<fweis...@gmail.com>,"Luis R . Rodriguez" <mcg...@kernel.org>,Stanislaw Gruszka <sgrus...@redhat.com>,Peter Zijlstra <pet...@infradead.org>,Josh Poimboeuf <jpoim...@redhat.com>,Vitaly Kuznetsov <vkuzn...@redhat.com>,Tim Chen <tim.c.c...@linux.intel.com>,Joerg Roedel <j...@8bytes.org>,=?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrc...@redhat.com>,the arch/x86 maintainers <x...@kernel.org>,LKML <linux-ker...@vger.kernel.org>,linux-...@vger.kernel.org,kasan-dev <kasan-...@googlegroups.com>,Linux-MM <linux...@kvack.org>,Linux PM list <linux...@vger.kernel.org>,linux-...@vger.kernel.org,xen-de...@lists.xenproject.org,lgu...@lists.ozlabs.org,kvm list <k...@vger.kernel.org>,Kernel Hardening <kernel-harden...@lists.openwall.com> From: h...@zytor.com Message-ID: <550f6209-025a-45e2-84e2-f00a3771c...@zytor.com>
On March 14, 2017 2:20:19 PM PDT, Thomas Garnier <thgar...@google.com> wrote: >On Tue, Mar 14, 2017 at 2:04 PM, Pavel Machek <pa...@ucw.cz> wrote: >> On Tue 2017-03-14 10:05:08, Thomas Garnier wrote: >>> This patch makes the GDT remapped pages read-only to prevent >corruption. >>> This change is done only on 64-bit. >>> >>> The native_load_tr_desc function was adapted to correctly handle a >>> read-only GDT. The LTR instruction always writes to the GDT TSS >entry. >>> This generates a page fault if the GDT is read-only. This change >checks >>> if the current GDT is a remap and swap GDTs as needed. This function >was >>> tested by booting multiple machines and checking hibernation works >>> properly. >>> >>> KVM SVM and VMX were adapted to use the writeable GDT. On VMX, the >>> per-cpu variable was removed for functions to fetch the original >GDT. >>> Instead of reloading the previous GDT, VMX will reload the fixmap >GDT as >>> expected. For testing, VMs were started and restored on multiple >>> configurations. >>> >>> Signed-off-by: Thomas Garnier <thgar...@google.com> >> >> Can we get the same change for 32-bit, too? Growing differences >> between 32 and 64 bit are a bit of a problem... >> Pavel > >It was discussed on previous versions that 32-bit read-only support >would create issues that why it was favor for 64-bit only right now. > >> >> -- >> (english) http://www.livejournal.com/~pavelmachek >> (cesky, pictures) >http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html We can't make the GDT read-only on 32 bits since we use task switches for last-resort recovery. 64 bits has IST instead. -- Sent from my Android device with K-9 Mail. Please excuse my brevity. _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel
