From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl0-f69.google.com (mail-pl0-f69.google.com [209.85.160.69]) by kanga.kvack.org (Postfix) with ESMTP id 94AB16B0003 for ; Mon, 5 Mar 2018 17:05:30 -0500 (EST) Received: by mail-pl0-f69.google.com with SMTP id 1-v6so8694596plv.6 for ; Mon, 05 Mar 2018 14:05:30 -0800 (PST) Received: from mail.zytor.com (terminus.zytor.com. [198.137.202.136]) by mx.google.com with ESMTPS id o1-v6si9981323pld.259.2018.03.05.14.05.29 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 05 Mar 2018 14:05:29 -0800 (PST) Subject: Re: [PATCH 07/34] x86/entry/32: Restore segments before int registers References: <1520245563-8444-1-git-send-email-joro@8bytes.org> <1520245563-8444-8-git-send-email-joro@8bytes.org> <20180305131231.GR16484@8bytes.org> <20180305213550.GV16484@8bytes.org> From: "H. Peter Anvin" Message-ID: <12c11262-5e0f-2987-0a74-3bde4b66c352@zytor.com> Date: Mon, 5 Mar 2018 14:03:49 -0800 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: To: Linus Torvalds , Joerg Roedel Cc: Brian Gerst , Thomas Gleixner , Ingo Molnar , the arch/x86 maintainers , Linux Kernel Mailing List , linux-mm , Andrew Lutomirski , Dave Hansen , Josh Poimboeuf , =?UTF-8?B?SsO8cmdlbiBHcm/Dnw==?= , Peter Zijlstra , Borislav Petkov , Jiri Kosina , Boris Ostrovsky , David Laight , Denys Vlasenko , Eduardo Valentin , Greg Kroah-Hartman , Will Deacon , "Liguori, Anthony" , Daniel Gruss , Hugh Dickins , Kees Cook , Andrea Arcangeli , Waiman Long , Pavel Machek , Joerg Roedel On 03/05/18 13:58, Linus Torvalds wrote: > On Mon, Mar 5, 2018 at 1:35 PM, Joerg Roedel wrote: >> On Mon, Mar 05, 2018 at 12:50:33PM -0800, Linus Torvalds wrote: >>> >>> Ahh, good. So presumably Joerg actually did check it, just didn't even notice ;) >> >> Yeah, sort of. I ran the test, but it didn't catch the failure case in >> previous versions which was return to user with kernel-cr3 :) > > Ahh. Yes, that's bad. The NX protection to guarantee that you don't > return to user mode was really good on x86-64. > > So some other case could slip through, because user code can happily > run with the kernel page tables. > >> I could probably add some debug instrumentation to check for that in my >> future testing, as there is no NX protection in the user address-range >> for the kernel-cr3. > > Does not NX work with PAE? > > Oh, it looks like the NX bit is marked as "RSVD (must be 0)" in the > PDPDT. Oh well. > On NX-enabled hardware NX works with PDE, but the PDPDT in general doesn't have permission bits (it's really more of a set of four CR3s than a page table level.) -hpa -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org