Messages in this thread | | | From | Andy Lutomirski <> | Date | Sun, 26 Apr 2015 16:39:38 -0700 | Subject | Re: [PATCH] x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue |
| |
> > diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h > index 7ee9b94d9921..8d555b046fe9 100644 > --- a/arch/x86/include/asm/cpufeature.h > +++ b/arch/x86/include/asm/cpufeature.h > @@ -265,6 +265,7 @@ > #define X86_BUG_11AP X86_BUG(5) /* Bad local APIC aka 11AP */ > #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ > #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ > +#define X86_BUG_CANONICAL_RCX X86_BUG(8) /* SYSRET #GPs when %RCX non-canonical */
I think that "sysret" should appear in the name.
> > #if defined(__KERNEL__) && !defined(__ASSEMBLY__) > > diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c > index 50163fa9034f..109a51815e92 100644 > --- a/arch/x86/kernel/cpu/intel.c > +++ b/arch/x86/kernel/cpu/intel.c > @@ -159,6 +159,8 @@ static void early_init_intel(struct cpuinfo_x86 *c) > pr_info("Disabling PGE capability bit\n"); > setup_clear_cpu_cap(X86_FEATURE_PGE); > } > + > + set_cpu_bug(c, X86_BUG_CANONICAL_RCX);
Oh no! My laptop is currently bug-free, and you're breaking it! :)
> } > > #ifdef CONFIG_X86_32 > diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S > index e952f6bf1d6d..d01fb6c1362f 100644 > --- a/arch/x86/kernel/entry_64.S > +++ b/arch/x86/kernel/entry_64.S > @@ -415,16 +415,20 @@ syscall_return: > jne opportunistic_sysret_failed > > /* > - * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP > - * in kernel space. This essentially lets the user take over > - * the kernel, since userspace controls RSP. > - * > * If width of "canonical tail" ever becomes variable, this will need > * to be updated to remain correct on both old and new CPUs. > */ > .ifne __VIRTUAL_MASK_SHIFT - 47 > .error "virtual address width changed -- SYSRET checks need update" > .endif > + > + /* > + * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP > + * in kernel space. This essentially lets the user take over > + * the kernel, since userspace controls RSP. > + */ > + ALTERNATIVE "jmp 1f", "", X86_BUG_CANONICAL_RCX > +
I know it would be ugly, but would it be worth saving two bytes by using ALTERNATIVE "jmp 1f", "shl ...", ...?
> /* Change top 16 bits to be the sign-extension of 47th bit */ > shl $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx > sar $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx > @@ -432,6 +436,7 @@ syscall_return: > cmpq %rcx, %r11 > jne opportunistic_sysret_failed > > +1: > cmpq $__USER_CS,CS(%rsp) /* CS must match SYSRET */ > jne opportunistic_sysret_failed
--Andy
| |