From: Yisheng Xie <xieyisheng1@huawei.com>
To: Dave Hansen <dave.hansen@linux.intel.com>,
<linux-kernel@vger.kernel.org>
Cc: <linux-mm@kvack.org>, <richard.fellner@student.tugraz.at>,
<moritz.lipp@iaik.tugraz.at>, <daniel.gruss@iaik.tugraz.at>,
<michael.schwarz@iaik.tugraz.at>, <luto@kernel.org>,
<torvalds@linux-foundation.org>, <keescook@google.com>,
<hughd@google.com>, <x86@kernel.org>
Subject: Re: [PATCH 05/23] x86, kaiser: unmap kernel from userspace page tables (core patch)
Date: Fri, 5 Jan 2018 12:16:13 +0800 [thread overview]
Message-ID: <e80ac5b1-c562-fc60-ee84-30a3a40bde60@huawei.com> (raw)
In-Reply-To: <20171123003447.1DB395E3@viggo.jf.intel.com>
Hi Dava,
On 2017/11/23 8:34, Dave Hansen wrote:
>
> From: Dave Hansen <dave.hansen@linux.intel.com>
>
> These patches are based on work from a team at Graz University of
> Technology: https://github.com/IAIK/KAISER . This work would not have
> been possible without their work as a starting point.
>
> KAISER is a countermeasure against side channel attacks against kernel
> virtual memory. It leaves the existing page tables largely alone and
> refers to them as the "kernel page tables. It adds a "shadow" pgd for
> every process which is intended for use when running userspace. The
> shadow pgd maps all the same user memory as the "kernel" copy, but
> only maps a minimal set of kernel memory.
>
> Whenever entering the kernel (syscalls, interrupts, exceptions), the
> pgd is switched to the "kernel" copy. When switching back to user
> mode, the shadow pgd is used.
>
> The minimalistic kernel page tables try to map only what is needed to
> enter/exit the kernel such as the entry/exit functions themselves and
> the interrupt descriptors (IDT).
>
> === Page Table Poisoning ===
>
> KAISER has two copies of the page tables: one for the kernel and
> one for when running in userspace.
So, we have 2 page table, thinking about this case:
If _ONE_ process includes _TWO_ threads, one run in user space, the other
run in kernel, they can run in one core with Hyper-Threading, right? So both
userspace and kernel space is valid, right? And for one core with
Hyper-Threading, they may share TLB, so the timing problem described in
the paper may still exist?
Can this case still be protected by KAISER?
Thanks
Yisheng
> There is also a kernel
> portion of each of the page tables: the part that *maps* the
> kernel.
>
> The kernel portion is relatively static and uses pre-populated
> PGDs. Nobody ever calls set_pgd() on the kernel portion during
> normal operation.
>
> The userspace portion of the page tables is updated frequently as
> userspace pages are mapped and page table pages are allocated.
> These updates of the userspace *portion* of the tables need to be
> reflected into both the kernel and user/shadow copies.
>
> The original KAISER patches did this by effectively looking at the
> address that is being updated. If it is <PAGE_OFFSET, it is
> considered to be doing an update for the userspace portion of the page
> tables and must make an entry in the shadow.
>
> However, this has a wrinkle: there are a few places where low
> addresses are used in supervisor (kernel) mode. When EFI calls
> are made, they use what are traditionally user addresses in
> supervisor mode and trip over these checks. The trampoline code
> that used for booting secondary CPUs has a similar issue.
>
> Remember, there are two things that KAISER needs performed on a
> userspace PGD:
>
> 1. Populate the shadow itself
> 2. Poison the kernel PGD so it can not be used by userspace.
>
> Only perform these actions when dealing with a user address *and* the
> PGD has _PAGE_USER set. That way, in-kernel users of low addresses
> typically used by userspace are not accidentally poisoned.
