From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753257AbdKNC2R (ORCPT ); Mon, 13 Nov 2017 21:28:17 -0500 Received: from mail.kernel.org ([198.145.29.99]:57724 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752566AbdKNC2Q (ORCPT ); Mon, 13 Nov 2017 21:28:16 -0500 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BEBC521925 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=luto@kernel.org X-Google-Smtp-Source: AGs4zMb0XxS3CzdKbuPOx0RJQ8Yn1FgX5Dgo8uFLw5nzWxh1XBow7/+W4yc3mQEfhZhPXYUn09weVTZyahBQFaHSitg= MIME-Version: 1.0 In-Reply-To: <3e2bdf66-cbd4-4e78-ead1-e5c99d2a6d08@intel.com> References: <5b424fefa9230917995d0584b40bc539a9bd9224.1510371795.git.luto@kernel.org> <3e2bdf66-cbd4-4e78-ead1-e5c99d2a6d08@intel.com> From: Andy Lutomirski Date: Mon, 13 Nov 2017 18:27:54 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [RFC 6/7] x86/asm: Remap the TSS into the cpu entry area To: Dave Hansen Cc: Andy Lutomirski , X86 ML , Borislav Petkov , "linux-kernel@vger.kernel.org" , Brian Gerst , Linus Torvalds Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 13, 2017 at 11:22 AM, Dave Hansen wrote: > On 11/10/2017 08:05 PM, Andy Lutomirski wrote: >> diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h >> index fbc9b7f4e35e..8a9ba5553cab 100644 >> --- a/arch/x86/include/asm/fixmap.h >> +++ b/arch/x86/include/asm/fixmap.h >> @@ -52,6 +52,13 @@ extern unsigned long __FIXADDR_TOP; >> struct cpu_entry_area >> { >> char gdt[PAGE_SIZE]; >> + >> + /* >> + * The gdt is just below cpu_tss and thus serves (on x86_64) as a >> + * a read-only guard page for the SYSENTER stack at the bottom >> + * of the TSS region. >> + */ >> + struct tss_struct tss; >> }; >> > > Aha, and here's the place that you need sizeof(tss_struct) to be nice > and page-aligned. > > But why don't we just do: > > char tss_space[PAGE_SIZE*something]; The idea is to save some space. The TSS plus IO bitmap is slightly over a page, so, if we're giving it a dedicated block of pages, we have almost a page of unused space. I want to use some of that space for the SYSENTER stack. To reliably detect overflow, that space should be at the beginning. It turns out that using almost a page is way too *big*: it masks bugs. I want anything nontrivial that accidentally runs on the SYSENTER stack to overflow and crash very quickly rather than having a decent chance of working or of causing nasty corruption with a crash down the road. So I'm going to make it much smaller and instead just add a build-time assertion that we don't cross a page boundary.