Messages in this thread | | | Date | Mon, 8 Jan 2018 18:05:35 +0100 (CET) | From | Thomas Gleixner <> | Subject | Re: [PATCH RFC 3/4] x86/pti: don't mark the user PGD with _PAGE_NX. |
| |
On Mon, 8 Jan 2018, Willy Tarreau wrote: > Since we're going to keep running on the same PGD when returning to > userspace for certain performance-critical tasks, we'll need the user > pages to be executable. So this code disables the extra protection > that was added consisting in marking user pages _PAGE_NX so that this > pgd remains usable for userspace. > > Note: it isn't necessarily the best approach, but one way or another > if we want to be able to return to userspace from the kernel, > we'll have to have this executable anyway. Another approach > might consist in using another pgd for userland+kernel but > the current core really looks like an extra careful measure > to catch early bugs if any.
I surely want to keep that as a safety measure. The entry code is simple to get wrong and running with the wrong pagetables by a silly mistake and thereby undoing the protection is surely not what we want.
Need to find a free time slot to think about that.
Thanks,
tglx
| |