• Andy Lutomirski's avatar
    x86/pti: Put the LDT in its own PGD if PTI is on · f55f0501
    Andy Lutomirski authored
    With PTI enabled, the LDT must be mapped in the usermode tables somewhere.
    The LDT is per process, i.e. per mm.
    
    An earlier approach mapped the LDT on context switch into a fixmap area,
    but that's a big overhead and exhausted the fixmap space when NR_CPUS got
    big.
    
    Take advantage of the fact that there is an address space hole which
    provides a completely unused pgd. Use this pgd to manage per-mm LDT
    mappings.
    
    This has a down side: the LDT isn't (currently) randomized, and an attack
    that can write the LDT is instant root due to call gates (thanks, AMD, for
    leaving call gates in AMD64 but designing them wrong so they're only useful
    for exploits).  This can be mitigated by making the LDT read-only or
    randomizing the mapping, either of which is strightforward on top of this
    patch.
    
    This will significantly slow down LDT users, but that shouldn't matter for
    important workloads -- the LDT is only used by DOSEMU(2), Wine, and very
    old libc implementations.
    
    [ tglx: Cleaned it up. ]
    Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Laight <David.Laight@aculab.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Juergen Gross <jgross@suse.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Kirill A. Shutemov <kirill@shutemov.name>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    f55f0501
processor.h 24.5 KB