linux-kernel - Re: [patch 02/38] x86/cpu: Use native_wrmsrl() in load_percpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 17 Jul 2022 22:08:16 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Andrew Cooper <Andrew.Cooper3@...rix.com>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     "x86@...nel.org" <x86@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
        Johannes Wikner <kwikner@...z.ch>,
        Alyssa Milburn <alyssa.milburn@...ux.intel.com>,
        Jann Horn <jannh@...gle.com>, "H.J. Lu" <hjl.tools@...il.com>,
        Joao Moreira <joao.moreira@...el.com>,
        Joseph Nuzman <joseph.nuzman@...el.com>,
        Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [patch 02/38] x86/cpu: Use native_wrmsrl() in
 load_percpu_segment()

On Sun, Jul 17 2022 at 21:08, Thomas Gleixner wrote:
> On Sun, Jul 17 2022 at 00:22, Andrew Cooper wrote:
>>  #ifdef CONFIG_X86_32
>>  /* The 32-bit entry code needs to find cpu_entry_area. */
>>  DEFINE_PER_CPU(struct cpu_entry_area *, cpu_entry_area);
>> @@ -742,12 +732,15 @@ EXPORT_SYMBOL_GPL(load_fixmap_gdt);
>>   * Current gdt points %fs at the "master" per-cpu area: after this,
>>   * it's on the real one.
>>   */
>> -void switch_to_new_gdt(int cpu)
>> +void __noinstr switch_to_new_gdt(int cpu)
>>  {
>>         /* Load the original GDT */
>>         load_direct_gdt(cpu);
>> +
>> +#ifdef CONFIG_X86_32
>>         /* Reload the per-cpu base */
>> -       load_percpu_segment(cpu);
>> +       loadsegment(fs, __KERNEL_PERCPU);
>> +#endif
>>  }
>>  
>>  static const struct cpu_dev *cpu_devs[X86_VENDOR_NUM] = {};
>>
>>
>> It's only 32bit where the percpu pointer is tied to the GDT.  On 64bit,
>> gsbase is good before this, and remains good after.
>>
>> With this change,
>>
>> # Make sure load_percpu_segment has no stackprotector
>> CFLAGS_common.o         := -fno-stack-protector
>>
>> comes up for re-evaluation too.
>
> Good point. Let me stare at it some more.

If it only would be that simple :)

loadsegment_simple() was a red herring. The gs segment is already zero.

So what explodes here is the early boot when switching from early per
CPU to the real per CPU area.

start_kernel()
        .....
        setup_per_cpu_areas();
        smp_prepare_boot_cpu()
          switch_to_new_gdt()
       	     load_direct_gdt(cpu);
          load_percpu_segment(cpu)
            GS: 0
            GS_BASE: 0xffffffff829d0000 (early PERCPU) 
            wrmsrl()
            GS_BASE: 0xffff888237c00000 (real PERCPU)

So the explosion happens when accessing a per CPU variable after loading
the GDT and before GS_BASE is fixed up.

That's the only case AFAICT where this matters. In all other invocations
GS_BASE is already correct.

Let me fix this proper.

Thanks,

        tglx