diff options
| author | Lai Jiangshan <jiangshan.ljs@antfin.com> | 2020-03-26 09:23:23 +0000 |
|---|---|---|
| committer | Lai Jiangshan <laijs@linux.alibaba.com> | 2020-08-06 21:31:51 +0800 |
| commit | 9cae407b270b20ff78370d33602191d37ddf5530 (patch) | |
| tree | 10eab7c5ead6e54bc2a5bc50bd40e581ec1bcb94 /pkg/sentry/socket/hostinet/socket.go | |
| parent | 6ce10c3c2ff516aabdef8b4d198690e7e7a87ca4 (diff) | |
amd64: implement KPTI for gvisor
Actually, gvisor has KPTI (Kernel PageTable Isolation) between
gr0 and gr3. But the upper half of the userCR3 contains the
whole sentry kernel which makes the kernel vulnerable to
gr3 APP through CPU bugs.
This patch implement full KPTI functionality for gvisor. It doesn't
map the whole kernel in the upper. It maps only the text section
of the binary and the entry area required by the ISA. The entry area
contains the global idt, the percpu gdt/tss etc. The entry area
packs all these together which is less than 350k for 512 vCPUs.
The text section is normally nonsensitive. It is possible to
map only the entry functions (interrupt handler etc.) only.
But it requires some hacks.
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antfin.com>
Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
Diffstat (limited to 'pkg/sentry/socket/hostinet/socket.go')
0 files changed, 0 insertions, 0 deletions