* [PATCH v2] x86: use fixed read-only IDT
@ 2013-04-09 16:39 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2013-04-09 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86,
Konrad Rzeszutek Wilk, Jeremy Fitzhardinge, Kees Cook,
Marcelo Tosatti, Alex Shi, Alexander Duyck, Frederic Weisbecker,
Steven Rostedt, Paul E. McKenney, xen-devel, virtualization,
kernel-hardening, Dan Rosenberg, Julien Tinnes, Will Drewry,
Eric Northup
Make a copy of the IDT (as seen via the "sidt" instruction) read-only.
This primarily removes the IDT from being a target for arbitrary memory
write attacks, and has the added benefit of also not leaking the kernel
base offset, if it has been relocated.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Eric Northup <digitaleric@google.com>
---
v2:
- clarify commit and comments
---
arch/x86/include/asm/fixmap.h | 4 +---
arch/x86/kernel/cpu/intel.c | 18 +-----------------
arch/x86/kernel/traps.c | 8 ++++++++
arch/x86/xen/mmu.c | 4 +---
4 files changed, 11 insertions(+), 23 deletions(-)
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index a09c285..51b9e32 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -104,9 +104,7 @@ enum fixed_addresses {
FIX_LI_PCIA, /* Lithium PCI Bridge A */
FIX_LI_PCIB, /* Lithium PCI Bridge B */
#endif
-#ifdef CONFIG_X86_F00F_BUG
- FIX_F00F_IDT, /* Virtual mapping for IDT */
-#endif
+ FIX_RO_IDT, /* Virtual mapping for read-only IDT */
#ifdef CONFIG_X86_CYCLONE_TIMER
FIX_CYCLONE_TIMER, /*cyclone timer register*/
#endif
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 1905ce9..7170024 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -164,20 +164,6 @@ int __cpuinit ppro_with_ram_bug(void)
return 0;
}
-#ifdef CONFIG_X86_F00F_BUG
-static void __cpuinit trap_init_f00f_bug(void)
-{
- __set_fixmap(FIX_F00F_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
-
- /*
- * Update the IDT descriptor and reload the IDT so that
- * it uses the read-only mapped virtual address.
- */
- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
- load_idt(&idt_descr);
-}
-#endif
-
static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
{
/* calling is from identify_secondary_cpu() ? */
@@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
/*
* All current models of Pentium and Pentium with MMX technology CPUs
* have the F0 0F bug, which lets nonprivileged users lock up the
- * system.
- * Note that the workaround only should be initialized once...
+ * system. Announce that the fault handler will be checking for it.
*/
c->f00f_bug = 0;
if (!paravirt_enabled() && c->x86 == 5) {
@@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
c->f00f_bug = 1;
if (!f00f_workaround_enabled) {
- trap_init_f00f_bug();
printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
f00f_workaround_enabled = 1;
}
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 68bda7a..a2a9b78 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -753,6 +753,14 @@ void __init trap_init(void)
#endif
/*
+ * Set the IDT descriptor to a fixed read-only location, so that the
+ * "sidt" instruction will not leak the location of the kernel, and
+ * to defend the IDT against arbitrary memory write vulnerabilities.
+ * It will be reloaded in cpu_init() */
+ __set_fixmap(FIX_RO_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
+ idt_descr.address = fix_to_virt(FIX_RO_IDT);
+
+ /*
* Should be a barrier for any external CPU state:
*/
cpu_init();
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 6afbb2c..8bc4dec 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2039,9 +2039,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
switch (idx) {
case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
-#ifdef CONFIG_X86_F00F_BUG
- case FIX_F00F_IDT:
-#endif
+ case FIX_RO_IDT:
#ifdef CONFIG_X86_32
case FIX_WP_TEST:
case FIX_VDSO:
--
1.7.9.5
--
Kees Cook
Chrome OS Security
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH v2] x86: use fixed read-only IDT
@ 2013-04-09 16:39 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2013-04-09 16:39 UTC (permalink / raw)
To: linux-kernel
Cc: Alexander Duyck, Alex Shi, Jeremy Fitzhardinge, Will Drewry,
Kees Cook, Julien Tinnes, Konrad Rzeszutek Wilk,
Frederic Weisbecker, Dan Rosenberg, x86, Steven Rostedt,
virtualization, Ingo Molnar, H. Peter Anvin, kernel-hardening,
Thomas Gleixner, Paul E. McKenney, xen-devel
Make a copy of the IDT (as seen via the "sidt" instruction) read-only.
