From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753398AbdKKK6c (ORCPT ); Sat, 11 Nov 2017 05:58:32 -0500 Received: from mx2.suse.de ([195.135.220.15]:52608 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751819AbdKKK6b (ORCPT ); Sat, 11 Nov 2017 05:58:31 -0500 Date: Sat, 11 Nov 2017 11:58:21 +0100 From: Borislav Petkov To: Andy Lutomirski Cc: X86 ML , "linux-kernel@vger.kernel.org" , Brian Gerst , Dave Hansen , Linus Torvalds Subject: Re: [RFC 0/7] Prep code for better stack switching Message-ID: <20171111105821.kxjjuc7peiqoxfuc@pd.tnic> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Nov 10, 2017 at 08:05:19PM -0800, Andy Lutomirski wrote: > This isn't quite done (the TSS remap patch is busted on 32-bit, but > that's a straightforward fix), but it should be ready for at least a > conceptual review. > > The idea here is to prepare us to have all kernel data needed for > user mode execution and early entry located in the fixmap. To do > this, I hijack the GDT remap mechanism and make it more general. I > add a struct cpu_entry_area. This struct is never instantiated > directly. Instead, it represents the layout of a per-cpu portion of > the fixmap. That portion contains the GDT, the TSS (including IO > bitmap), and the entry stack (for now just a part of the TSS > region). It should also end up containing the PEBS and BTS buffers. > > If this works, then the idea would be to add a magic *executable* page > to cpu_entry_area. That page would contain a stub like this: > > ENTRY(entry_SYSCALL_64_trampoline) > UNWIND_HINT_EMPTY > movq %rsp, 0x1000+entry_SYSCALL_64_trampoline-1f(%rip) > 1: > movq 0x1008+entry_SYSCALL_64_trampoline-1f(%rip), %rsp > 1: > pushq %rdi > pushq %rsi > movq 0x1000+entry_SYSCALL_64_trampoline-1f(%rip), %rsi > 1: > movq $entry_SYSCALL_64, %rdi > jmp *%rdi So I'm wondering: r12-r15 are callee-preserved so why can't you scratch into those on entry and leave rsi and rdi pristine so that entry_SYSCALL_64 can get to work directly? -- Regards/Gruss, Boris. SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --