linux-kernel - Re: [PATCH 22/43] x86/mm/kaiser: Prepare assembly for entry/exit CR3 switching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171124121706.ldrmycmmquenhap7@gmail.com>
Date:   Fri, 24 Nov 2017 13:17:06 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     linux-kernel@...r.kernel.org,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...capital.net>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H . Peter Anvin" <hpa@...or.com>, Borislav Petkov <bp@...en8.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 22/43] x86/mm/kaiser: Prepare assembly for entry/exit CR3
 switching


* Peter Zijlstra <peterz@...radead.org> wrote:

> On Fri, Nov 24, 2017 at 10:14:27AM +0100, Ingo Molnar wrote:
> > Interactions with SWAPGS: previous versions of the KAISER code
> > relied on having per-cpu scratch space to save/restore a register
> > that can be used for the CR3 MOV.  The %GS register is used to
> > index into our per-cpu space, so SWAPGS *had* to be done before
> > the CR3 switch.  That scratch space is gone now, but the semantic
> > that SWAPGS must be done before the CR3 MOV is retained.  This is
> > good to keep because it is not that hard to do and it allows us
> > to do things like add per-cpu debugging information to help us
> > figure out what goes wrong sometimes.
> 
> > +.macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req
> > +	movq	%cr3, %r\scratch_reg
> > +	movq	%r\scratch_reg, \save_reg
> > +	/*
> > +	 * Is the switch bit zero?  This means the address is
> > +	 * up in real KAISER patches in a moment.
> > +	 */
> > +	testq	$(KAISER_SWITCH_MASK), %r\scratch_reg
> > +	jz	.Ldone_\@
> > +
> > +	ADJUST_KERNEL_CR3 %r\scratch_reg
> > +	movq	%r\scratch_reg, %cr3
> > +
> > +.Ldone_\@:
> > +.endm
> 
> > @@ -1333,6 +1362,7 @@ ENTRY(error_entry)
> >  	 * gsbase and proceed.  We'll fix up the exception and land in
> >  	 * .Lgs_change's error handler with kernel gsbase.
> >  	 */
> > +	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
> >  	SWAPGS
> >  	jmp .Lerror_entry_done
> >  
> 
> > @@ -1343,9 +1373,10 @@ ENTRY(error_entry)
> >  
> >  .Lerror_bad_iret:
> >  	/*
> > -	 * We came from an IRET to user mode, so we have user gsbase.
> > -	 * Switch to kernel gsbase:
> > +	 * We came from an IRET to user mode, so we have user
> > +	 * gsbase and CR3.  Switch to kernel gsbase and CR3:
> >  	 */
> > +	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
> >  	SWAPGS
> >  
> >  	/*
> 
> The Changelog states SWAPGS must be done before, yet the code does
> after.

Yes, so this is the SWAPGS that is done before we go back to user-space.

Thanks,

	Ingo