From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935114AbcATKeR (ORCPT ); Wed, 20 Jan 2016 05:34:17 -0500 Received: from mx2.suse.de ([195.135.220.15]:45631 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934951AbcATKeO (ORCPT ); Wed, 20 Jan 2016 05:34:14 -0500 Date: Wed, 20 Jan 2016 11:33:45 +0100 From: Borislav Petkov To: "H. Peter Anvin" Cc: Andy Lutomirski , Brian Gerst , the arch/x86 maintainers , Linux Kernel Mailing List , Ingo Molnar , Denys Vlasenko , Linus Torvalds Subject: Re: [PATCH] x86: static_cpu_has_safe: discard dynamic check after init Message-ID: <20160120103345.GA23350@pd.tnic> References: <20160118181457.GG12651@pd.tnic> <20160118183921.GH12651@pd.tnic> <569D40CE.5090506@zytor.com> <20160118230554.GJ12651@pd.tnic> <3D4E057B-AB03-4C12-B59D-774E8954C742@zytor.com> <20160118232547.GK12651@pd.tnic> <20160119135714.GD15071@pd.tnic> <569F072B.1020504@zytor.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <569F072B.1020504@zytor.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jan 19, 2016 at 08:03:55PM -0800, H. Peter Anvin wrote: > On 01/19/16 05:57, Borislav Petkov wrote: > > > > old insn VA: 0xffffffff8108c0d0, CPU feat: X86_BUG_SYSRET_SS_ATTRS, size: 2, padlen: 0 > > __switch_to: > > ffffffff8108c0d0: eb 70 jmp ffffffff8108c142 > > repl insn: 0xffffffff8ca7a1a7, size: 0 > > > > This is the only one I could possibly imagine mattering. Would it be > possible to get the disassembly here? Sure, I've kept the vmlinux, see below: ffffffff8108c0d0: eb 70 jmp ffffffff8108c142 <__switch_to+0x838> jumps to: ffffffff8108c142: 48 ff 05 b7 08 aa 0b incq 0xbaa08b7(%rip) which is something-gcov. In any case, it jumps over the SS fixup code: if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) { ... unsigned short ss_sel; savesegment(ss, ss_sel); if (ss_sel != __KERNEL_DS) loadsegment(ss, __KERNEL_DS); } I guess we could fix that with an alternative_call() where @oldinstr is empty so that on !X86_BUG_SYSRET_SS_ATTRS machines we simply return and on the others, we do a CALL fixup_ss or so. We have to pay attention to clobbers, though, similar to the POPCNT fun in __arch_hweight32(). ffffffff8108b90a <__switch_to>: ffffffff8108b90a: 55 push %rbp ffffffff8108b90b: 48 8d 87 c0 2d 00 00 lea 0x2dc0(%rdi),%rax ffffffff8108b912: 48 c7 c1 80 f6 1d 00 mov $0x1df680,%rcx ffffffff8108b919: 48 89 e5 mov %rsp,%rbp ffffffff8108b91c: 41 57 push %r15 ffffffff8108b91e: 45 31 ff xor %r15d,%r15d ffffffff8108b921: 41 56 push %r14 ... ffffffff8108c0c2: 48 ff 05 07 09 aa 0b incq 0xbaa0907(%rip) # ffffffff8cb2c9d0 <__gcov0.__switch_to+0xc0> ffffffff8108c0c9: 48 ff 05 08 09 aa 0b incq 0xbaa0908(%rip) # ffffffff8cb2c9d8 <__gcov0.__switch_to+0xc8> ffffffff8108c0d0: eb 70 jmp ffffffff8108c142 <__switch_to+0x838> ffffffff8108c0d2: 48 ff 05 07 09 aa 0b incq 0xbaa0907(%rip) # ffffffff8cb2c9e0 <__gcov0.__switch_to+0xd0> ffffffff8108c0d9: 48 ff 05 08 09 aa 0b incq 0xbaa0908(%rip) # ffffffff8cb2c9e8 <__gcov0.__switch_to+0xd8> ffffffff8108c0e0: 48 ff 05 11 09 aa 0b incq 0xbaa0911(%rip) # ffffffff8cb2c9f8 <__gcov0.__switch_to+0xe8> ffffffff8108c0e7: 66 8c d0 mov %ss,%ax ffffffff8108c0ea: 66 83 f8 18 cmp $0x18,%ax ffffffff8108c0ee: 75 17 jne ffffffff8108c107 <__switch_to+0x7fd> ffffffff8108c0f0: eb 57 jmp ffffffff8108c149 <__switch_to+0x83f> ffffffff8108c0f2: 48 ff 05 cf 08 aa 0b incq 0xbaa08cf(%rip) # ffffffff8cb2c9c8 <__gcov0.__switch_to+0xb8> ffffffff8108c0f9: e8 db b0 01 00 callq ffffffff810a71d9 ffffffff8108c0fe: 48 ff 05 eb 08 aa 0b incq 0xbaa08eb(%rip) # ffffffff8cb2c9f0 <__gcov0.__switch_to+0xe0> ffffffff8108c105: eb 3b jmp ffffffff8108c142 <__switch_to+0x838> ffffffff8108c107: 48 ff 05 fa 08 aa 0b incq 0xbaa08fa(%rip) # ffffffff8cb2ca08 <__gcov0.__switch_to+0xf8> ffffffff8108c10e: b8 18 00 00 00 mov $0x18,%eax ffffffff8108c113: 8e d0 mov %eax,%ss ffffffff8108c115: 48 ff 05 f4 08 aa 0b incq 0xbaa08f4(%rip) # ffffffff8cb2ca10 <__gcov0.__switch_to+0x100> ffffffff8108c11c: eb 2b jmp ffffffff8108c149 <__switch_to+0x83f> ffffffff8108c11e: 48 ff 05 9b 02 aa 0b incq 0xbaa029b(%rip) # ffffffff8cb2c3c0 <__gcov0.copy_xregs_to_kernel+0x30> ffffffff8108c125: e9 91 f9 ff ff jmpq ffffffff8108babb <__switch_to+0x1b1> ffffffff8108c12a: 48 ff 05 bf 02 aa 0b incq 0xbaa02bf(%rip) # ffffffff8cb2c3f0 <__gcov0.copy_kernel_to_xregs+0x20> ffffffff8108c131: e9 84 fe ff ff jmpq ffffffff8108bfba <__switch_to+0x6b0> ffffffff8108c136: 48 ff 05 43 02 aa 0b incq 0xbaa0243(%rip) # ffffffff8cb2c380 <__gcov0.copy_kernel_to_fxregs+0x20> ffffffff8108c13d: e9 db fe ff ff jmpq ffffffff8108c01d <__switch_to+0x713> ffffffff8108c142: 48 ff 05 b7 08 aa 0b incq 0xbaa08b7(%rip) # ffffffff8cb2ca00 <__gcov0.__switch_to+0xf0> ffffffff8108c149: 48 83 c4 28 add $0x28,%rsp ffffffff8108c14d: 4c 89 e0 mov %r12,%rax ffffffff8108c150: 5b pop %rbx ffffffff8108c151: 41 5c pop %r12 ffffffff8108c153: 41 5d pop %r13 ffffffff8108c155: 41 5e pop %r14 ffffffff8108c157: 41 5f pop %r15 ffffffff8108c159: 5d pop %rbp ffffffff8108c15a: c3 retq -- Regards/Gruss, Boris. SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --