[lkml]   [2019]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[patch V2 00/16] x86/iopl: Prevent user space from using CLI/STI with iopl(3)
This is the second version of the attempt to confine the unwanted side
effects of iopl(). The first version of this series can be found here:

The V1 cover letter also contains a longer variant of the
background. Summary:

iopl(level = 3) enables aside of access to all 65536 I/O ports also the
usage of CLI/STI in user space.

Disabling interrupts in user space can lead to system lockups and breaks
assumptions in the kernel that userspace always runs with interrupts

iopl() is often preferred over ioperm() as it avoids the overhead of
copying the tasks I/O bitmap to the TSS bitmap on context switch. This
overhead can be avoided by providing a all zeroes bitmap in the TSS and
switching the TSS bitmap offset to this permit all IO bitmap. It's
marginally slower than iopl() which is a one time setup, but prevents the
usage of CLI/STI in user space.

The changes vs. V1:

- Fix the reported fallout on 32bit (0-day/Ingo)

- Implement a sequence count based conditional update (Linus)

- Drop the copy optimization

- Move the bitmap copying out of the context switch into the exit to
user mode machinery. The context switch merely invalidates the TSS
bitmap offset when a task using an I/O bitmap gets scheduled out.

- Move all bitmap information into a data structure to avoid adding
more fields to thread_struct.

- Add a refcount so the potentially pointless duplication of the bitmap
at fork can be avoided.

- Better sharing of update functions (Andy)

- More updates to self tests to verify the share/unshare mechanism and
the restore of an I/O bitmap when iopl() permissions are dropped.

- Pick up a few acked/reviewed-by tags as applicable

The series is also available from git:

git:// WIP.x86/iopl


arch/x86/Kconfig | 26 ++++
arch/x86/entry/common.c | 4
arch/x86/include/asm/iobitmap.h | 25 ++++
arch/x86/include/asm/paravirt.h | 4
arch/x86/include/asm/paravirt_types.h | 2
arch/x86/include/asm/pgtable_32_types.h | 2
arch/x86/include/asm/processor.h | 97 +++++++++-------
arch/x86/include/asm/ptrace.h | 6
arch/x86/include/asm/switch_to.h | 10 +
arch/x86/include/asm/xen/hypervisor.h | 2
arch/x86/kernel/cpu/common.c | 175 +++++++++++-----------------
arch/x86/kernel/doublefault.c | 2
arch/x86/kernel/ioport.c | 176 ++++++++++++++++++-----------
arch/x86/kernel/paravirt.c | 2
arch/x86/kernel/process.c | 194 +++++++++++++++++++++++++-------
arch/x86/kernel/process_32.c | 77 ------------
arch/x86/kernel/process_64.c | 86 --------------
arch/x86/kernel/ptrace.c | 12 +
arch/x86/kvm/vmx/vmx.c | 8 -
arch/x86/mm/cpu_entry_area.c | 8 +
arch/x86/xen/enlighten_pv.c | 10 -
tools/testing/selftests/x86/ioperm.c | 16 ++
tools/testing/selftests/x86/iopl.c | 129 +++++++++++++++++++--
23 files changed, 614 insertions(+), 459 deletions(-)

 \ /
  Last update: 2019-11-11 23:37    [W:0.377 / U:1.352 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site