This primarily removes the IDT from being a target for arbitrary memory
write attacks, and has the added benefit of also not leaking the kernel
base offset, if it has been relocated.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Eric Northup <digitaleric@google.com>
---
v2:
- clarify commit and comments
---
arch/x86/include/asm/fixmap.h | 4 +---
arch/x86/kernel/cpu/intel.c | 18 +-----------------
arch/x86/kernel/traps.c | 8 ++++++++
arch/x86/xen/mmu.c | 4 +---
4 files changed, 11 insertions(+), 23 deletions(-)
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index a09c285..51b9e32 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -104,9 +104,7 @@ enum fixed_addresses {
FIX_LI_PCIA, /* Lithium PCI Bridge A */
FIX_LI_PCIB, /* Lithium PCI Bridge B */
#endif
-#ifdef CONFIG_X86_F00F_BUG
- FIX_F00F_IDT, /* Virtual mapping for IDT */
-#endif
+ FIX_RO_IDT, /* Virtual mapping for read-only IDT */
#ifdef CONFIG_X86_CYCLONE_TIMER
FIX_CYCLONE_TIMER, /*cyclone timer register*/
#endif
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 1905ce9..7170024 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -164,20 +164,6 @@ int __cpuinit ppro_with_ram_bug(void)
return 0;
}
-#ifdef CONFIG_X86_F00F_BUG
-static void __cpuinit trap_init_f00f_bug(void)
-{
- __set_fixmap(FIX_F00F_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
-
- /*
- * Update the IDT descriptor and reload the IDT so that
- * it uses the read-only mapped virtual address.
- */
- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
- load_idt(&idt_descr);
-}
-#endif
-
static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
{
/* calling is from identify_secondary_cpu() ? */
@@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
/*
* All current models of Pentium and Pentium with MMX technology CPUs
* have the F0 0F bug, which lets nonprivileged users lock up the
- * system.
- * Note that the workaround only should be initialized once...
+ * system. Announce that the fault handler will be checking for it.
*/
c->f00f_bug = 0;
if (!paravirt_enabled() && c->x86 == 5) {
@@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
c->f00f_bug = 1;
if (!f00f_workaround_enabled) {
- trap_init_f00f_bug();
printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
f00f_workaround_enabled = 1;
}
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 68bda7a..a2a9b78 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -753,6 +753,14 @@ void __init trap_init(void)
#endif
/*
+ * Set the IDT descriptor to a fixed read-only location, so that the
+ * "sidt" instruction will not leak the location of the kernel, and
+ * to defend the IDT against arbitrary memory write vulnerabilities.
+ * It will be reloaded in cpu_init() */
+ __set_fixmap(FIX_RO_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
+ idt_descr.address = fix_to_virt(FIX_RO_IDT);
+
+ /*
* Should be a barrier for any external CPU state:
*/
cpu_init();
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 6afbb2c..8bc4dec 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2039,9 +2039,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
switch (idx) {
case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
-#ifdef CONFIG_X86_F00F_BUG
- case FIX_F00F_IDT:
-#endif
+ case FIX_RO_IDT:
#ifdef CONFIG_X86_32
case FIX_WP_TEST:
case FIX_VDSO:
--
1.7.9.5
--
Kees Cook
Chrome OS Security
^ permalink raw reply related [flat|nested] 10+ messages in thread* [kernel-hardening] Re: [PATCH v2] x86: use fixed read-only IDT
2013-04-09 16:39 ` Kees Cook
(?)
