Messages in this thread | | | From | Linus Torvalds <> | Date | Wed, 10 Jan 2018 11:54:17 -0800 | Subject | Re: [RFC PATCH v3 6/8] x86/pti: don't mark the user PGD with _PAGE_NX. |
| |
On Wed, Jan 10, 2018 at 11:28 AM, Willy Tarreau <w@1wt.eu> wrote: > Since we're going to keep running on the same PGD when returning to > userspace for certain performance-critical tasks, we'll need the user > pages to be executable. So this code disables the extra protection > that was added consisting in marking user pages _PAGE_NX so that this > pgd remains usable for userspace.
Yeah, no. This is wrong.
Sure, SMEP gives the same thing in most cases, but not for older CPU's.
So NX is a really nice way to make sure that PTI really does protect against user-space gadgets.
We don't break that, and we definitely don't break that just because of some broken notion of "let's make page table isolation per-thread".
Linus
| |