Andy Lutomirski <[email protected]> wrote: > > >> On Jan 15, 2018, at 9:50 AM, Nadav Amit <[email protected]> wrote: >> >> Andy Lutomirski <[email protected]> wrote: >> >>>> On Jan 15, 2018, at 9:42 AM, Nadav Amit <[email protected]> wrote: >>>> >>>> Andy Lutomirski <[email protected]> wrote: >>>> >>>>>> On Jan 14, 2018, at 12:13 PM, Nadav Amit <[email protected]> wrote: >>>>>> >>>>>> Currently, when page-table isolation is on to prevent the Meltdown bug >>>>>> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt. >>>>>> >>>>>> However, it appears that this is an unnecessary measure when programs >>>>>> run in compatibility mode. In this mode only 32-bit registers are >>>>>> available, which means that there *should* be no way for the CPU to >>>>>> access, even speculatively, memory that belongs to the kernel, which >>>>>> sits in high addresses. >>>>> >>>>> You're assuming that TIF_IA32 prevents the execution of 64-bit code. It >>>>> doesn't. >>>>> >>>>> I've occasionally considered adding an opt-in hardening mechanism to >>>>> enforce 32-bit or 64-bit execution, but we don't have this now. >>>> >>>> I noticed it doesn’t. I thought the removing/restoring the __USER_CS >>>> descriptor on context switch, based on TIF_IA32, would be enough. >>>> modify_ldt() always keeps the descriptor l-bit clear. I will review the >>>> other GDT descriptors, and if needed, create two GDTs. Let me know if I >>>> missed anything else. >>> >>> There world need to be some opt-in control, I think, for CRIU if nothing >>> else. >>> >>> Also, on Xen PV, it's a complete nonstarter. We don't have enough control >>> over the GDT unless someone knows otherwise. But there's no PTI on Xen PV >>> either. >>> >>>>> Anything like this would also need to spend on SMEP, I think -- the >>>>> pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I >>>>> think. >>>> >>>> If SMEP is not supported, compatibility mode would still require page-table >>>> isolation. >>>> >>>> Thanks for the feedback. I still look for an ack for the basic idea of >>>> disabling page-table isolation on compatibility mode. >>> >>> I'm still not really convinced this is worth it. It will send a bad >>> message and get people to run critical stuff compiled for 32-bit, which has >>> its own downsides. >> >> I can handle #GP gracefully if __USER_CS is loaded so PTI would be required >> again. Doing so would eliminate the need for an opt-in, and preserve the >> current semantics. > > Not if someone used LAR, a la the sigreturn_32 test. Not necessarily a > showstopper, though.
Thanks for pointing it out. Actually, I think that since GDT_ENTRY_DEFAULT_USER_DS and GDT_ENTRY_DEFAULT_USER_CS are the last set entries in the GDT, I can just play with the GDT limit (lower it on IA32), and get LAR working as well. > You'd also have to figure out how to do PTI per-thread, which Linus doesn't > like. See Willy's PTI opt-out thread. Maybe I read it wrong, but I think Linus's main objections are for dynamically enabling/disabling PTI and for not having clear protection guarantees. I don’t think that disabling PTI on compatibility mode suffers from these limitations. (But then again…)
