linux-kernel - Re: [PATCH V4 1/7] x86/traps: Move pt_regs only in fixup_bad

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 6 Apr 2022 21:00:38 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Lai Jiangshan <jiangshanlai@...il.com>
Cc:     linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andy Lutomirski <luto@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org,
        Lai Jiangshan <jiangshan.ljs@...group.com>,
        Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Thomas Tai <thomas.tai@...cle.com>,
        "Chang S. Bae" <chang.seok.bae@...el.com>,
        Masami Hiramatsu <mhiramat@...nel.org>
Subject: Re: [PATCH V4 1/7] x86/traps: Move pt_regs only in fixup_bad_iret()

On Fri, Mar 18, 2022 at 10:30:10PM +0800, Lai Jiangshan wrote:
> From: Lai Jiangshan <jiangshan.ljs@...group.com>
> 
> fixup_bad_iret() and sync_regs() have similar arguments and do similar
> work that copies full or partial pt_regs to a place and switches stack
> after return.  They are quite the same, but fixup_bad_iret() not only
> copies the pt_regs but also the return address of error_entry() while

What return address of error_entry()? You lost me here.

fixup_bad_iret() moves the stack frame while sync_regs() switches to the
thread stack. I have no clue what you mean.

> sync_regs() copies the pt_regs only and the return address of
> error_entry() was preserved and handled in ASM code.

Nope, no idea.
 
> This patch makes fixup_bad_iret() work like sync_regs() and the

Avoid having "This patch" or "This commit" in the commit message. It is
tautologically useless.

Also, do

$ git grep 'This patch' Documentation/process

for more details.

> handling of the return address of error_entry() is moved in ASM code.
> 
> It removes the need to use the struct bad_iret_stack, simplifies
> fixup_bad_iret() and makes the ASM error_entry() call fixup_bad_iret()
> as the same as calling sync_regs() which adds readability because
> the calling patterns are exactly the same.

So fixup_bad_iret() gets the stack ptr passed in by doing:

        mov     %rsp, %rdi
        call    fixup_bad_iret
        mov     %rax, %rsp


and error_regs()

        movq    %rsp, %rdi                      /* arg0 = pt_regs pointer */
        call    sync_regs
        movq    %rax, %rsp                      /* switch stack */

the same way.

Confused.

> It is prepared for later patch to do the stack switch after the
> error_entry() which simplifies the code further.

Looking at your next patch, is all this dance done just so that you can
do

	leaq    8(%rsp), %rdi

in order to pass in pt_regs to both functions?

And get rid of the saving/restoring %r12?

Is that what the whole noise is about?

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette