linux-kernel - Re: [PATCH 22/43] x86/mm/kaiser: Prepare assembly for entry/exit CR3 switching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 24 Nov 2017 13:05:16 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Ingo Molnar <mingo@...nel.org>
Cc:     linux-kernel@...r.kernel.org,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...capital.net>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H . Peter Anvin" <hpa@...or.com>, Borislav Petkov <bp@...en8.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 22/43] x86/mm/kaiser: Prepare assembly for entry/exit CR3
 switching

On Fri, Nov 24, 2017 at 10:14:27AM +0100, Ingo Molnar wrote:
> Interactions with SWAPGS: previous versions of the KAISER code
> relied on having per-cpu scratch space to save/restore a register
> that can be used for the CR3 MOV.  The %GS register is used to
> index into our per-cpu space, so SWAPGS *had* to be done before
> the CR3 switch.  That scratch space is gone now, but the semantic
> that SWAPGS must be done before the CR3 MOV is retained.  This is
> good to keep because it is not that hard to do and it allows us
> to do things like add per-cpu debugging information to help us
> figure out what goes wrong sometimes.

> +.macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req
> +	movq	%cr3, %r\scratch_reg
> +	movq	%r\scratch_reg, \save_reg
> +	/*
> +	 * Is the switch bit zero?  This means the address is
> +	 * up in real KAISER patches in a moment.
> +	 */
> +	testq	$(KAISER_SWITCH_MASK), %r\scratch_reg
> +	jz	.Ldone_\@
> +
> +	ADJUST_KERNEL_CR3 %r\scratch_reg
> +	movq	%r\scratch_reg, %cr3
> +
> +.Ldone_\@:
> +.endm

> @@ -1333,6 +1362,7 @@ ENTRY(error_entry)
>  	 * gsbase and proceed.  We'll fix up the exception and land in
>  	 * .Lgs_change's error handler with kernel gsbase.
>  	 */
> +	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
>  	SWAPGS
>  	jmp .Lerror_entry_done
>  

> @@ -1343,9 +1373,10 @@ ENTRY(error_entry)
>  
>  .Lerror_bad_iret:
>  	/*
> -	 * We came from an IRET to user mode, so we have user gsbase.
> -	 * Switch to kernel gsbase:
> +	 * We came from an IRET to user mode, so we have user
> +	 * gsbase and CR3.  Switch to kernel gsbase and CR3:
>  	 */
> +	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
>  	SWAPGS
>  
>  	/*

The Changelog states SWAPGS must be done before, yet the code does
after.