> On Jan 15, 2018, at 9:42 AM, Nadav Amit <[email protected]> wrote: > > Andy Lutomirski <[email protected]> wrote: > >> >>> On Jan 14, 2018, at 12:13 PM, Nadav Amit <[email protected]> wrote: >>> >>> Currently, when page-table isolation is on to prevent the Meltdown bug >>> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt. >>> >>> However, it appears that this is an unnecessary measure when programs >>> run in compatibility mode. In this mode only 32-bit registers are >>> available, which means that there *should* be no way for the CPU to >>> access, even speculatively, memory that belongs to the kernel, which >>> sits in high addresses. >> >> You're assuming that TIF_IA32 prevents the execution of 64-bit code. It >> doesn't. >> >> I've occasionally considered adding an opt-in hardening mechanism to enforce >> 32-bit or 64-bit execution, but we don't have this now. > > I noticed it doesn’t. I thought the removing/restoring the __USER_CS > descriptor on context switch, based on TIF_IA32, would be enough. > modify_ldt() always keeps the descriptor l-bit clear. I will review the > other GDT descriptors, and if needed, create two GDTs. Let me know if I > missed anything else.
There world need to be some opt-in control, I think, for CRIU if nothing else. Also, on Xen PV, it's a complete nonstarter. We don't have enough control over the GDT unless someone knows otherwise. But there's no PTI on Xen PV either. > >> Anything like this would also need to spend on SMEP, I think -- the >> pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I think. > > If SMEP is not supported, compatibility mode would still require page-table > isolation. > > Thanks for the feedback. I still look for an ack for the basic idea of > disabling page-table isolation on compatibility mode. > I'm still not really convinced this is worth it. It will send a bad message and get people to run critical stuff compiled for 32-bit, which has its own downsides. > Regards, > Nadav
