From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752918AbdKWPhi (ORCPT ); Thu, 23 Nov 2017 10:37:38 -0500 Received: from mga03.intel.com ([134.134.136.65]:55930 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752493AbdKWPhh (ORCPT ); Thu, 23 Nov 2017 10:37:37 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,441,1505804400"; d="scan'208";a="8701162" Subject: Re: [PATCH 11/23] x86, kaiser: map entry stack variables To: Andy Lutomirski References: <20171123003438.48A0EEDE@viggo.jf.intel.com> <20171123003459.C0FF167A@viggo.jf.intel.com> Cc: "linux-kernel@vger.kernel.org" , "linux-mm@kvack.org" , moritz.lipp@iaik.tugraz.at, Daniel Gruss , michael.schwarz@iaik.tugraz.at, richard.fellner@student.tugraz.at, Linus Torvalds , Kees Cook , Hugh Dickins , X86 ML From: Dave Hansen Message-ID: Date: Thu, 23 Nov 2017 07:37:33 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/22/2017 07:31 PM, Andy Lutomirski wrote: > On Wed, Nov 22, 2017 at 4:34 PM, Dave Hansen > wrote: >> >> From: Dave Hansen >> >> There are times where the kernel is entered but there is not a >> safe stack, like at SYSCALL entry. To obtain a safe stack, the >> per-cpu variables 'rsp_scratch' and 'cpu_current_top_of_stack' >> are used to save the old %rsp value and to find where the kernel >> stack should start. >> >> You can not directly manipulate the CR3 register. You can only >> 'MOV' to it from another register, which means a register must be >> clobbered in order to do any CR3 manipulation. User-mapping >> these variables allows us to obtain a safe stack and use it for >> temporary storage *before* CR3 is switched. >> >> Signed-off-by: Dave Hansen >> Cc: Moritz Lipp >> Cc: Daniel Gruss >> Cc: Michael Schwarz >> Cc: Richard Fellner >> Cc: Andy Lutomirski >> Cc: Linus Torvalds >> Cc: Kees Cook >> Cc: Hugh Dickins >> Cc: x86@kernel.org >> --- >> >> b/arch/x86/kernel/cpu/common.c | 2 +- >> b/arch/x86/kernel/process_64.c | 2 +- >> 2 files changed, 2 insertions(+), 2 deletions(-) >> >> diff -puN arch/x86/kernel/cpu/common.c~kaiser-user-map-stack-helper-vars arch/x86/kernel/cpu/common.c >> --- a/arch/x86/kernel/cpu/common.c~kaiser-user-map-stack-helper-vars 2017-11-22 15:45:50.128619736 -0800 >> +++ b/arch/x86/kernel/cpu/common.c 2017-11-22 15:45:50.134619736 -0800 >> @@ -1524,7 +1524,7 @@ EXPORT_PER_CPU_SYMBOL(__preempt_count); >> * the top of the kernel stack. Use an extra percpu variable to track the >> * top of the kernel stack directly. >> */ >> -DEFINE_PER_CPU(unsigned long, cpu_current_top_of_stack) = >> +DEFINE_PER_CPU_USER_MAPPED(unsigned long, cpu_current_top_of_stack) = >> (unsigned long)&init_thread_union + THREAD_SIZE; > > This is in an x86_32-only section and should be dropped, I think. It's used in entry_SYSCALL_64 (see below). But I do think it's safe to drop now. We switch before we use it. >> diff -puN arch/x86/kernel/process_64.c~kaiser-user-map-stack-helper-vars arch/x86/kernel/process_64.c >> --- a/arch/x86/kernel/process_64.c~kaiser-user-map-stack-helper-vars 2017-11-22 15:45:50.130619736 -0800 >> +++ b/arch/x86/kernel/process_64.c 2017-11-22 15:45:50.134619736 -0800 >> @@ -59,7 +59,7 @@ >> #include >> #endif >> >> -__visible DEFINE_PER_CPU(unsigned long, rsp_scratch); >> +__visible DEFINE_PER_CPU_USER_MAPPED(unsigned long, rsp_scratch); >> > This shouldn't be needed any more either. What about this hunk? It touches rsp_scratch before switching: @@ -207,9 +210,16 @@ ENTRY(entry_SYSCALL_64) swapgs movq %rsp, PER_CPU_VAR(rsp_scratch) - movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp - TRACE_IRQS_OFF + /* + * The kernel CR3 is needed to map the process stack, but we + * need a scratch register to be able to load CR3. %rsp is + * clobberable right now, so use it as a scratch register. + * %rsp will be look crazy here for a couple instructions. + */ + SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp + + movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp