Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Mar 2017 22:04:24 +0100
From: Pavel Machek <pavel@....cz>
To: Thomas Garnier <thgarnie@...gle.com>
Cc: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
	"H . Peter Anvin" <hpa@...or.com>, Jonathan Corbet <corbet@....net>,
	Andrey Ryabinin <aryabinin@...tuozzo.com>,
	Alexander Potapenko <glider@...gle.com>,
	Dmitry Vyukov <dvyukov@...gle.com>,
	Lorenzo Stoakes <lstoakes@...il.com>,
	Kees Cook <keescook@...omium.org>, Juergen Gross <jgross@...e.com>,
	Andy Lutomirski <luto@...nel.org>,
	Paul Gortmaker <paul.gortmaker@...driver.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Michal Hocko <mhocko@...e.com>, zijun_hu <zijun_hu@....com>,
	Chris Wilson <chris@...is-wilson.co.uk>,
	Andy Lutomirski <luto@...capital.net>,
	"Rafael J . Wysocki" <rjw@...ysocki.net>,
	Len Brown <len.brown@...el.com>, Jiri Kosina <jikos@...nel.org>,
	Matt Fleming <matt@...eblueprint.co.uk>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	Boris Ostrovsky <boris.ostrovsky@...cle.com>,
	Rusty Russell <rusty@...tcorp.com.au>,
	Paolo Bonzini <pbonzini@...hat.com>, Borislav Petkov <bp@...e.de>,
	Christian Borntraeger <borntraeger@...ibm.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	"Luis R . Rodriguez" <mcgrof@...nel.org>,
	Stanislaw Gruszka <sgruszka@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Josh Poimboeuf <jpoimboe@...hat.com>,
	Vitaly Kuznetsov <vkuznets@...hat.com>,
	Tim Chen <tim.c.chen@...ux.intel.com>,
	Joerg Roedel <joro@...tes.org>,
	Radim Krčmář <rkrcmar@...hat.com>, x86@...nel.org,
	linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org,
	kasan-dev@...glegroups.com, linux-mm@...ck.org,
	linux-pm@...r.kernel.org, linux-efi@...r.kernel.org,
	xen-devel@...ts.xenproject.org, lguest@...ts.ozlabs.org,
	kvm@...r.kernel.org, kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v7 3/3] x86: Make the GDT remapping read-only on 64-bit

On Tue 2017-03-14 10:05:08, Thomas Garnier wrote:
> This patch makes the GDT remapped pages read-only to prevent corruption.
> This change is done only on 64-bit.
> 
> The native_load_tr_desc function was adapted to correctly handle a
> read-only GDT. The LTR instruction always writes to the GDT TSS entry.
> This generates a page fault if the GDT is read-only. This change checks
> if the current GDT is a remap and swap GDTs as needed. This function was
> tested by booting multiple machines and checking hibernation works
> properly.
> 
> KVM SVM and VMX were adapted to use the writeable GDT. On VMX, the
> per-cpu variable was removed for functions to fetch the original GDT.
> Instead of reloading the previous GDT, VMX will reload the fixmap GDT as
> expected. For testing, VMs were started and restored on multiple
> configurations.
> 
> Signed-off-by: Thomas Garnier <thgarnie@...gle.com>

Can we get the same change for 32-bit, too? Growing differences
between 32 and 64 bit are a bit of a problem...
								Pavel
								
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.