with a user address *and* the
>> PGD has _PAGE_USER set. That way, in-kernel users of low addresses
>> typically used by userspace are not accidentally poisoned.
>
> This seems sane.
>
>> +/*
>> + * Take a PGD location (pgdp) and a pgd value that needs
>> + * to be set there. Populates the shadow and returns
>> + * the resulting PGD that must be set in the kernel copy
>> + * of the page tables.
>> + */
>> +static inline pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
>> +{
>> +#ifdef CONFIG_KAISER
>> + if (pgd_userspace_access(pgd)) {
>> + if (pgdp_maps_userspace(pgdp)) {
>> + /*
>> + * The user/shadow page tables get the full
>> + * PGD, accessible from userspace:
>> + */
>> + kernel_to_shadow_pgdp(pgdp)->pgd = pgd.pgd;
>> + /*
>> + * For the copy of the pgd that the kernel
>> + * uses, make it unusable to userspace. This
>> + * ensures if we get out to userspace with the
>> + * wrong CR3 value, userspace will crash
>> + * instead of running.
>> + */
>> + pgd.pgd |= _PAGE_NX;
>> + }
>> + } else if (pgd_userspace_access(*pgdp)) {
>> + /*
>> + * We are clearing a _PAGE_USER PGD for which we
>> + * presumably populated the shadow. We must now
>> + * clear the shadow PGD entry.
>> + */
>> + if (pgdp_maps_userspace(pgdp)) {
>> + kernel_to_shadow_pgdp(pgdp)->pgd = pgd.pgd;
>> + } else {
>> + /*
>> + * Attempted to clear a _PAGE_USER PGD which
>> + * is in the kernel porttion of the address
>> + * space. PGDs are pre-populated and we
>> + * never clear them.
>> + */
>> + WARN_ON_ONCE(1);
>> + }
>> + } else {
>> + /*
>> + * _PAGE_USER was not set in either the PGD being set
>> + * or cleared. All kernel PGDs should be
>> + * pre-populated so this should never happen after
>> + * boot.
>> + */
>> + }
>> +#endif
>> + /* return the copy of the PGD we want the kernel to use: */
>> + return pgd;
>> +}
>> +
>
> The more I read this code, the more I dislike "shadow". Shadow
> pagetables mean something specific in the virtualization world and,
> more importantly, the word "shadow" fails to convey *which* table it
> is. Unless I'm extra confused, mm->pgd points to the kernelmode
> tables. So can we replace the word "shadow" with "usermode"? That
> will also make the entry stuff way clearer. (Or I have it backwards,
> in which case "kernelmode" would be the right choice.) And rename the
> argument.
>
> That confusion aside, I'm trying to wrap my head around this. I think
> the description above makes sense, but I'm struggling to grok the code
> and how it matches the description. May I suggest an alternative
> implementation? (Apologies for epic whitespace damage.)
>
> /*
> * Install an entry into the usermode pgd. pgdp points to the kernelmode
> * entry whose usermode counterpart we're supposed to set. pgd is the
> * desired entry. Returns pgd, possibly modified if the actual entry installed
> * into the kernelmode needs different mode bits.
> */
> static inline pgd_t kaiser_set_usermode_pgd(pgd_t *pgdp, pgd_t pgd) {
> VM_BUG_ON(pgdp points to a usermode table);
>
> if (pgdp_maps_userspace(pgdp)) {
> /* Install the pgd as requested into the usermode tables. */
> kernelmode_to_usermode_pgdp(pgdp)->pgd = pgd.pgd;
>
> if (pgd_val(pgd) & _PAGE_USER) {
> /*
> * This is a normal user pgd -- the kernelmode mapping should have NX
> * set to prevent erroneous usermode execution with the kernel tables.
> */
> return __pgd(pgd_val(pgd) | _PAGE_NX;
> } else {
> /* This is a weird mapping, e.g. EFI. Map it straight through. */
> return pgd;
> }
> } else {
> /*
> * We can get here due to vmalloc, a vmalloc fault, memory
> hot-add, or initial setup
> * of kernelmode page tables. Regardless of which particular code
> path we're in,
> * these mappings should not be automatically propagated to the
> usermode tables.
> */
> return pgd;
> }
> }
>
> As a side benefit, this shouldn't have magical interactions with the
> vsyscall page any more.
>
> Are there cases that this would get wrong?
>
Quick ping: did this get lost?
