linux-kernel - Re: [Xen-devel] Re: [patch 17/24] Xen-paravirt_ops: avoid having a bad selector in %gs during context switch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 Feb 2007 15:25:04 -0800
From:	Zachary Amsden <zach@...are.com>
To:	Andi Kleen <ak@...e.de>
CC:	virtualization@...ts.osdl.org, Chris Wright <chrisw@...s-sol.org>,
	Jeremy Fitzhardinge <jeremy@...p.org>,
	xen-devel@...ts.xensource.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: [Xen-devel] Re: [patch 17/24] Xen-paravirt_ops: avoid having
 a bad	selector in %gs during context switch

Andi Kleen wrote:
>>  	/*
>> +	 * Temporary hack: zero gs now that we've saved it so that Xen
>> +	 * doesn't try to reload the old value after changing the GDT
>> +	 * during the context switch.  This can go away once Xen has
>> +	 * been taught to only reload %gs when it absolutely must.
>> +	 */
>> +	loadsegment(gs, 0);
>>     
>
> Sorry, but i don't really want that unconditionally in the context switch.
> Adding a paravirt ops for it would be also ugly. Can Xen be fixed?
>   

I agree with that, but especially because this is not even the right 
place to save and clear gs; when userspace uses an LDT based %gs, you 
need to do this all the way back in mmu_context.h before you switch the 
LDT out.  We have the same bug, but I was loathe to try to fix it yet, 
since it could mean some strange code movement.  The awkward bit is that 
switch_mm doesn't have the pointer to the previous task, only it's mm, 
so there is no place to save gs.  Perhaps it is time to move the LDT 
switch into switch_to instead of switch_mm?  It's not like there are 
different per-process LDTs in the fixmap or something, which I could see 
as a valid reason to associate this with the mm switch.  But all process 
LDTs are global, so there isn't an issue.

And I noticed this martian hanging out in mmu_context.h:

#define deactivate_mm(tsk, mm)                  \
        asm("movl %0,%%gs": :"r" (0));

Zach
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/