Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964800AbbGUX7U (ORCPT ); Tue, 21 Jul 2015 19:59:20 -0400 Received: from ppsw-41.csi.cam.ac.uk ([131.111.8.141]:40413 "EHLO ppsw-41.csi.cam.ac.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934076AbbGUX7Q (ORCPT ); Tue, 21 Jul 2015 19:59:16 -0400 X-Greylist: delayed 1212 seconds by postgrey-1.27 at vger.kernel.org; Tue, 21 Jul 2015 19:59:15 EDT X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Subject: Re: [PATCH v2 1/3] x86/ldt: Make modify_ldt synchronous To: Boris Ostrovsky , Andy Lutomirski , Peter Zijlstra , Steven Rostedt References: <55AEBF76.4040501@oracle.com> Cc: "security@kernel.org" , X86 ML , Borislav Petkov , Sasha Levin , linux-kernel@vger.kernel.org, Konrad Rzeszutek Wilk , stable@vger.kernel.org, Jan Beulich , xen-devel From: Andrew Cooper X-Enigmail-Draft-Status: N1110 Message-ID: <55AED813.5020603@citrix.com> Date: Wed, 22 Jul 2015 00:38:59 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: <55AEBF76.4040501@oracle.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2909 Lines: 69 On 21/07/2015 22:53, Boris Ostrovsky wrote: > On 07/21/2015 03:59 PM, Andy Lutomirski wrote: >> --- a/arch/x86/include/asm/mmu_context.h >> +++ b/arch/x86/include/asm/mmu_context.h >> @@ -34,6 +34,44 @@ static inline void load_mm_cr4(struct mm_struct >> *mm) {} >> #endif >> /* >> + * ldt_structs can be allocated, used, and freed, but they are never >> + * modified while live. >> + */ >> +struct ldt_struct { >> + int size; >> + int __pad; /* keep the descriptors naturally aligned. */ >> + struct desc_struct entries[]; >> +}; > > > > This breaks Xen which expects LDT to be page-aligned. Not sure why. > > Jan, Andrew? PV guests are not permitted to have writeable mappings to the frames making up the GDT and LDT, so it cannot make unaudited changes to loadable descriptors. In particular, for a 32bit PV guest, it is only the segment limit which protects Xen from the ring1 guest kernel. A lot of this code hasn't been touched in years, and it certainly predates me. The alignment requirement appears to come from the virtual region Xen uses to map the guests GDT and LDT. Strict alignment is required for the GDT so Xen's descriptors starting at 0xe0xx are correct, but the LDT alignment seems to be a side effect of similar codepaths. For an LDT smaller than 8192 entries, I can't see any specific reason for enforcing alignment, other than "that's the way it has always been". However, the guest would still have to relinquish write access to all frames which make up the LDT, which looks to be a bit of an issue given the snippet above. I think I have a solution, but I doubt it is going to be very popular. * Make a new paravirt hook for allocation of ldt_struct, so the paravirt backend can choose an alignment if needed * Make absolutely certain that __pad has the value 0 (so size and __pad combined don't look like a present descriptor) * Never hand selector 0x0008 to unsuspecting users. This will allow ldt_struct itself to be page aligned, and for the size field to sit across the base/limit field of what would logically be selector 0x0008 There would be some issues accessing size. To load frames as an LDT, a guest must drop all refs to the page so that its type may be changed from writeable to segdesc. After that, an update_descriptor hypercall can be used to change size, and I believe the guest may subsequently recreate read-only mappings to the frames in question (although frankly it is getting late so you will want to double check all of this). Anyhow, this looks like an issue which should be fixed up with slightly more PVOps, rather than enforcing a Xen view of the world on native Linux. ~Andrew -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/