linux/drivers/lguest
Thomas Garnier 69218e4799 x86: Remap GDT tables in the fixmap section
Each processor holds a GDT in its per-cpu structure. The sgdt
instruction gives the base address of the current GDT. This address can
be used to bypass KASLR memory randomization. With another bug, an
attacker could target other per-cpu structures or deduce the base of
the main memory section (PAGE_OFFSET).

This patch relocates the GDT table for each processor inside the
fixmap section. The space is reserved based on number of supported
processors.

For consistency, the remapping is done by default on 32 and 64-bit.

Each processor switches to its remapped GDT at the end of
initialization. For hibernation, the main processor returns with the
original GDT and switches back to the remapping at completion.

This patch was tested on both architectures. Hibernation and KVM were
both tested specially for their usage of the GDT.

Thanks to Boris Ostrovsky <boris.ostrovsky@oracle.com> for testing and
recommending changes for Xen support.

Signed-off-by: Thomas Garnier <thgarnie@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Len Brown <len.brown@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Luis R . Rodriguez <mcgrof@kernel.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Rafael J . Wysocki <rjw@rjwysocki.net>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: kasan-dev@googlegroups.com
Cc: kernel-hardening@lists.openwall.com
Cc: kvm@vger.kernel.org
Cc: lguest@lists.ozlabs.org
Cc: linux-doc@vger.kernel.org
Cc: linux-efi@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: linux-pm@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Cc: zijun_hu <zijun_hu@htc.com>
Link: http://lkml.kernel.org/r/20170314170508.100882-2-thgarnie@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-03-16 09:06:35 +01:00
..
x86 x86: Remap GDT tables in the fixmap section 2017-03-16 09:06:35 +01:00
Kconfig lguest: now needs PCI_DIRECT. 2015-04-01 10:29:05 -07:00
Makefile lguest: remove support for lguest bus. 2015-02-11 16:47:41 +10:30
README lguest: documentation I: Preparation 2007-07-26 11:35:16 -07:00
core.c sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> 2017-03-02 08:42:32 +01:00
hypercalls.c x86/fpu, lguest: Remove CR0.TS support 2016-11-01 07:47:54 +01:00
interrupts_and_traps.c lguest, x86/entry/32: Fix handling of guest syscalls using interrupt gates 2016-04-01 08:58:13 +02:00
lg.h x86/fpu, lguest: Remove CR0.TS support 2016-11-01 07:47:54 +01:00
lguest_user.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/mm.h> 2017-03-02 08:42:28 +01:00
page_tables.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
segments.c lguest: switch segment-voodoo-numbers to readable symbols 2012-01-12 15:44:47 +10:30

README

Welcome, friend reader, to lguest.

Lguest is an adventure, with you, the reader, as Hero.  I can't think of many
5000-line projects which offer both such capability and glimpses of future
potential; it is an exciting time to be delving into the source!

But be warned; this is an arduous journey of several hours or more!  And as we
know, all true Heroes are driven by a Noble Goal.  Thus I offer a Beer (or
equivalent) to anyone I meet who has completed this documentation.

So get comfortable and keep your wits about you (both quick and humorous).
Along your way to the Noble Goal, you will also gain masterly insight into
lguest, and hypervisors and x86 virtualization in general.

Our Quest is in seven parts: (best read with C highlighting turned on)

I) Preparation
	- In which our potential hero is flown quickly over the landscape for a
	  taste of its scope.  Suitable for the armchair coders and other such
	  persons of faint constitution.

II) Guest
	- Where we encounter the first tantalising wisps of code, and come to
	  understand the details of the life of a Guest kernel.

III) Drivers
	- Whereby the Guest finds its voice and become useful, and our
	  understanding of the Guest is completed.

IV) Launcher
	- Where we trace back to the creation of the Guest, and thus begin our
	  understanding of the Host.

V) Host
	- Where we master the Host code, through a long and tortuous journey.
	  Indeed, it is here that our hero is tested in the Bit of Despair.

VI) Switcher
	- Where our understanding of the intertwined nature of Guests and Hosts
	  is completed.

VII) Mastery
	- Where our fully fledged hero grapples with the Great Question:
	  "What next?"

make Preparation!
Rusty Russell.