linux-kernel - Re: [PATCH v12 19/37] x86/fred: Update MSR_IA32_FRED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Nov 2023 12:36:04 -0500
From:   "H. Peter Anvin" <hpa@...or.com>
To:     Borislav Petkov <bp@...en8.de>, Xin Li <xin3.li@...el.com>
CC:     linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-edac@...r.kernel.org, linux-hyperv@...r.kernel.org,
        kvm@...r.kernel.org, xen-devel@...ts.xenproject.org,
        tglx@...utronix.de, mingo@...hat.com, dave.hansen@...ux.intel.com,
        x86@...nel.org, luto@...nel.org, pbonzini@...hat.com,
        seanjc@...gle.com, peterz@...radead.org, jgross@...e.com,
        ravi.v.shankar@...el.com, mhiramat@...nel.org,
        andrew.cooper3@...rix.com, jiangshanlai@...il.com,
        nik.borisov@...e.com
Subject: Re: [PATCH v12 19/37] x86/fred: Update MSR_IA32_FRED_RSP0 during task switch

On November 13, 2023 4:37:42 AM EST, Borislav Petkov <bp@...en8.de> wrote:
>On Mon, Oct 02, 2023 at 11:24:40PM -0700, Xin Li wrote:
>> From: "H. Peter Anvin (Intel)" <hpa@...or.com>
>> 
>> MSR_IA32_FRED_RSP0 is used during ring 3 event delivery, and needs to
>> be updated to point to the top of next task stack during task switch.
>> 
>> Signed-off-by: H. Peter Anvin (Intel) <hpa@...or.com>
>> Tested-by: Shan Kang <shan.kang@...el.com>
>> Signed-off-by: Xin Li <xin3.li@...el.com>
>> ---
>>  arch/x86/include/asm/switch_to.h | 8 ++++++--
>>  1 file changed, 6 insertions(+), 2 deletions(-)
>> 
>> diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
>> index f42dbf17f52b..c3bd0c0758c9 100644
>> --- a/arch/x86/include/asm/switch_to.h
>> +++ b/arch/x86/include/asm/switch_to.h
>> @@ -70,9 +70,13 @@ static inline void update_task_stack(struct task_struct *task)
>>  #ifdef CONFIG_X86_32
>>  	this_cpu_write(cpu_tss_rw.x86_tss.sp1, task->thread.sp0);
>>  #else
>> -	/* Xen PV enters the kernel on the thread stack. */
>> -	if (cpu_feature_enabled(X86_FEATURE_XENPV))
>> +	if (cpu_feature_enabled(X86_FEATURE_FRED)) {
>> +		/* WRMSRNS is a baseline feature for FRED. */
>> +		wrmsrns(MSR_IA32_FRED_RSP0, (unsigned long)task_stack_page(task) + THREAD_SIZE);
>
>If this non-serializing write happens now and, AFAICT, the CR3 write
>during the task switch has already happened in switch_mm* earlier, what
>is the serialization point that's going to make sure that write is
>committed before the new task starts executing?
>
>Thx.
>

A resource cannot be consumed after the value has been written; this is the only necessary level of serialization, equivalent to, say, RAX.

A serializing instruction stops the entire pipeline until everything has retired and any stores have become globally visible.