@ 2013-04-10 0:14 ` H. Peter Anvin
-1 siblings, 0 replies; 10+ messages in thread
From: H. Peter Anvin @ 2013-04-10 0:14 UTC (permalink / raw)
To: Kees Cook
Cc: linux-kernel, Thomas Gleixner, Ingo Molnar, x86,
Konrad Rzeszutek Wilk, Jeremy Fitzhardinge, Marcelo Tosatti,
Alex Shi, Alexander Duyck, Frederic Weisbecker, Steven Rostedt,
Paul E. McKenney, xen-devel, virtualization, kernel-hardening,
Dan Rosenberg, Julien Tinnes, Will Drewry, Eric Northup
On 04/09/2013 09:39 AM, Kees Cook wrote:
> -
> static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
> {
> /* calling is from identify_secondary_cpu() ? */
> @@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
> /*
> * All current models of Pentium and Pentium with MMX technology CPUs
> * have the F0 0F bug, which lets nonprivileged users lock up the
> - * system.
> - * Note that the workaround only should be initialized once...
> + * system. Announce that the fault handler will be checking for it.
> */
> c->f00f_bug = 0;
> if (!paravirt_enabled() && c->x86 == 5) {
> @@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>
> c->f00f_bug = 1;
> if (!f00f_workaround_enabled) {
> - trap_init_f00f_bug();
> printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
> f00f_workaround_enabled = 1;
> }
Why do we care about this message anymore? It provides no relevant user
information, the flag itself is already in /proc/cpuinfo, and the
message is likely to be wrong since all it does is look for an Intel CPU
with family == 5.
-hpa
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v2] x86: use fixed read-only IDT
@ 2013-04-10 0:14 ` H. Peter Anvin
0 siblings, 0 replies; 10+ messages in thread
From: H. Peter Anvin @ 2013-04-10 0:14 UTC (permalink / raw)
To: Kees Cook
Cc: linux-kernel, Thomas Gleixner, Ingo Molnar, x86,
Konrad Rzeszutek Wilk, Jeremy Fitzhardinge, Marcelo Tosatti,
Alex Shi, Alexander Duyck, Frederic Weisbecker, Steven Rostedt,
Paul E. McKenney, xen-devel, virtualization, kernel-hardening,
Dan Rosenberg, Julien Tinnes, Will Drewry, Eric Northup
On 04/09/2013 09:39 AM, Kees Cook wrote:
> -
> static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
> {
> /* calling is from identify_secondary_cpu() ? */
> @@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
> /*
> * All current models of Pentium and Pentium with MMX technology CPUs
> * have the F0 0F bug, which lets nonprivileged users lock up the
> - * system.
> - * Note that the workaround only should be initialized once...
> + * system. Announce that the fault handler will be checking for it.
> */
> c->f00f_bug = 0;
> if (!paravirt_enabled() && c->x86 == 5) {
> @@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>
> c->f00f_bug = 1;
> if (!f00f_workaround_enabled) {
> - trap_init_f00f_bug();
> printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
> f00f_workaround_enabled = 1;
> }
Why do we care about this message anymore? It provides no relevant user
information, the flag itself is already in /proc/cpuinfo, and the
message is likely to be wrong since all it does is look for an Intel CPU
with family == 5.
-hpa
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v2] x86: use fixed read-only IDT
@ 2013-04-10 0:14 ` H. Peter Anvin
0 siblings, 0 replies; 10+ messages in thread
From: H. Peter Anvin @ 2013-04-10 0:14 UTC (permalink / raw)
To: Kees Cook
Cc: Alexander Duyck, Alex Shi, Jeremy Fitzhardinge, Will Drewry,
Julien Tinnes, Konrad Rzeszutek Wilk, Frederic Weisbecker,
Dan Rosenberg, x86, linux-kernel, Steven Rostedt, virtualization,
Ingo Molnar, kernel-hardening, Thomas Gleixner, Paul E. McKenney,
xen-devel
On 04/09/2013 09:39 AM, Kees Cook wrote:
> -
> static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
> {
> /* calling is from identify_secondary_cpu() ? */
> @@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
> /*
> * All current models of Pentium and Pentium with MMX technology CPUs
> * have the F0 0F bug, which lets nonprivileged users lock up the
> - * system.