>
next prev parent reply other threads:[~2018-01-05 4:16 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-23 0:34 [PATCH 00/23] [v4] KAISER: unmap most of the kernel from userspace page tables Dave Hansen
2017-11-23 0:34 ` [PATCH 01/23] x86, kaiser: disable global pages by default with KAISER Dave Hansen
2017-11-23 0:34 ` [PATCH 02/23] x86, kaiser: prepare assembly for entry/exit CR3 switching Dave Hansen
2017-11-23 0:34 ` [PATCH 03/23] x86, kaiser: introduce user-mapped per-cpu areas Dave Hansen
2017-11-23 0:34 ` [PATCH 04/23] x86, kaiser: mark per-cpu data structures required for entry/exit Dave Hansen
2017-11-23 0:34 ` [PATCH 05/23] x86, kaiser: unmap kernel from userspace page tables (core patch) Dave Hansen
2017-11-23 4:07 ` Andy Lutomirski
2017-11-26 16:10 ` Andy Lutomirski
2017-11-26 16:24 ` Dave Hansen
2017-11-26 16:29 ` Andy Lutomirski
2018-01-05 4:16 ` Yisheng Xie [this message]
2018-01-05 5:18 ` Dave Hansen
2018-01-05 6:16 ` Yisheng Xie
2018-01-05 6:29 ` Dave Hansen
2018-01-05 11:49 ` Andrea Arcangeli
2018-01-05 18:19 ` Jiri Kosina
2018-01-05 19:00 ` Jiri Kosina
2018-01-05 19:03 ` Dave Hansen
2018-01-05 19:17 ` Jiri Kosina
2018-01-05 19:18 ` Jiri Kosina
2018-01-05 19:55 ` Andrea Arcangeli
2018-01-05 21:07 ` Dave Hansen
2018-01-05 21:14 ` Jiri Kosina
2018-01-05 21:29 ` Andy Lutomirski
2018-01-05 22:48 ` Hugh Dickins
2018-01-06 4:54 ` Hanjun Guo
2018-01-06 6:06 ` Dave Hansen
2018-01-06 6:28 ` Hanjun Guo
2018-01-06 6:53 ` Hanjun Guo
2018-01-06 7:55 ` Dave Hansen
2018-01-06 8:42 ` Hanjun Guo
2018-01-06 7:51 ` Dave Hansen
2018-01-06 17:22 ` Andrea Arcangeli
2017-11-23 0:34 ` [PATCH 06/23] x86, kaiser: allow NX poison to be set in p4d/pgd Dave Hansen
2017-11-23 0:34 ` [PATCH 07/23] x86, kaiser: make sure static PGDs are 8k in size Dave Hansen
2017-11-23 0:34 ` [PATCH 08/23] x86, kaiser: map cpu entry area Dave Hansen
2017-11-23 0:34 ` [PATCH 09/23] x86, kaiser: map dynamically-allocated LDTs Dave Hansen
2017-11-23 19:42 ` Eric Biggers
2017-11-23 20:12 ` Andy Lutomirski
2017-11-23 0:34 ` [PATCH 10/23] x86, kaiser: map espfix structures Dave Hansen
2017-11-23 0:34 ` [PATCH 11/23] x86, kaiser: map entry stack variables Dave Hansen
2017-11-23 3:31 ` Andy Lutomirski
2017-11-23 15:37 ` Dave Hansen
2017-11-23 15:55 ` Andy Lutomirski
2017-11-23 0:35 ` [PATCH 12/23] x86, kaiser: map virtually-addressed performance monitoring buffers Dave Hansen
2017-11-23 0:35 ` [PATCH 13/23] x86, mm: Move CR3 construction functions Dave Hansen
2017-11-23 0:35 ` [PATCH 14/23] x86, mm: remove hard-coded ASID limit checks Dave Hansen
2017-11-23 0:35 ` [PATCH 15/23] x86, mm: put mmu-to-h/w ASID translation in one place Dave Hansen
2017-11-23 0:35 ` [PATCH 16/23] x86, pcid, kaiser: allow flushing for future ASID switches Dave Hansen
2017-11-23 0:35 ` [PATCH 17/23] x86, kaiser: use PCID feature to make user and kernel switches faster Dave Hansen
2017-11-23 0:35 ` [PATCH 18/23] x86, kaiser: disable native VSYSCALL Dave Hansen
2017-11-23 0:35 ` [PATCH 19/23] x86, kaiser: add debugfs file to turn KAISER on/off at runtime Dave Hansen
2017-11-23 0:35 ` [PATCH 20/23] x86, kaiser: add a function to check for KAISER being enabled Dave Hansen
2017-11-25 1:23 ` Eduardo Valentin
2017-11-23 0:35 ` [PATCH 21/23] x86, kaiser: un-poison PGDs at runtime Dave Hansen
2017-11-25 1:17 ` Eduardo Valentin
2017-11-23 0:35 ` [PATCH 22/23] x86, kaiser: allow KAISER to be enabled/disabled " Dave Hansen
2017-11-23 0:35 ` [PATCH 23/23] x86, kaiser: add Kconfig Dave Hansen
2017-11-23 7:23 ` [PATCH 00/23] [v4] KAISER: unmap most of the kernel from userspace page tables Ingo Molnar
2017-11-23 7:27 ` Ingo Molnar
2017-11-23 7:32 ` Ingo Molnar
2017-11-23 15:02 ` Dave Hansen
2017-11-23 16:20 ` Dave Hansen
2017-11-24 6:35 ` Ingo Molnar
2017-11-24 6:41 ` Dave Hansen
2017-11-24 7:33 ` Ingo Molnar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e80ac5b1-c562-fc60-ee84-30a3a40bde60@huawei.com \
--to=xieyisheng1@huawei.com \
--cc=daniel.gruss@iaik.tugraz.at \
--cc=dave.hansen@linux.intel.com \
--cc=hughd@google.com \
--cc=keescook@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=michael.schwarz@iaik.tugraz.at \
--cc=moritz.lipp@iaik.tugraz.at \
--cc=richard.fellner@student.tugraz.at \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).