On Fri, 2017-11-10 at 11:31 -0800, Dave Hansen wrote: > From: Dave Hansen <[email protected]> > > Global pages stay in the TLB across context switches. Since all > contexts > share the same kernel mapping, these mappings are marked as global > pages > so kernel entries in the TLB are not flushed out on a context switch. > > But, even having these entries in the TLB opens up something that an > attacker can use [1]. > > That means that even when KAISER switches page tables on return to > user > space the global pages would stay in the TLB cache. > > Disable global pages so that kernel TLB entries can be flushed before > returning to user space. This way, all accesses to kernel addresses > from > userspace result in a TLB miss independent of the existence of a > kernel > mapping. > > Replace _PAGE_GLOBAL by __PAGE_KERNEL_GLOBAL and keep _PAGE_GLOBAL > available so that it can still be used for a few selected kernel > mappings > which must be visible to userspace, when KAISER is enabled, like the > entry/exit code and data.
Nice changelog.
Why am I pointing this out?
> +++ b/arch/x86/include/asm/pgtable_types.h 2017-11-10
> 11:22:06.626244956 -0800
> @@ -179,8 +179,20 @@ enum page_cache_mode {
> #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT |
> _PAGE_USER | \
> _PAGE_ACCESSED)
>
> +/*
> + * Disable global pages for anything using the default
> + * __PAGE_KERNEL* macros. PGE will still be enabled
> + * and _PAGE_GLOBAL may still be used carefully.
> + */
> +#ifdef CONFIG_KAISER
> +#define __PAGE_KERNEL_GLOBAL 0
> +#else
> +#define __PAGE_KERNEL_GLOBAL _PAGE_GLOBAL
> +#endif
> +
The comment above could use a little more info
on why things are done that way, though :)
--
All rights reversed
signature.asc
Description: This is a digitally signed message part