> - * Note that the workaround only should be initialized once...
> + * system. Announce that the fault handler will be checking for it.
> */
> c->f00f_bug = 0;
> if (!paravirt_enabled() && c->x86 == 5) {
> @@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>
> c->f00f_bug = 1;
> if (!f00f_workaround_enabled) {
> - trap_init_f00f_bug();
> printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
> f00f_workaround_enabled = 1;
> }
Why do we care about this message anymore? It provides no relevant user
information, the flag itself is already in /proc/cpuinfo, and the
message is likely to be wrong since all it does is look for an Intel CPU
with family == 5.
-hpa
^ permalink raw reply [flat|nested] 10+ messages in thread* [kernel-hardening] Re: [PATCH v2] x86: use fixed read-only IDT
2013-04-10 0:14 ` H. Peter Anvin
(?)
@ 2013-04-10 0:29 ` Kees Cook
-1 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2013-04-10 0:29 UTC (permalink / raw)
To: H. Peter Anvin
Cc: LKML, Thomas Gleixner, Ingo Molnar, x86@kernel.org,
Konrad Rzeszutek Wilk, Jeremy Fitzhardinge, Marcelo Tosatti,
Alex Shi, Alexander Duyck, Frederic Weisbecker, Steven Rostedt,
Paul E. McKenney, xen-devel@lists.xensource.com,
virtualization@lists.linux-foundation.org,
kernel-hardening@lists.openwall.com, Dan Rosenberg, Julien Tinnes,
Will Drewry, Eric Northup
On Tue, Apr 9, 2013 at 5:14 PM, H. Peter Anvin <hpa@zytor.com> wrote:
> On 04/09/2013 09:39 AM, Kees Cook wrote:
>> -
>> static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
>> {
>> /* calling is from identify_secondary_cpu() ? */
>> @@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>> /*
>> * All current models of Pentium and Pentium with MMX technology CPUs
>> * have the F0 0F bug, which lets nonprivileged users lock up the
>> - * system.
>> - * Note that the workaround only should be initialized once...
>> + * system. Announce that the fault handler will be checking for it.
>> */
>> c->f00f_bug = 0;
>> if (!paravirt_enabled() && c->x86 == 5) {
>> @@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>>
>> c->f00f_bug = 1;
>> if (!f00f_workaround_enabled) {
>> - trap_init_f00f_bug();
>> printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
>> f00f_workaround_enabled = 1;
>> }
>
> Why do we care about this message anymore? It provides no relevant user
> information, the flag itself is already in /proc/cpuinfo, and the
> message is likely to be wrong since all it does is look for an Intel CPU
> with family == 5.
I have no objection to removing it, but with CONFIG_F00F_BUG, the trap
handler does still do some checking, and I figured this message was
there to notify people about it.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v2] x86: use fixed read-only IDT
@ 2013-04-10 0:29 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2013-04-10 0:29 UTC (permalink / raw)
To: H. Peter Anvin
Cc: LKML, Thomas Gleixner, Ingo Molnar, x86@kernel.org,
Konrad Rzeszutek Wilk, Jeremy Fitzhardinge, Marcelo Tosatti,
Alex Shi, Alexander Duyck, Frederic Weisbecker, Steven Rostedt,
Paul E. McKenney, xen-devel@lists.xensource.com,
virtualization@lists.linux-foundation.org,
kernel-hardening@lists.openwall.com, Dan Rosenberg, Julien Tinnes,
Will Drewry, Eric Northup
On Tue, Apr 9, 2013 at 5:14 PM, H. Peter Anvin <hpa@zytor.com> wrote:
> On 04/09/2013 09:39 AM, Kees Cook wrote:
>> -
>> static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
>> {
>> /* calling is from identify_secondary_cpu() ? */
>> @@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>> /*
>> * All current models of Pentium and Pentium with MMX technology CPUs
>> * have the F0 0F bug, which lets nonprivileged users lock up the
>> - * system.
