lkml.org 
[lkml]   [2018]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC PATCH v3 6/8] x86/pti: don't mark the user PGD with _PAGE_NX.
On Wed, Jan 10, 2018 at 11:28 AM, Willy Tarreau <w@1wt.eu> wrote:
> Since we're going to keep running on the same PGD when returning to
> userspace for certain performance-critical tasks, we'll need the user
> pages to be executable. So this code disables the extra protection
> that was added consisting in marking user pages _PAGE_NX so that this
> pgd remains usable for userspace.

Yeah, no. This is wrong.

Sure, SMEP gives the same thing in most cases, but not for older CPU's.

So NX is a really nice way to make sure that PTI really does protect
against user-space gadgets.

We don't break that, and we definitely don't break that just because
of some broken notion of "let's make page table isolation per-thread".

Linus

\
 
 \ /
  Last update: 2018-01-14 23:22    [W:0.091 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site