Messages in this thread Patch in this message | | | From | Lai Jiangshan <> | Subject | [PATCH V3 02/49] x86/entry: Use the correct fence macro after swapgs in kernel CR3 | Date | Thu, 14 Oct 2021 11:13:25 +0800 |
| |
From: Lai Jiangshan <laijs@linux.alibaba.com>
The commit c75890700455 ("x86/entry/64: Remove unneeded kernel CR3 switching") removes a CR3 write in the faulting path of load_gs_index.
But the path's FENCE_SWAPGS_USER_ENTRY has no fence operation if PTI is enabled. Rahter, it depends on the CR3 write of SWITCH_TO_KERNEL_CR3. So the path should use FENCE_SWAPGS_KERNEL_ENTRY if SWITCH_TO_KERNEL_CR3 is removed.
Fixes: c75890700455 ("x86/entry/64: Remove unneeded kernel CR3 switching") Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com> --- arch/x86/entry/entry_64.S | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index 1f98188e83ef..9d468c8877e2 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -994,11 +994,6 @@ SYM_CODE_START_LOCAL(error_entry) pushq %r12 ret -.Lerror_entry_done_lfence: - FENCE_SWAPGS_KERNEL_ENTRY -.Lerror_entry_done: - ret - /* * There are two places in the kernel that can potentially fault with * usergs. Handle them here. B stepping K8s sometimes report a @@ -1021,8 +1016,15 @@ SYM_CODE_START_LOCAL(error_entry) * .Lgs_change's error handler with kernel gsbase. */ SWAPGS - FENCE_SWAPGS_USER_ENTRY - jmp .Lerror_entry_done + + /* + * The above code has no serializing instruction. So do an lfence + * to prevent GS speculation, regardless of whether it is kernel + * gsbase or user gsbase. + */ +.Lerror_entry_done_lfence: + FENCE_SWAPGS_KERNEL_ENTRY + ret .Lbstep_iret: /* Fix truncated RIP */ -- 2.19.1.6.gb485710b
| |