>> - * Note that the workaround only should be initialized once...
>> + * system. Announce that the fault handler will be checking for it.
>> */
>> c->f00f_bug = 0;
>> if (!paravirt_enabled() && c->x86 == 5) {
>> @@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>>
>> c->f00f_bug = 1;
>> if (!f00f_workaround_enabled) {
>> - trap_init_f00f_bug();
>> printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
>> f00f_workaround_enabled = 1;
>> }
>
> Why do we care about this message anymore? It provides no relevant user
> information, the flag itself is already in /proc/cpuinfo, and the
> message is likely to be wrong since all it does is look for an Intel CPU
> with family == 5.
I have no objection to removing it, but with CONFIG_F00F_BUG, the trap
handler does still do some checking, and I figured this message was
there to notify people about it.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v2] x86: use fixed read-only IDT
@ 2013-04-10 0:29 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2013-04-10 0:29 UTC (permalink / raw)
To: H. Peter Anvin
Cc: Alexander Duyck, Alex Shi, Jeremy Fitzhardinge, Will Drewry,
Julien Tinnes, Konrad Rzeszutek Wilk, Frederic Weisbecker,
Dan Rosenberg, x86@kernel.org, LKML, Steven Rostedt,
virtualization@lists.linux-foundation.org, Ingo Molnar,
kernel-hardening@lists.openwall.com, Thomas Gleixner,
Paul E. McKenney, xen-devel@lists.xensource.com
On Tue, Apr 9, 2013 at 5:14 PM, H. Peter Anvin <hpa@zytor.com> wrote:
> On 04/09/2013 09:39 AM, Kees Cook wrote:
>> -
>> static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
>> {
>> /* calling is from identify_secondary_cpu() ? */
>> @@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>> /*
>> * All current models of Pentium and Pentium with MMX technology CPUs
>> * have the F0 0F bug, which lets nonprivileged users lock up the
>> - * system.
>> - * Note that the workaround only should be initialized once...
>> + * system. Announce that the fault handler will be checking for it.
>> */
>> c->f00f_bug = 0;
>> if (!paravirt_enabled() && c->x86 == 5) {
>> @@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
>>
>> c->f00f_bug = 1;
>> if (!f00f_workaround_enabled) {
>> - trap_init_f00f_bug();
>> printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
>> f00f_workaround_enabled = 1;
>> }
>
> Why do we care about this message anymore? It provides no relevant user
> information, the flag itself is already in /proc/cpuinfo, and the
> message is likely to be wrong since all it does is look for an Intel CPU
> with family == 5.
I have no objection to removing it, but with CONFIG_F00F_BUG, the trap
handler does still do some checking, and I figured this message was
there to notify people about it.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 10+ messages in thread
* [tip:x86/cpu] x86: Use a read-only IDT alias on all CPUs
2013-04-09 16:39 ` Kees Cook
` (2 preceding siblings ...)
(?)
@ 2013-04-10 0:26 ` tip-bot for Kees Cook
-1 siblings, 0 replies; 10+ messages in thread
From: tip-bot for Kees Cook @ 2013-04-10 0:26 UTC (permalink / raw)
To: linux-tip-commits
Cc: linux-kernel, hpa, mingo, keescook, digitaleric, tglx, hpa
Commit-ID: 1a138b534ac6063ccca1a534967df46edc0366c4
Gitweb: http://git.kernel.org/tip/1a138b534ac6063ccca1a534967df46edc0366c4
Author: Kees Cook <keescook@chromium.org>
AuthorDate: Tue, 9 Apr 2013 09:39:32 -0700
Committer: H. Peter Anvin <hpa@linux.intel.com>
CommitDate: Tue, 9 Apr 2013 17:08:50 -0700
x86: Use a read-only IDT alias on all CPUs
Make a copy of the IDT (as seen via the "sidt" instruction) read-only.
