All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Laight <David.Laight@ACULAB.COM>
To: 'Brian Gerst' <brgerst@gmail.com>, Andy Lutomirski <luto@kernel.org>
Cc: X86 ML <x86@kernel.org>, LKML <linux-kernel@vger.kernel.org>,
	Ingo Molnar <mingo@kernel.org>, "H . Peter Anvin" <hpa@zytor.com>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>,
	Oleg Nesterov <oleg@redhat.com>
Subject: RE: [PATCH] x86: Remove force_iret()
Date: Fri, 20 Dec 2019 10:10:10 +0000	[thread overview]
Message-ID: <431a146f6461402da61d09fff155f35b@AcuMS.aculab.com> (raw)
In-Reply-To: <CAMzpN2if2m4McWpL49U4QAEM1MJ+qgTe-emN8vKcjVc1H+84vA@mail.gmail.com>

From: Brian Gerst
> Sent: 20 December 2019 03:48
> On Thu, Dec 19, 2019 at 8:50 PM Andy Lutomirski <luto@kernel.org> wrote:
> >
> > On Thu, Dec 19, 2019 at 3:58 AM Brian Gerst <brgerst@gmail.com> wrote:
> > >
> > > force_iret() was originally intended to prevent the return to user mode with
> > > the SYSRET or SYSEXIT instructions, in cases where the register state could
> > > have been changed to be incompatible with those instructions.
> >
> > It's more than that.  Before the big syscall rework, we didn't restore
> > the caller-saved regs.  See:
> >
> > commit 21d375b6b34ff511a507de27bf316b3dde6938d9
> > Author: Andy Lutomirski <luto@kernel.org>
> > Date:   Sun Jan 28 10:38:49 2018 -0800
> >
> >     x86/entry/64: Remove the SYSCALL64 fast path
> >
> > So if you changed r12, for example, the change would get lost.
> 
> force_iret() specifically dealt with changes to CS, SS and EFLAGS.
> Saving and restoring the extra registers was a different problem
> although it affected the same functions like ptrace, signals, and
> exec.

Is it ever possible for any of the segment registers to refer to the LDT
and for another thread to invalidate the entries 'very late' ?

So even though the values were valid when changed, they are
invalid during the 'return to user' sequence.

I remember writing a signal handler that 'corrupted' all the
segment registers (etc) and fixing the NetBSD kernel to handle
all the faults restoring the segment registers and IRET faulting
in kernel (IIRC invalid user %SS or %CS).
(IRET can also fault in user space, but that is a normal fault.)

Is it actually cheaper to properly validate the segment registers,
or take the 'hit' of the slightly slower IRET path and get the cpu
to do it for you?

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

  reply	other threads:[~2019-12-20 10:10 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-19 11:58 [PATCH] x86: Remove force_iret() Brian Gerst
2019-12-20  1:49 ` Andy Lutomirski
2019-12-20  3:48   ` Brian Gerst
2019-12-20 10:10     ` David Laight [this message]
2019-12-20 10:30       ` Andy Lutomirski
2019-12-20 10:59         ` David Laight
2019-12-20 21:20           ` Andy Lutomirski
2019-12-20 12:18       ` Brian Gerst
2019-12-20 12:35         ` David Laight
2019-12-20 19:35 ` Oleg Nesterov
2020-01-08 20:30 ` [tip: x86/asm] " tip-bot2 for Brian Gerst

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=431a146f6461402da61d09fff155f35b@AcuMS.aculab.com \
    --to=david.laight@aculab.com \
    --cc=boris.ostrovsky@oracle.com \
    --cc=brgerst@gmail.com \
    --cc=hpa@zytor.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=oleg@redhat.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.