From patchwork Fri Jan 20 16:41:25 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 9528977 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 115B5601AE for ; Fri, 20 Jan 2017 16:42:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1BBF328645 for ; Fri, 20 Jan 2017 16:42:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1013B28665; Fri, 20 Jan 2017 16:42:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9764228645 for ; Fri, 20 Jan 2017 16:42:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753273AbdATQmi (ORCPT ); Fri, 20 Jan 2017 11:42:38 -0500 Received: from mail-pf0-f170.google.com ([209.85.192.170]:34678 "EHLO mail-pf0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753158AbdATQlu (ORCPT ); Fri, 20 Jan 2017 11:41:50 -0500 Received: by mail-pf0-f170.google.com with SMTP id e4so23627644pfg.1 for ; Fri, 20 Jan 2017 08:41:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=tcvCKygkcNZQWEwtWCtEONiUappuO+FauqqEUCIMUgQ=; b=V67CsDuPaBghXmFRmKakKX3tz3T+xqgADm3vK9ALFjKJeLU0bdblt3W2OrAPsJ7V3c +p1nC7HU6bzqViTJWuw4gOJahBVwWHd1FgcUSUxEqB1rXwOqSbsBZRA2tsGuVKfcnq8S afH0jl7kO8uFnaQ2J3Dh3zxCe+fm5Agob+dBo2Fr2fBUp7SDfBpMsHs51hMkXpECS7s3 0p+DEVrxo8cFhCA9YV5LFmLJGHuogIibtEcSY7XnLBB9YIzbUk9uqVurrp8oaTrI76bJ XhStVI+3Cz+JHMVDoFkL6rtGd/VsVPKCUuML99mHUMj679eEwCWJYahWvMPh2iPebGqX JL3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=tcvCKygkcNZQWEwtWCtEONiUappuO+FauqqEUCIMUgQ=; b=gdfhViCot//dobgI4DNzvh3z5m/2SXuPs/UC7UxK6BqFOCsDek2VIXiVoIBUx81xS/ qb6x5etNRilavffdQZe/zqhO5Qo/k9c6Cg2jWcF1oKREfRS6s9wDdwuMOU82yLDpcEQN Fw7eISrBR59x7PLPsVWibQ9Xmss9QOxs2XYeqdJ4LCLsZeyLzmx2cKqwoWowDaCLPe1F vY7uZ2krZkCXpawexTPGoNg2gZqpKq9TeOh0YWF0NCYRqWUdoKDSEwQMo1HnCuFY0grh Kr7u3HPtWh4CVMLb9YHbTNv7gdBhfSMBkZ0+gOZSYPQTSoqeXB+e55YLlRZnOpUr+YcH Zn0A== X-Gm-Message-State: AIkVDXL1Djh9jHPVwApNndf7XdlaQZD56gFAUP0/b9BQ3hPRAvtMpt0Zyu2pU25nGEtFig8d X-Received: by 10.84.197.131 with SMTP id n3mr22599527pld.6.1484930509898; Fri, 20 Jan 2017 08:41:49 -0800 (PST) Received: from skynet.sea.corp.google.com ([100.100.206.185]) by smtp.gmail.com with ESMTPSA id v186sm18085415pgv.44.2017.01.20.08.41.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 20 Jan 2017 08:41:49 -0800 (PST) From: Thomas Garnier To: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Thomas Garnier , Kees Cook , "Rafael J . Wysocki" , Pavel Machek , Andy Lutomirski , Borislav Petkov , Christian Borntraeger , Brian Gerst , He Chen , Dave Hansen , Chen Yucong , Baoquan He , Paul Gortmaker , Joerg Roedel , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Fenghua Yu Cc: x86@kernel.org, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, kvm@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH v1 2/3] x86: Remap GDT tables in the Fixmap section Date: Fri, 20 Jan 2017 08:41:25 -0800 Message-Id: <20170120164126.27624-2-thgarnie@google.com> X-Mailer: git-send-email 2.11.0.483.g087da7b7c-goog In-Reply-To: <20170120164126.27624-1-thgarnie@google.com> References: <20170120164126.27624-1-thgarnie@google.com> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Each processor holds a GDT in its per-cpu structure. The sgdt instruction gives the base address of the current GDT. This address can be used to bypass KASLR memory randomization. With another bug, an attacker could target other per-cpu structures or deduce the base of the main memory section (PAGE_OFFSET). This patch relocates the GDT table for each processor inside the Fixmap section. The space is reserved based on number of supported cpus. For consistency, the remapping is done by default on 32 and 64 bit. Each processor switches to its remapped GDT at the end of initialization. For hibernation, the main processor returns with the original GDT and switches back to the remapping at completion. On 32 bit, the maximum number of processors is now 256. The