next prev parent reply other threads:[~2017-11-26 16:10 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-23 0:34 [PATCH 00/23] [v4] KAISER: unmap most of the kernel from userspace page tables Dave Hansen
2017-11-23 0:34 ` [PATCH 01/23] x86, kaiser: disable global pages by default with KAISER Dave Hansen
2017-11-23 0:34 ` [PATCH 02/23] x86, kaiser: prepare assembly for entry/exit CR3 switching Dave Hansen
2017-11-23 0:34 ` [PATCH 03/23] x86, kaiser: introduce user-mapped per-cpu areas Dave Hansen
2017-11-23 0:34 ` [PATCH 04/23] x86, kaiser: mark per-cpu data structures required for entry/exit Dave Hansen
2017-11-23 0:34 ` [PATCH 05/23] x86, kaiser: unmap kernel from userspace page tables (core patch) Dave Hansen
2017-11-23 4:07 ` Andy Lutomirski
2017-11-26 16:10 ` Andy Lutomirski [this message]
2017-11-26 16:24 ` Dave Hansen
2017-11-26 16:29 ` Andy Lutomirski
2018-01-05 4:16 ` Yisheng Xie
2018-01-05 5:18 ` Dave Hansen
2018-01-05 6:16 ` Yisheng Xie
2018-01-05 6:29 ` Dave Hansen
2018-01-05 11:49 ` Andrea Arcangeli
2018-01-05 18:19 ` Jiri Kosina
2018-01-05 19:00 ` Jiri Kosina
2018-01-05 19:03 ` Dave Hansen
2018-01-05 19:17 ` Jiri Kosina
2018-01-05 19:18 ` Jiri Kosina
2018-01-05 19:55 ` Andrea Arcangeli
2018-01-05 21:07 ` Dave Hansen
2018-01-05 21:14 ` Jiri Kosina
2018-01-05 21:29 ` Andy Lutomirski
2018-01-05 22:48 ` Hugh Dickins
2018-01-06 4:54 ` Hanjun Guo
2018-01-06 6:06 ` Dave Hansen
2018-01-06 6:28 ` Hanjun Guo
2018-01-06 6:53 ` Hanjun Guo
2018-01-06 7:55 ` Dave Hansen
2018-01-06 8:42 ` Hanjun Guo
2018-01-06 7:51 ` Dave Hansen
2018-01-06 17:22 ` Andrea Arcangeli
2017-11-23 0:34 ` [PATCH 06/23] x86, kaiser: allow NX poison to be set in p4d/pgd Dave Hansen
2017-11-23 0:34 ` [PATCH 07/23] x86, kaiser: make sure static PGDs are 8k in size Dave Hansen
2017-11-23 0:34 ` [PATCH 08/23] x86, kaiser: map cpu entry area Dave Hansen
2017-11-23 0:34 ` [PATCH 09/23] x86, kaiser: map dynamically-allocated LDTs Dave Hansen
2017-11-23 19:42 ` Eric Biggers
2017-11-23 20:12 ` Andy Lutomirski
2017-11-23 0:34 ` [PATCH 10/23] x86, kaiser: map espfix structures Dave Hansen
2017-11-23 0:34 ` [PATCH 11/23] x86, kaiser: map entry stack variables Dave Hansen
2017-11-23 3:31 ` Andy Lutomirski
2017-11-23 15:37 ` Dave Hansen
2017-11-23 15:55 ` Andy Lutomirski
2017-11-23 0:35 ` [PATCH 12/23] x86, kaiser: map virtually-addressed performance monitoring buffers Dave Hansen
2017-11-23 0:35 ` [PATCH 13/23] x86, mm: Move CR3 construction functions Dave Hansen
2017-11-23 0:35 ` [PATCH 14/23] x86, mm: remove hard-coded ASID limit checks Dave Hansen
2017-11-23 0:35 ` [PATCH 15/23] x86, mm: put mmu-to-h/w ASID translation in one place Dave Hansen
2017-11-23 0:35 ` [PATCH 16/23] x86, pcid, kaiser: allow flushing for future ASID switches Dave Hansen
2017-11-23 0:35 ` [PATCH 17/23] x86, kaiser: use PCID feature to make user and kernel switches faster Dave Hansen
2017-11-23 0:35 ` [PATCH 18/23] x86, kaiser: disable native VSYSCALL Dave Hansen
2017-11-23 0:35 ` [PATCH 19/23] x86, kaiser: add debugfs file to turn KAISER on/off at runtime Dave Hansen
2017-11-23 0:35 ` [PATCH 20/23] x86, kaiser: add a function to check for KAISER being enabled Dave Hansen
2017-11-25 1:23 ` Eduardo Valentin
2017-11-23 0:35 ` [PATCH 21/23] x86, kaiser: un-poison PGDs at runtime Dave Hansen
2017-11-25 1:17 ` Eduardo Valentin
2017-11-23 0:35 ` [PATCH 22/23] x86, kaiser: allow KAISER to be enabled/disabled " Dave Hansen
2017-11-23 0:35 ` [PATCH 23/23] x86, kaiser: add Kconfig Dave Hansen
2017-11-23 7:23 ` [PATCH 00/23] [v4] KAISER: unmap most of the kernel from userspace page tables Ingo Molnar
2017-11-23 7:27 ` Ingo Molnar
2017-11-23 7:32 ` Ingo Molnar
2017-11-23 15:02 ` Dave Hansen
2017-11-23 16:20 ` Dave Hansen
2017-11-24 6:35 ` Ingo Molnar
2017-11-24 6:41 ` Dave Hansen
2017-11-24 7:33 ` Ingo Molnar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CALCETrXqcB_2oBktvLTc2k1z_O65mTs2rDF5ZMYnFvhs2Kh3Ng@mail.gmail.com \
--to=luto@kernel.org \
--cc=daniel.gruss@iaik.tugraz.at \
--cc=dave.hansen@linux.intel.com \
--cc=hughd@google.com \
--cc=keescook@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=michael.schwarz@iaik.tugraz.at \
--cc=moritz.lipp@iaik.tugraz.at \
--cc=richard.fellner@student.tugraz.at \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).