x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C (af726f21) · Commits · 戴 / test

arch/x86/kernel/entry_64.S

+2 −32

Original line number	Original line	Diff line number	Diff line
	@@ -828,6 +828,7 @@ ENTRY(native_iret)
	jnz native_irq_return_ldt		jnz native_irq_return_ldt
	#endif		#endif

			.global native_irq_return_iret
	native_irq_return_iret:		native_irq_return_iret:
	iretq		iretq
	_ASM_EXTABLE(native_irq_return_iret, bad_iret)		_ASM_EXTABLE(native_irq_return_iret, bad_iret)
	@@ -922,37 +923,6 @@ ENTRY(retint_kernel)
	CFI_ENDPROC		CFI_ENDPROC
	END(common_interrupt)		END(common_interrupt)

	/*
	* If IRET takes a fault on the espfix stack, then we
	* end up promoting it to a doublefault. In that case,
	* modify the stack to make it look like we just entered
	* the #GP handler from user space, similar to bad_iret.
	*/
	#ifdef CONFIG_X86_ESPFIX64
	ALIGN
	__do_double_fault:
	XCPT_FRAME 1 RDI+8
	movq RSP(%rdi),%rax /* Trap on the espfix stack? */
	sarq $PGDIR_SHIFT,%rax
	cmpl $ESPFIX_PGD_ENTRY,%eax
	jne do_double_fault /* No, just deliver the fault */
	cmpl $__KERNEL_CS,CS(%rdi)
	jne do_double_fault
	movq RIP(%rdi),%rax
	cmpq $native_irq_return_iret,%rax
	jne do_double_fault /* This shouldn't happen... */
	movq PER_CPU_VAR(kernel_stack),%rax
	subq $(68-KERNEL_STACK_OFFSET),%rax / Reset to original stack */
	movq %rax,RSP(%rdi)
	movq $0,(%rax) /* Missing (lost) #GP error code */
	movq $general_protection,RIP(%rdi)
	retq
	CFI_ENDPROC
	END(__do_double_fault)
	#else
	# define __do_double_fault do_double_fault
	#endif

	/*		/*
	* APIC interrupts.		* APIC interrupts.
	*/		*/
	@@ -1124,7 +1094,7 @@ idtentry overflow do_overflow has_error_code=0
	idtentry bounds do_bounds has_error_code=0		idtentry bounds do_bounds has_error_code=0
	idtentry invalid_op do_invalid_op has_error_code=0		idtentry invalid_op do_invalid_op has_error_code=0
	idtentry device_not_available do_device_not_available has_error_code=0		idtentry device_not_available do_device_not_available has_error_code=0
	idtentry double_fault __do_double_fault has_error_code=1 paranoid=1		idtentry double_fault do_double_fault has_error_code=1 paranoid=1
	idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0		idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0
	idtentry invalid_TSS do_invalid_TSS has_error_code=1		idtentry invalid_TSS do_invalid_TSS has_error_code=1
	idtentry segment_not_present do_segment_not_present has_error_code=1		idtentry segment_not_present do_segment_not_present has_error_code=1

arch/x86/kernel/traps.c

+24 −0

Original line number	Original line	Diff line number	Diff line
	@@ -259,6 +259,30 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
	static const char str[] = "double fault";		static const char str[] = "double fault";
	struct task_struct *tsk = current;		struct task_struct *tsk = current;

			#ifdef CONFIG_X86_ESPFIX64
			extern unsigned char native_irq_return_iret[];

			/*
			* If IRET takes a non-IST fault on the espfix64 stack, then we
			* end up promoting it to a doublefault. In that case, modify
			* the stack to make it look like we just entered the #GP
			* handler from user space, similar to bad_iret.
			*/
			if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
			regs->cs == __KERNEL_CS &&
			regs->ip == (unsigned long)native_irq_return_iret)
			{
			struct pt_regs *normal_regs = task_pt_regs(current);

			/* Fake a #GP(0) from userspace. */
			memmove(&normal_regs->ip, (void )regs->sp, 58);
			normal_regs->orig_ax = 0; /* Missing (lost) #GP error code */
			regs->ip = (unsigned long)general_protection;
			regs->sp = (unsigned long)&normal_regs->orig_ax;
			return;
			}
			#endif

	exception_enter();		exception_enter();
	/* Return not checked because double check cannot be ignored */		/* Return not checked because double check cannot be ignored */
	notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);		notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);

Admin message