x86/mm/pti: Allow NX poison to be set in p4d/pgd

hansendc · Ingo Molnar · commit 1c4de1ff4fe5 · 2017-12-23T21:13:00.000+01:00
With PAGE_TABLE_ISOLATION the user portion of the kernel page tables is
poisoned with the NX bit so if the entry code exits with the kernel page
tables selected in CR3, userspace crashes.

But doing so trips the p4d/pgd_bad() checks.  Make sure it does not do
that.

Signed-off-by: Dave Hansen &lt;dave.hansen@linux.intel.com&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Reviewed-by: Borislav Petkov &lt;bp@suse.de&gt;
Cc: Andy Lutomirski &lt;luto@kernel.org&gt;
Cc: Boris Ostrovsky &lt;boris.ostrovsky@oracle.com&gt;
Cc: Borislav Petkov &lt;bp@alien8.de&gt;
Cc: Brian Gerst &lt;brgerst@gmail.com&gt;
Cc: David Laight &lt;David.Laight@aculab.com&gt;
Cc: Denys Vlasenko &lt;dvlasenk@redhat.com&gt;
Cc: Eduardo Valentin &lt;eduval@amazon.com&gt;
Cc: Greg KH &lt;gregkh@linuxfoundation.org&gt;
Cc: H. Peter Anvin &lt;hpa@zytor.com&gt;
Cc: Josh Poimboeuf &lt;jpoimboe@redhat.com&gt;
Cc: Juergen Gross &lt;jgross@suse.com&gt;
Cc: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Will Deacon &lt;will.deacon@arm.com&gt;
Cc: aliguori@amazon.com
Cc: daniel.gruss@iaik.tugraz.at
Cc: hughd@google.com
Cc: keescook@google.com
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
@@ -846,7 +846,12 @@ static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
 
 static inline int p4d_bad(p4d_t p4d)
 {
-	return (p4d_flags(p4d) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
+	unsigned long ignore_flags = _KERNPG_TABLE | _PAGE_USER;
+
+	if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+		ignore_flags |= _PAGE_NX;
+
+	return (p4d_flags(p4d) & ~ignore_flags) != 0;
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 
@@ -880,7 +885,12 @@ static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
 
 static inline int pgd_bad(pgd_t pgd)
 {
-	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
+	unsigned long ignore_flags = _PAGE_USER;
+
+	if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+		ignore_flags |= _PAGE_NX;
+
+	return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
 }
 
 static inline int pgd_none(pgd_t pgd)

Original file line number	Diff line number	Diff line change
`@@ -846,7 +846,12 @@ static inline pud_t pud_offset(p4d_t p4d, unsigned long address)`
`846`	`846`
`847`	`847`	`static inline int p4d_bad(p4d_t p4d)`
`848`	`848`	`{`
`849`		`- return (p4d_flags(p4d) & ~(_KERNPG_TABLE \| _PAGE_USER)) != 0;`
	`849`	`+ unsigned long ignore_flags = _KERNPG_TABLE \| _PAGE_USER;`
	`850`	`+`
	`851`	`+ if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))`
	`852`	`+ ignore_flags \|= _PAGE_NX;`
	`853`	`+`
	`854`	`+ return (p4d_flags(p4d) & ~ignore_flags) != 0;`
`850`	`855`	`}`
`851`	`856`	`#endif /* CONFIG_PGTABLE_LEVELS > 3 */`
`852`	`857`
`@@ -880,7 +885,12 @@ static inline p4d_t p4d_offset(pgd_t pgd, unsigned long address)`
`880`	`885`
`881`	`886`	`static inline int pgd_bad(pgd_t pgd)`
`882`	`887`	`{`
`883`		`- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;`
	`888`	`+ unsigned long ignore_flags = _PAGE_USER;`
	`889`	`+`
	`890`	`+ if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))`
	`891`	`+ ignore_flags \|= _PAGE_NX;`
	`892`	`+`
	`893`	`+ return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;`
`884`	`894`	`}`
`885`	`895`
`886`	`896`	`static inline int pgd_none(pgd_t pgd)`