From: Brian Gerst <brgerst@gmail.com>
To: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Andy Lutomirski <luto@amacapital.net>,
Borislav Petkov <bp@alien8.de>,
"the arch/x86 maintainers" <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] x86/asm/entry/64: better check for canonical address
Date: Fri, 27 Mar 2015 07:27:31 -0400 [thread overview]
Message-ID: <CAMzpN2iRhG8vhHEd2AD5LHWi7rQBoqdnVSjnNdkay8HpeJsjFw@mail.gmail.com> (raw)
In-Reply-To: <1427373731-13056-1-git-send-email-dvlasenk@redhat.com>
On Thu, Mar 26, 2015 at 8:42 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote:
> This change makes the check exact (no more false positives
> on kernel addresses).
>
> It isn't really important to be fully correct here -
> almost all addresses we'll ever see will be userspace ones,
> but OTOH it looks to be cheap enough:
> the new code uses two more ALU ops but preserves %rcx,
> allowing to not reload it from pt_regs->cx again.
> On disassembly level, the changes are:
>
> cmp %rcx,0x80(%rsp) -> mov 0x80(%rsp),%r11; cmp %rcx,%r11
> shr $0x2f,%rcx -> shl $0x10,%rcx; sar $0x10,%rcx; cmp %rcx,%r11
> mov 0x58(%rsp),%rcx -> (eliminated)
>
> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
> CC: Borislav Petkov <bp@alien8.de>
> CC: x86@kernel.org
> CC: linux-kernel@vger.kernel.org
> ---
>
> Andy, I'd undecided myself on the merits of doing this.
> If you like it, feel free to take it in your tree.
> I trimmed CC list to not bother too many people with this trivial
> and quite possibly "useless churn"-class change.
>
> arch/x86/kernel/entry_64.S | 23 ++++++++++++-----------
> 1 file changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
> index bf9afad..a36d04d 100644
> --- a/arch/x86/kernel/entry_64.S
> +++ b/arch/x86/kernel/entry_64.S
> @@ -688,26 +688,27 @@ retint_swapgs: /* return to user-space */
> * a completely clean 64-bit userspace context.
> */
> movq RCX(%rsp),%rcx
> - cmpq %rcx,RIP(%rsp) /* RCX == RIP */
> + movq RIP(%rsp),%r11
> + cmpq %rcx,%r11 /* RCX == RIP */
> jne opportunistic_sysret_failed
>
> /*
> * On Intel CPUs, sysret with non-canonical RCX/RIP will #GP
> * in kernel space. This essentially lets the user take over
> - * the kernel, since userspace controls RSP. It's not worth
> - * testing for canonicalness exactly -- this check detects any
> - * of the 17 high bits set, which is true for non-canonical
> - * or kernel addresses. (This will pessimize vsyscall=native.
> - * Big deal.)
> + * the kernel, since userspace controls RSP.
> *
> - * If virtual addresses ever become wider, this will need
> + * If width of "canonical tail" ever become variable, this will need
> * to be updated to remain correct on both old and new CPUs.
> */
> .ifne __VIRTUAL_MASK_SHIFT - 47
> .error "virtual address width changed -- sysret checks need update"
> .endif
> - shr $__VIRTUAL_MASK_SHIFT, %rcx
> - jnz opportunistic_sysret_failed
> + /* Change top 16 bits to be a sign-extension of the rest */
> + shl $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
> + sar $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
> + /* If this changed %rcx, it was not canonical */
> + cmpq %rcx, %r11
> + jne opportunistic_sysret_failed
>
> cmpq $__USER_CS,CS(%rsp) /* CS must match SYSRET */
> jne opportunistic_sysret_failed
Would it be possible to to skip this check entirely on AMD processors?
It's my understanding that AMD correctly issues the #GP from CPL3,
causing a stack switch.
Looking at the AMD docs, sysret doesn't even check for a canonical
address. The #GP is probably from the instruction fetch at the
non-canonical address instead of from sysret itself.
--
Brian Gerst
next prev parent reply other threads:[~2015-03-27 11:27 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-26 12:42 [PATCH] x86/asm/entry/64: better check for canonical address Denys Vlasenko
2015-03-26 18:45 ` Andy Lutomirski
2015-03-27 8:57 ` Borislav Petkov
2015-03-30 14:27 ` Denys Vlasenko
2015-03-30 14:30 ` Andy Lutomirski
2015-03-30 14:45 ` Andy Lutomirski
2015-03-27 8:11 ` Ingo Molnar
2015-03-27 10:45 ` Denys Vlasenko
2015-03-27 11:17 ` Ingo Molnar
2015-03-27 11:28 ` Brian Gerst
2015-03-27 11:34 ` Ingo Molnar
2015-03-27 12:14 ` Denys Vlasenko
2015-03-27 12:16 ` Ingo Molnar
2015-03-27 12:31 ` Denys Vlasenko
2015-03-28 9:11 ` Ingo Molnar
2015-03-29 19:36 ` Denys Vlasenko
2015-03-29 21:12 ` Andy Lutomirski
2015-03-29 21:46 ` Denys Vlasenko
2015-03-31 16:43 ` Ingo Molnar
2015-03-31 17:08 ` Andy Lutomirski
2015-03-31 17:31 ` Denys Vlasenko
2015-03-27 11:27 ` Brian Gerst [this message]
2015-03-27 11:31 ` Ingo Molnar
2015-03-27 21:37 ` Andy Lutomirski
2015-04-02 17:37 ` Denys Vlasenko
2015-04-02 18:10 ` Ingo Molnar
2015-04-21 16:27 Denys Vlasenko
2015-04-21 18:08 ` Andy Lutomirski
2015-04-23 15:10 ` Borislav Petkov
2015-04-23 15:41 ` Andy Lutomirski
2015-04-23 15:49 ` Borislav Petkov
2015-04-23 15:52 ` Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAMzpN2iRhG8vhHEd2AD5LHWi7rQBoqdnVSjnNdkay8HpeJsjFw@mail.gmail.com \
--to=brgerst@gmail.com \
--cc=bp@alien8.de \
--cc=dvlasenk@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).