linux-kernel - Re: [PATCH] x86/asm/entry/64: better check for canonical address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 27 Mar 2015 13:31:47 +0100
From:	Denys Vlasenko <dvlasenk@...hat.com>
To:	Ingo Molnar <mingo@...nel.org>
CC:	Brian Gerst <brgerst@...il.com>,
	Andy Lutomirski <luto@...capital.net>,
	Borislav Petkov <bp@...en8.de>,
	the arch/x86 maintainers <x86@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] x86/asm/entry/64: better check for canonical address

On 03/27/2015 01:16 PM, Ingo Molnar wrote:
>>> Indeed, an IRET ought to be pretty cheap for same-ring interrupt 
>>> returns in any case.
>>
>> Unfortunately, it is not. Try attached program.
>>
>> On this CPU, 1 ns ~= 3 cycles.
>>
>> $ ./timing_test64 callret
>> 10000 loops in 0.00008s = 7.87 nsec/loop for callret
>> 100000 loops in 0.00076s = 7.56 nsec/loop for callret
>> 1000000 loops in 0.00548s = 5.48 nsec/loop for callret
>> 10000000 loops in 0.02882s = 2.88 nsec/loop for callret
>> 100000000 loops in 0.18334s = 1.83 nsec/loop for callret
>> 200000000 loops in 0.36051s = 1.80 nsec/loop for callret
>> 400000000 loops in 0.71632s = 1.79 nsec/loop for callret
>>
>> Near call + near ret = 5 cycles
>>
>> $ ./timing_test64 lret
>> 10000 loops in 0.00034s = 33.95 nsec/loop for lret
>> 100000 loops in 0.00328s = 32.83 nsec/loop for lret
>> 1000000 loops in 0.04541s = 45.41 nsec/loop for lret
>> 10000000 loops in 0.32130s = 32.13 nsec/loop for lret
>> 20000000 loops in 0.64191s = 32.10 nsec/loop for lret
>>
>> push my_cs + push next_label + far ret = ~90 cycles
>>
>> $ ./timing_test64 iret
>> 10000 loops in 0.00344s = 343.90 nsec/loop for iret
>> 100000 loops in 0.01890s = 188.97 nsec/loop for iret
>> 1000000 loops in 0.08228s = 82.28 nsec/loop for iret
>> 10000000 loops in 0.77910s = 77.91 nsec/loop for iret
>>
>> This is the "same-ring interrupt return". ~230 cycles!  :(
> 
> Ugh, that's really expensive! Why is that so? Same-ring irqs are 
> supposedly a lot simpler.

Descriptor checks for restored CS and SS,
checking canonical-ness of RIP,
supporting "return to TSS" (flags.NT bit),
"return to VM86" (flags.VM bit),
complex logic around restoring RFLAGS
  ("don't allow CPL3 to be able to disable interrupts...
  ...unless their flags.IOPL is 3." Gasp)
return to 16-bit code ("do not touch high 16 bits")

All of this is a giant PITA to encode in microcode.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/