Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751851AbeAJUEs (ORCPT + 1 other); Wed, 10 Jan 2018 15:04:48 -0500 Received: from mail.kernel.org ([198.145.29.99]:45994 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751062AbeAJUEr (ORCPT ); Wed, 10 Jan 2018 15:04:47 -0500 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AED9621745 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=luto@kernel.org X-Google-Smtp-Source: ACJfBot20KU1y0xNoMVqcBKDNNnmTzIpAdbEQNpljHLNCen9dfk7wYlLlSV4/dBCFbNNc3oXLDCqXLIzTCjzzgFcK1I= MIME-Version: 1.0 In-Reply-To: References: <1515502580-12261-1-git-send-email-w@1wt.eu> <1515502580-12261-7-git-send-email-w@1wt.eu> <20180110082207.GX29822@worktop.programming.kicks-ass.net> <20180110091102.GH14066@1wt.eu> From: Andy Lutomirski Date: Wed, 10 Jan 2018 12:04:25 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC PATCH v2 6/6] x86/entry/pti: don't switch PGD on when pti_disable is set To: Linus Torvalds Cc: Andy Lutomirski , Willy Tarreau , Peter Zijlstra , LKML , X86 ML , Borislav Petkov , Brian Gerst , Dave Hansen , Ingo Molnar , Thomas Gleixner , Josh Poimboeuf , "H. Peter Anvin" , Greg Kroah-Hartman , Kees Cook Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Wed, Jan 10, 2018 at 11:50 AM, Linus Torvalds wrote: > On Wed, Jan 10, 2018 at 11:21 AM, Andy Lutomirski wrote: >> >> I really dislike state that isn't cleared on execve(). I'm assuming >> that this is so you can run time pwn_me_without_pti whatever? Surely >> LD_PRELOAD can do this, too? > > Andy, what the hell is wrong with you? > > You are actively trying to screw this whole interface up, aren't you? > > LD_PRELOAD cannot work for a wrapper, for the simple reason that it > runs in the same context as the process. So if you want to say "I want > to run this process without PTI", but you don't want to run the > process with elevated privileges, LD_PRELOAD doesn't work. Oh, right, duh. Brain was off. > The "let's do it per thread" made no sense either, since that's > fundamentally not how page tables work, and it's complete broken shit. I still disagree with you here. The whole concept of per-thread or per-mm or per-whatever PTI disablement is if the admin for some reason trusts some piece of code not to try to exploit Meltdown. But just imagine a program like a web browser. The browser will do some performance critical stuff (networking) and some absolutely-no-fucking-way-would-I-turn-off-PTI stuff (running scripts). So per-thread seems totally sensible to me. No one sane would ever do this for a web browser, but I can easily imagine it for something like a web *server* or even a database server. Just logically, too, per-thread is the obvious semantics. Whether we rewrite CR3 when we go to usermode is a thing affecting that thread. The only reason the mm has anything to do with it is the NX trick.