Date: Mon, 8 Jan 2018 18:46:36 +0100
From: Ingo Molnar <mingo@kernel.org>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: Willy Tarreau <w@1wt.eu>, linux-kernel@vger.kernel.org,
        x86@kernel.org, gnomes@lxorguk.ukuu.org.uk,
        torvalds@linux-foundation.org, Dave Hansen <dave@sr71.net>,
        Andy Lutomirski <luto@kernel.org>,
        Borislav Petkov <bp@alien8.de>,
        Peter Zijlstra <a.p.zijlstra@chello.nl>,
        Josh Poimboeuf <jpoimboe@redhat.com>
Subject: Re: [PATCH RFC 2/4] x86/arch_prctl: add ARCH_GET_NOPTI and
 ARCH_SET_NOPTI to enable/disable PTI
Message-ID: <20180108174636.76ioxk6yem73yh7i@gmail.com>
References: <1515427939-10999-1-git-send-email-w@1wt.eu>
 <1515427939-10999-3-git-send-email-w@1wt.eu>
 <alpine.DEB.2.20.1801081757520.1735@nanos>
 <20180108171759.qissiwwxyg6m7rrl@gmail.com>
 <alpine.DEB.2.20.1801081824410.1735@nanos>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <alpine.DEB.2.20.1801081824410.1735@nanos>
User-Agent: NeoMutt/20170609 (1.8.3)
Sender: linux-kernel-owner@vger.kernel.org


* Thomas Gleixner <tglx@linutronix.de> wrote:

> On Mon, 8 Jan 2018, Ingo Molnar wrote:
> > * Thomas Gleixner <tglx@linutronix.de> wrote:
> > > Per task is really an odd choice. That should be per process I think, but
> > > that of course needs synchronization of some form. Aside of that we need to
> > > think about fork().
> > 
> > So per task (thread) is the most natural approach to low level asm flaggery.
> 
> Well, yes and no. PTI is a property of the mm/pgdir and that's process
> wide.

Yes and no: the contents of CR3 is a property of the _thread_ (CPU), so we do have 
the implementational degree of freedom of executing user-space with either the 
user+kernel PGD or the user-only PGD.

The question I'm asking is whether it makes sense to offer this - the 
_possibility_ is clearly there unless I'm missing something.

> > Making it per thread also makes some sense conceptually: in a complex 
> > multi-threaded runtime implementation some threads might never execute
> > 'untrusted' code, some might. No need to penalize the 'server' threads.
> 
> If one thread runs untrusted code then your 'trusted' thread is not longer
> trusted either as they share everything.

I think you are missing the wider context here: a number of runtime environments 
(browsers, JIT compilers, etc.) are able to run "untrusted code" while still 
applying heavy sandboxing constraints.

In some of those runtime models it's very much possible to have untrusted code in 
the same address space as trusted code. BPF is an example for such a runtime 
model: we can run user-defined BPF JIT-ed code in kernel context.

Thanks,

	Ingo