On Tue, Apr 21, 2015 at 11:08:42AM -0700, Andy Lutomirski wrote: > I'll take a full implementation of what Intel says over probably > unmeasurable performance. If anyone in the AMD camp really cared, we > could add X86_BUG_SYSRET_NEEDS_CANONICAL_RCX and use alternatives to > patch this out on AMD. I doubt this would buy us much.
Err, why do we care if RCX is canonical when executing SYSRET? The RIP canonicalness test is being done anyway and we read RIP from RCX. What am I missing? Oh, and then there's this: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html and more specifically: "AMD have issued the following statement: AMD processors' SYSRET behavior is such that a non-canonical address in RCX does not generate a #GP while in CPL0. We have verified this with our architecture team, with our design team, and have performed tests that verified this on silicon. Therefore, this privilege escalation exposure is not applicable to any AMD processor. " oh, and look at one of the xen fixes, hahaha! (at the end). Intel faults in ring0 due to non-canonical RCX but with user RSP. Lovely. --- x86_64: Do not execute sysret with a non-canonical return address Check for non-canonical guest RIP before attempting to execute sysret. If sysret is executed with a non-canonical value in RCX, Intel CPUs take the fault in ring0, but we will necessarily already have switched to the the user's stack pointer. This is a security vulnerability, XSA-7 / CVE-2012-0217. Signed-off-by: Jan Beulich <[email protected]> Signed-off-by: Ian Campbell <[email protected]> Signed-off-by: Ian Jackson <[email protected]> Tested-by: Ian Campbell <[email protected]> Acked-by: Keir Fraser <[email protected]> Committed-by: Ian Jackson <[email protected]> diff -r 340062faf298 -r ad87903fdca1 xen/arch/x86/x86_64/entry.S --- a/xen/arch/x86/x86_64/entry.S Wed May 23 11:06:49 2012 +0100 +++ b/xen/arch/x86/x86_64/entry.S Thu May 24 11:02:35 2012 +0100 @@ -40,6 +40,13 @@ restore_all_guest: testw $TRAP_syscall,4(%rsp) jz iret_exit_to_guest + /* Don't use SYSRET path if the return address is not canonical. */ + movq 8(%rsp),%rcx + sarq $47,%rcx + incl %ecx + cmpl $1,%ecx + ja .Lforce_iret + addq $8,%rsp popq %rcx # RIP popq %r11 # CS @@ -50,6 +57,10 @@ restore_all_guest: sysretq 1: sysretl +.Lforce_iret: + /* Mimic SYSRET behavior. */ + movq 8(%rsp),%rcx # RIP + movq 24(%rsp),%r11 # RFLAGS ALIGN /* No special register assumptions. */ iret_exit_to_guest: --- Thanks. -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
