Re: [PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-11 Thread H. Peter Anvin
Kees posted that one too. Andi Kleen wrote: >Ingo Molnar writes: >> >> This looks very nice to me now. Peter, any objections? > >it seems pointless without randomized main kernel text location, >because >the IDT will be still at a known per kernel fixed writable location in >the direct

Re: [PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-11 Thread Andi Kleen
Ingo Molnar writes: > > This looks very nice to me now. Peter, any objections? it seems pointless without randomized main kernel text location, because the IDT will be still at a known per kernel fixed writable location in the direct mapping. As long as such randomization is not there it just

Re: [PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-11 Thread Ingo Molnar
* Kees Cook wrote: > Make a copy of the IDT (as seen via the "sidt" instruction) read-only. > This primarily removes the IDT from being a target for arbitrary memory > write attacks, and has the added benefit of also not leaking the kernel > base offset, if it has been relocated. > > We

Re: [PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-11 Thread Ingo Molnar
* Kees Cook keesc...@chromium.org wrote: Make a copy of the IDT (as seen via the sidt instruction) read-only. This primarily removes the IDT from being a target for arbitrary memory write attacks, and has the added benefit of also not leaking the kernel base offset, if it has been relocated.

Re: [PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-11 Thread Andi Kleen
Ingo Molnar mi...@kernel.org writes: This looks very nice to me now. Peter, any objections? it seems pointless without randomized main kernel text location, because the IDT will be still at a known per kernel fixed writable location in the direct mapping. As long as such randomization is not

Re: [PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-11 Thread H. Peter Anvin
Kees posted that one too. Andi Kleen a...@firstfloor.org wrote: Ingo Molnar mi...@kernel.org writes: This looks very nice to me now. Peter, any objections? it seems pointless without randomized main kernel text location, because the IDT will be still at a known per kernel fixed writable

[PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-10 Thread Kees Cook
Make a copy of the IDT (as seen via the "sidt" instruction) read-only. This primarily removes the IDT from being a target for arbitrary memory write attacks, and has the added benefit of also not leaking the kernel base offset, if it has been relocated. We already did this on vendor == Intel and

[PATCH v3] x86: use a read-only IDT alias on all CPUs

2013-04-10 Thread Kees Cook
Make a copy of the IDT (as seen via the sidt instruction) read-only. This primarily removes the IDT from being a target for arbitrary memory write attacks, and has the added benefit of also not leaking the kernel base offset, if it has been relocated. We already did this on vendor == Intel and