Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [RFC PATCH v9 03/13] mm: Add support for eXclusive Page Frame
 Ownership (XPFO)
To:     Ingo Molnar <mingo@kernel.org>
Cc:     juergh@gmail.com, tycho@tycho.ws, jsteckli@amazon.de,
        keescook@google.com, konrad.wilk@oracle.com,
        Juerg Haefliger <juerg.haefliger@canonical.com>,
        deepa.srinivasan@oracle.com, chris.hyser@oracle.com,
        tyhicks@canonical.com, dwmw@amazon.co.uk,
        andrew.cooper3@citrix.com, jcm@redhat.com,
        boris.ostrovsky@oracle.com, iommu@lists.linux-foundation.org,
        x86@kernel.org, linux-arm-kernel@lists.infradead.org,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org, linux-security-module@vger.kernel.org,
        Khalid Aziz <khalid@gonehiking.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Andy Lutomirski <luto@kernel.org>,
        Peter Zijlstra <a.p.zijlstra@chello.nl>,
        Dave Hansen <dave@sr71.net>, Borislav Petkov <bp@alien8.de>,
        "H. Peter Anvin" <hpa@zytor.com>,
        Arjan van de Ven <arjan@infradead.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
References: <cover.1554248001.git.khalid.aziz@oracle.com>
 <f1ac3700970365fb979533294774af0b0dd84b3b.1554248002.git.khalid.aziz@oracle.com>
 <20190417161042.GA43453@gmail.com>
From:   Khalid Aziz <khalid.aziz@oracle.com>
Organization: Oracle Corp
Message-ID: <e16c1d73-d361-d9c7-5b8e-c495318c2509@oracle.com>
Date:   Wed, 17 Apr 2019 10:49:26 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.1
MIME-Version: 1.0
In-Reply-To: <20190417161042.GA43453@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 4/17/19 10:15 AM, Ingo Molnar wrote:
>=20
> [ Sorry, had to trim the Cc: list from hell. Tried to keep all the=20
>   mailing lists and all x86 developers. ]
>=20
> * Khalid Aziz <khalid.aziz@oracle.com> wrote:
>=20
>> From: Juerg Haefliger <juerg.haefliger@canonical.com>
>>
>> This patch adds basic support infrastructure for XPFO which protects=20
>> against 'ret2dir' kernel attacks. The basic idea is to enforce=20
>> exclusive ownership of page frames by either the kernel or userspace, =

>> unless explicitly requested by the kernel. Whenever a page destined fo=
r=20
>> userspace is allocated, it is unmapped from physmap (the kernel's page=
=20
>> table). When such a page is reclaimed from userspace, it is mapped bac=
k=20
>> to physmap. Individual architectures can enable full XPFO support usin=
g=20
>> this infrastructure by supplying architecture specific pieces.
>=20
> I have a higher level, meta question:
>=20
> Is there any updated analysis outlining why this XPFO overhead would be=
=20
> required on x86-64 kernels running on SMAP/SMEP CPUs which should be al=
l=20
> recent Intel and AMD CPUs, and with kernel that mark all direct kernel =

> mappings as non-executable - which should be all reasonably modern=20
> kernels later than v4.0 or so?
>=20
> I.e. the original motivation of the XPFO patches was to prevent executi=
on=20
> of direct kernel mappings. Is this motivation still present if those=20
> mappings are non-executable?
>=20
> (Sorry if this has been asked and answered in previous discussions.)

Hi Ingo,

That is a good question. Because of the cost of XPFO, we have to be very
sure we need this protection. The paper from Vasileios, Michalis and
Angelos - <http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf>,
does go into how ret2dir attacks can bypass SMAP/SMEP in sections 6.1
and 6.2.

Thanks,
Khalid