From: Dave Hansen <dave.han...@linux.intel.com> With KAISER Kernel PGDs that map userspace are "poisoned" with the NX bit. This ensures that if a kernel->user CR3 switch is missed, userspace crashes instead of running in an unhardened state.
This code will be needed in a moment when KAISER is turned on and off at runtime. Note that an __ASSEMBLY__ #ifdef is now required since kaiser.h is indirectly included into assembly. Signed-off-by: Dave Hansen <dave.han...@linux.intel.com> Cc: Andy Lutomirski <l...@kernel.org> Cc: Borislav Petkov <b...@alien8.de> Cc: Brian Gerst <brge...@gmail.com> Cc: Daniel Gruss <daniel.gr...@iaik.tugraz.at> Cc: Denys Vlasenko <dvlas...@redhat.com> Cc: H. Peter Anvin <h...@zytor.com> Cc: Hugh Dickins <hu...@google.com> Cc: Josh Poimboeuf <jpoim...@redhat.com> Cc: Kees Cook <keesc...@google.com> Cc: Linus Torvalds <torva...@linux-foundation.org> Cc: Michael Schwarz <michael.schw...@iaik.tugraz.at> Cc: Moritz Lipp <moritz.l...@iaik.tugraz.at> Cc: Peter Zijlstra <pet...@infradead.org> Cc: Richard Fellner <richard.fell...@student.tugraz.at> Cc: Thomas Gleixner <t...@linutronix.de> Cc: linux...@kvack.org Link: http://lkml.kernel.org/r/20171123003521.a90ac...@viggo.jf.intel.com Signed-off-by: Ingo Molnar <mi...@kernel.org> --- arch/x86/include/asm/pgtable_64.h | 16 +++++++++++++++- arch/x86/mm/kaiser.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/kaiser.h | 3 ++- 3 files changed, 55 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h index c239839e92bd..89bde2091af1 100644 --- a/arch/x86/include/asm/pgtable_64.h +++ b/arch/x86/include/asm/pgtable_64.h @@ -3,6 +3,7 @@ #define _ASM_X86_PGTABLE_64_H #include <linux/const.h> +#include <linux/kaiser.h> #include <asm/pgtable_64_types.h> #ifndef __ASSEMBLY__ @@ -199,6 +200,18 @@ static inline bool pgd_userspace_access(pgd_t pgd) return pgd.pgd & _PAGE_USER; } +static inline void kaiser_poison_pgd(pgd_t *pgd) +{ + if (pgd->pgd & _PAGE_PRESENT) + pgd->pgd |= _PAGE_NX; +} + +static inline void kaiser_unpoison_pgd(pgd_t *pgd) +{ + if (pgd->pgd & _PAGE_PRESENT) + pgd->pgd &= ~_PAGE_NX; +} + /* * Take a PGD location (pgdp) and a pgd value that needs * to be set there. Populates the shadow and returns @@ -222,7 +235,8 @@ static inline pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd) * wrong CR3 value, userspace will crash * instead of running. */ - pgd.pgd |= _PAGE_NX; + if (kaiser_active()) + kaiser_poison_pgd(&pgd); } } else if (pgd_userspace_access(*pgdp)) { /* diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c index 968d5b62d597..06966b111280 100644 --- a/arch/x86/mm/kaiser.c +++ b/arch/x86/mm/kaiser.c @@ -501,6 +501,9 @@ static ssize_t kaiser_enabled_write_file(struct file *file, if (enable > 1) return -EINVAL; + if (kaiser_enabled == enable) + return count; + WRITE_ONCE(kaiser_enabled, enable); return count; } @@ -518,3 +521,38 @@ static int __init create_kaiser_enabled(void) return 0; } late_initcall(create_kaiser_enabled); + +enum poison { + KAISER_POISON, + KAISER_UNPOISON +}; +void kaiser_poison_pgd_page(pgd_t *pgd_page, enum poison do_poison) +{ + int i = 0; + + for (i = 0; i < PTRS_PER_PGD; i++) { + pgd_t *pgd = &pgd_page[i]; + + /* Stop once we hit kernel addresses: */ + if (!pgdp_maps_userspace(pgd)) + break; + + if (do_poison == KAISER_POISON) + kaiser_poison_pgd(pgd); + else + kaiser_unpoison_pgd(pgd); + } + +} + +void kaiser_poison_pgds(enum poison do_poison) +{ + struct page *page; + + spin_lock(&pgd_lock); + list_for_each_entry(page, &pgd_list, lru) { + pgd_t *pgd = (pgd_t *)page_address(page); + kaiser_poison_pgd_page(pgd, do_poison); + } + spin_unlock(&pgd_lock); +} diff --git a/include/linux/kaiser.h b/include/linux/kaiser.h index a3d28d00d555..83d465599646 100644 --- a/include/linux/kaiser.h +++ b/include/linux/kaiser.h @@ -4,7 +4,7 @@ #ifdef CONFIG_KAISER #include <asm/kaiser.h> #else - +#ifndef __ASSEMBLY__ /* * These stubs are used whenever CONFIG_KAISER is off, which * includes architectures that support KAISER, but have it @@ -33,5 +33,6 @@ static inline bool kaiser_active(void) { return 0; } +#endif /* __ASSEMBLY__ */ #endif /* !CONFIG_KAISER */ #endif /* _INCLUDE_KAISER_H */ -- 2.14.1
