lkml.org 
[lkml]   [2019]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [PATCH v7 12/18] x86/fsgsbase/64: GSBASE handling with FSGSBASE in the paranoid path
Date

> On May 8, 2019, at 03:02, Chang S. Bae <chang.seok.bae@intel.com> wrote:
>
> ENTRY(paranoid_exit)
> …
> +
> + /* On FSGSBASE systems, always restore the stashed GSBASE */
> + wrgsbase %rbx
> + jmp .Lparanoid_exit_no_swapgs;

It would crash any time getting a paranoid entry with user GS but kernel CR3.
The issue is thankfully uncovered by Vegard N. A relevant test case will be
published by Andy L. The patch fixes the issue. (Rebased on the tip master.)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index b5e782a..dfdadc1 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1288,9 +1288,12 @@ ENTRY(paranoid_exit)
/* Handle GS depending on FSGSBASE availability */
ALTERNATIVE "jmp .Lparanoid_exit_checkgs", "nop",X86_FEATURE_FSGSBASE

+ TRACE_IRQS_IRETQ
+ /* Always restore stashed CR3 value (see paranoid_entry) */
+ RESTORE_CR3 scratch_reg=%rax save_reg=%r14
/* With FSGSBASE enabled, unconditionally restore GSBASE */
wrgsbase %rbx
- jmp .Lparanoid_exit_no_swapgs;
+ jmp .Lparanoid_exit_restore;

.Lparanoid_exit_checkgs:
/* On non-FSGSBASE systems, conditionally do SWAPGS */

> ...
> .Lparanoid_exit_no_swapgs:
> TRACE_IRQS_IRETQ_DEBUG
> /* Always restore stashed CR3 value (see paranoid_entry) */
> RESTORE_CR3 scratch_reg=%rbx save_reg=%r14
> +
> .Lparanoid_exit_restore:
> - jmp restore_regs_and_return_to_kernel
> + jmp restore_regs_and_return_to_kernel
> END(paranoid_exit)
>


\
 
 \ /
  Last update: 2019-06-29 09:22    [W:0.255 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site