This primarily removes the IDT from being a target for arbitrary memory
write attacks, and has the added benefit of also not leaking the kernel
base offset, if it has been relocated.
We already did this on vendor == Intel and family == 5 because of the
F0 0F bug -- regardless of if a particular CPU had the F0 0F bug or
not. Since the workaround was so cheap, there simply was no reason to
be very specific. This patch extends the readonly alias to all CPUs,
but does not activate the #PF to #UD conversion code needed to deliver
the proper exception in the F0 0F case except on Intel family 5
processors.
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: http://lkml.kernel.org/r/20130409163932.GA19130@www.outflux.net
Cc: Eric Northup <digitaleric@google.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
---
arch/x86/include/asm/fixmap.h | 4 +---
arch/x86/kernel/cpu/intel.c | 18 +-----------------
arch/x86/kernel/traps.c | 8 ++++++++
arch/x86/xen/mmu.c | 4 +---
4 files changed, 11 insertions(+), 23 deletions(-)
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index a09c285..51b9e32 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -104,9 +104,7 @@ enum fixed_addresses {
FIX_LI_PCIA, /* Lithium PCI Bridge A */
FIX_LI_PCIB, /* Lithium PCI Bridge B */
#endif
-#ifdef CONFIG_X86_F00F_BUG
- FIX_F00F_IDT, /* Virtual mapping for IDT */
-#endif
+ FIX_RO_IDT, /* Virtual mapping for read-only IDT */
#ifdef CONFIG_X86_CYCLONE_TIMER
FIX_CYCLONE_TIMER, /*cyclone timer register*/
#endif
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 1acdd42..dcda985 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -164,20 +164,6 @@ int __cpuinit ppro_with_ram_bug(void)
return 0;
}
-#ifdef CONFIG_X86_F00F_BUG
-static void __cpuinit trap_init_f00f_bug(void)
-{
- __set_fixmap(FIX_F00F_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
-
- /*
- * Update the IDT descriptor and reload the IDT so that
- * it uses the read-only mapped virtual address.
- */
- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
- load_idt(&idt_descr);
-}
-#endif
-
static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c)
{
/* calling is from identify_secondary_cpu() ? */
@@ -206,8 +192,7 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
/*
* All current models of Pentium and Pentium with MMX technology CPUs
* have the F0 0F bug, which lets nonprivileged users lock up the
- * system.
- * Note that the workaround only should be initialized once...
+ * system. Announce that the fault handler will be checking for it.
*/
clear_cpu_bug(c, X86_BUG_F00F);
if (!paravirt_enabled() && c->x86 == 5) {
@@ -215,7 +200,6 @@ static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c)
set_cpu_bug(c, X86_BUG_F00F);
if (!f00f_workaround_enabled) {
- trap_init_f00f_bug();
printk(KERN_NOTICE "Intel Pentium with F0 0F bug - workaround enabled.\n");
f00f_workaround_enabled = 1;
}
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 68bda7a..a2a9b78 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -753,6 +753,14 @@ void __init trap_init(void)
#endif
/*
+ * Set the IDT descriptor to a fixed read-only location, so that the
+ * "sidt" instruction will not leak the location of the kernel, and
+ * to defend the IDT against arbitrary memory write vulnerabilities.
+ * It will be reloaded in cpu_init() */
+ __set_fixmap(FIX_RO_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
+ idt_descr.address = fix_to_virt(FIX_RO_IDT);
+
+ /*
* Should be a barrier for any external CPU state:
*/
cpu_init();
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 6afbb2c..8bc4dec 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2039,9 +2039,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
switch (idx) {
case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
-#ifdef CONFIG_X86_F00F_BUG
- case FIX_F00F_IDT:
-#endif
+ case FIX_RO_IDT:
#ifdef CONFIG_X86_32
case FIX_WP_TEST:
case FIX_VDSO:
^ permalink raw reply related [flat|nested] 10+ messages in thread