The current state of kernel page-table isolation

Posted Dec 20, 2017 18:43 UTC (Wed) by josh (subscriber, #17465)
In reply to: The current state of kernel page-table isolation by luto
Parent article: The current state of kernel page-table isolation

Would it be reasonable to add a CONFIG option to completely disable LDT support, for the *large* number of systems that don't need it?

The current state of kernel page-table isolation

Posted Dec 20, 2017 19:59 UTC (Wed) by luto (guest, #39314) [Link] (2 responses)

It's already there :) CONFIG_SYSCALL_MODIFY_LDT or something like that.

The current state of kernel page-table isolation

Posted Dec 20, 2017 20:06 UTC (Wed) by josh (subscriber, #17465) [Link] (1 responses)

Does the additional LDT handling mentioned in the article (having an extra PGD for LDTs) get skipped and compiled out in that case?

The current state of kernel page-table isolation

Posted Dec 22, 2017 17:57 UTC (Fri) by luto (guest, #39314) [Link]

I think so. It's actually very little code, and the PGD entry isn't allocated until someone actually calls modify_ldt()

The current state of kernel page-table isolation

Posted Dec 21, 2017 14:35 UTC (Thu) by dvrabel (subscriber, #9500) [Link] (3 responses)

The go runtime uses (or has used, I've not checked if the latest version of go still does this) the LDT, so there are probably fewer systems out there that don't need LDT support than you think.

The current state of kernel page-table isolation

Posted Dec 21, 2017 15:25 UTC (Thu) by luto (guest, #39314) [Link] (2 responses)

Indeed: https://github.com/golang/go/issues/14795

The Go runtime is, in my experience, really quite crappy. This isn't the first time it's been caught using a wildly outdated kernel feature.

The current state of kernel page-table isolation

Posted Dec 25, 2017 20:20 UTC (Mon) by roc (subscriber, #30627) [Link]

And "redzone? what redzone?"

The current state of kernel page-table isolation

Posted Dec 27, 2017 16:47 UTC (Wed) by zlynx (guest, #2285) [Link]

It's still better than container runtimes last updated in 2010.