Commit 45e876f7 authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Ingo Molnar
Browse files

x86/segments/64: When loadsegment(fs, ...) fails, clear the base 



On AMD CPUs, a failed loadsegment currently may not clear the FS
base.  Fix it.

While we're at it, prevent loadsegment(gs, xyz) from even compiling
on 64-bit kernels.  It shouldn't be used.

Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/a084c1b93b7b1408b58d3fd0b5d6e47da8e7d7cf.1461698311.git.luto@kernel.org


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent f005f5d8

arch/x86/include/asm/segment.h

+39 −3
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
#define _ASM_X86_SEGMENT_H



#include <linux/const.h>

#include <asm/alternative.h>



/*

 * Constructor for a conventional segment GDT (or LDT) entry.
@@ -249,10 +250,13 @@ extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDL 
#endif



/*

 * Load a segment. Fall back on loading the zero

 * segment if something goes wrong..

 * Load a segment. Fall back on loading the zero segment if something goes

 * wrong.  This variant assumes that loading zero fully clears the segment.

 * This is always the case on Intel CPUs and, even on 64-bit AMD CPUs, any

 * failure to fully clear the cached descriptor is only observable for

 * FS and GS.

 */

#define loadsegment(seg, value)						\

#define __loadsegment_simple(seg, value)				\

do {									\

	unsigned short __val = (value);					\

									\
@@ -269,6 +273,38 @@ do { \ 
		     : "+r" (__val) : : "memory");			\

} while (0)



#define __loadsegment_ss(value) __loadsegment_simple(ss, (value))

#define __loadsegment_ds(value) __loadsegment_simple(ds, (value))

#define __loadsegment_es(value) __loadsegment_simple(es, (value))



#ifdef CONFIG_X86_32



/*

 * On 32-bit systems, the hidden parts of FS and GS are unobservable if

 * the selector is NULL, so there's no funny business here.

 */

#define __loadsegment_fs(value) __loadsegment_simple(fs, (value))

#define __loadsegment_gs(value) __loadsegment_simple(gs, (value))



#else



static inline void __loadsegment_fs(unsigned short value)

{

	asm volatile("						\n"

		     "1:	movw %0, %%fs			\n"

		     "2:					\n"



		     _ASM_EXTABLE_HANDLE(1b, 2b, ex_handler_clear_fs)



		     : : "rm" (value) : "memory");

}



/* __loadsegment_gs is intentionally undefined.  Use load_gs_index instead. */



#endif



#define loadsegment(seg, value) __loadsegment_ ## seg (value)



/*

 * Save a segment register away:

 */

arch/x86/kernel/cpu/common.c

+1 −1
Original line number Diff line number Diff line
@@ -430,7 +430,7 @@ void load_percpu_segment(int cpu) 
#ifdef CONFIG_X86_32

	loadsegment(fs, __KERNEL_PERCPU);

#else

	loadsegment(gs, 0);

	__loadsegment_simple(gs, 0);

	wrmsrl(MSR_GS_BASE, (unsigned long)per_cpu(irq_stack_union.gs_base, cpu));

#endif

	load_stack_canary_segment();

arch/x86/mm/extable.c

+10 −0
Original line number Diff line number Diff line
@@ -70,6 +70,16 @@ bool ex_handler_wrmsr_unsafe(const struct exception_table_entry *fixup, 
}

EXPORT_SYMBOL(ex_handler_wrmsr_unsafe);



bool ex_handler_clear_fs(const struct exception_table_entry *fixup,

			 struct pt_regs *regs, int trapnr)

{

	if (static_cpu_has(X86_BUG_NULL_SEG))

		asm volatile ("mov %0, %%fs" : : "rm" (__USER_DS));

	asm volatile ("mov %0, %%fs" : : "rm" (0));

	return ex_handler_default(fixup, regs, trapnr);

}

EXPORT_SYMBOL(ex_handler_clear_fs);



bool ex_has_fault_handler(unsigned long ip)

{

	const struct exception_table_entry *e;

CRA Git | Maintained and supported by SUSTech CRA and CCSE