Messages in this thread |  | | From | Kees Cook <> | Date | Thu, 19 Apr 2018 09:55:16 -0700 | Subject | Re: [PATCH 11/11] x86/pti: leave kernel text global for !PCID |
| |
On Thu, Apr 19, 2018 at 9:02 AM, Dave Hansen <dave.hansen@linux.intel.com> wrote: > On 04/18/2018 05:11 PM, Kees Cook wrote: >> On Fri, Apr 6, 2018 at 1:55 PM, Dave Hansen <dave.hansen@linux.intel.com> wrote: >>> +/* >>> + * For some configurations, map all of kernel text into the user page >>> + * tables. This reduces TLB misses, especially on non-PCID systems. >>> + */ >>> +void pti_clone_kernel_text(void) >>> +{ >>> + unsigned long start = PFN_ALIGN(_text); >>> + unsigned long end = ALIGN((unsigned long)_end, PMD_PAGE_SIZE); >> I think this is too much set global: _end is after data, bss, and brk, >> and all kinds of other stuff that could hold secrets. I think this >> should match what mark_rodata_ro() is doing and use >> __end_rodata_hpage_align. (And on i386, this should be maybe _etext.) > > Sounds reasonable to me. This does assume that there are no secrets > built into the kernel image, right?
It's hard to say, but I was trying to consider the basic threat model of having your kernel image available to an attacker (i.e. a distro kernel can be examined from packages, etc). In that case, the text and rodata are readable through much more direct mechanisms. Everything after rodata is run-time state, and should be excluded in the general case.
I would expect more paranoid system builders to boot with "pti=on", but perhaps we should disable Global under other specific CONFIGs, or make a specific CONFIG for it that other options can select, probably.
-Kees
-- Kees Cook Pixel Security
|  |