Fixmap section cannot handle the original 512. Additional asserts ensure that the Fixmap section cannot grow beyond the space available. This patch was tested on both architectures. Hibernation and KVM were both tested specially for their usage of the GDT. Signed-off-by: Thomas Garnier --- Based on next-20170119 --- arch/x86/Kconfig | 1 + arch/x86/include/asm/fixmap.h | 4 ++++ arch/x86/include/asm/processor.h | 1 + arch/x86/kernel/cpu/common.c | 18 +++++++++++++++++- arch/x86/mm/init_32.c | 2 ++ arch/x86/power/cpu.c | 3 +++ 6 files changed, 28 insertions(+), 1 deletion(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index f1d4e8f2131f..b4ed35db10a8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -912,6 +912,7 @@ config MAXSMP config NR_CPUS int "Maximum number of CPUs" if SMP && !MAXSMP range 2 8 if SMP && X86_32 && !X86_BIGSMP + range 2 256 if SMP && X86_32 && X86_BIGSMP range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64 default "1" if !SMP diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h index c46289799b02..8b913b5e9383 100644 --- a/arch/x86/include/asm/fixmap.h +++ b/arch/x86/include/asm/fixmap.h @@ -100,6 +100,10 @@ enum fixed_addresses { #ifdef CONFIG_X86_INTEL_MID FIX_LNW_VRTC, #endif + /* Fixmap entries to remap the GDTs, one per processor. */ + FIX_GDT_REMAP_BEGIN, + FIX_GDT_REMAP_END = FIX_GDT_REMAP_BEGIN + NR_CPUS - 1, + __end_of_permanent_fixed_addresses, /* diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h index 1be64da0384e..280211ad8be9 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -705,6 +705,7 @@ extern struct desc_ptr early_gdt_descr; extern void cpu_set_gdt(int); extern void switch_to_new_gdt(int); +extern void load_remapped_gdt(int); extern void load_percpu_segment(int); extern void cpu_init(void); diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index e97ffc8d29f4..7d940b0e805a 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -443,6 +443,19 @@ void load_percpu_segment(int cpu) load_stack_canary_segment(); } +/* Load a fixmap remapping of the per-cpu GDT */ +void load_remapped_gdt(int cpu) +{ + struct desc_ptr gdt_descr; + unsigned long idx = FIX_GDT_REMAP_BEGIN + cpu; + + __set_fixmap(idx, __pa(get_cpu_gdt_table(cpu)), PAGE_KERNEL); + + gdt_descr.address = (long)__fix_to_virt(idx); + gdt_descr.size = GDT_SIZE - 1; + load_gdt(&gdt_descr); +} + /* * Current gdt points %fs at the "master" per-cpu area: after this, * it's on the real one. @@ -455,7 +468,6 @@ void switch_to_new_gdt(int cpu) gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); /* Reload the per-cpu base */ - load_percpu_segment(cpu); } @@ -1508,6 +1520,8 @@ void cpu_init(void) if (is_uv_system()) uv_cpu_init(); + + load_remapped_gdt(cpu); } #else @@ -1563,6 +1577,8 @@ void cpu_init(void) dbg_restore_debug_regs(); fpu__init_cpu(); + + load_remapped_gdt(cpu); } #endif diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c index 928d657de829..cfbcf42099d0 100644 --- a/arch/x86/mm/init_32.c +++ b/arch/x86/mm/init_32.c @@ -798,9 +798,11 @@ void __init mem_init(void) #ifdef CONFIG_HIGHMEM BUILD_BUG_ON(PKMAP_BASE + LAST_PKMAP*PAGE_SIZE > FIXADDR_START); BUILD_BUG_ON(VMALLOC_END > PKMAP_BASE); + BUILD_BUG_ON(__fix_to_virt(__end_of_fixed_addresses) <= PKMAP_BASE + LAST_PKMAP*PAGE_SIZE); #endif #define high_memory (-128UL << 20) BUILD_BUG_ON(VMALLOC_START >= VMALLOC_END); + BUILD_BUG_ON(__fix_to_virt(__end_of_fixed_addresses) <= VMALLOC_END); #undef high_memory #undef __FIXADDR_TOP diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c index 66ade16c7693..7578de6db833 100644 --- a/arch/x86/power/cpu.c +++ b/arch/x86/power/cpu.c @@ -183,6 +183,9 @@ static void fix_processor_context(void) load_mm_ldt(current->active_mm); /* This does lldt */ fpu__resume_cpu(); + + /* Load remapped GDT */ + load_remapped_gdt(cpu); } /**