Re: [PATCH] x86: static_cpu_has_safe: discard dynamic check after init

[Borislav Petkov]

On Tue, Jan 19, 2016 at 08:03:55PM -0800, H. Peter Anvin wrote:
> On 01/19/16 05:57, Borislav Petkov wrote:
> > 
> > old insn VA: 0xffffffff8108c0d0, CPU feat: X86_BUG_SYSRET_SS_ATTRS, size: 2, padlen: 0
> > __switch_to:
> >  ffffffff8108c0d0:      eb 70                   jmp ffffffff8108c142
> > repl insn: 0xffffffff8ca7a1a7, size: 0
> > 
> 
> This is the only one I could possibly imagine mattering.  Would it be
> possible to get the disassembly here?

Sure, I've kept the vmlinux, see below:

ffffffff8108c0d0:       eb 70                   jmp    ffffffff8108c142 <__switch_to+0x838>

jumps to:

ffffffff8108c142:       48 ff 05 b7 08 aa 0b    incq   0xbaa08b7(%rip)

which is something-gcov. In any case, it jumps over the SS fixup code:

        if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) {

		...

                unsigned short ss_sel;
                savesegment(ss, ss_sel);
                if (ss_sel != __KERNEL_DS)
                        loadsegment(ss, __KERNEL_DS);
        }

I guess we could fix that with an alternative_call() where @oldinstr is
empty so that on !X86_BUG_SYSRET_SS_ATTRS machines we simply return and
on the others, we do a CALL fixup_ss or so.

We have to pay attention to clobbers, though, similar to the POPCNT fun
in __arch_hweight32().

ffffffff8108b90a <__switch_to>:
ffffffff8108b90a:       55                      push   %rbp
ffffffff8108b90b:       48 8d 87 c0 2d 00 00    lea    0x2dc0(%rdi),%rax
ffffffff8108b912:       48 c7 c1 80 f6 1d 00    mov    $0x1df680,%rcx
ffffffff8108b919:       48 89 e5                mov    %rsp,%rbp
ffffffff8108b91c:       41 57                   push   %r15
ffffffff8108b91e:       45 31 ff                xor    %r15d,%r15d
ffffffff8108b921:       41 56                   push   %r14

...

ffffffff8108c0c2:       48 ff 05 07 09 aa 0b    incq   0xbaa0907(%rip)        # ffffffff8cb2c9d0 <__gcov0.__switch_to+0xc0>
ffffffff8108c0c9:       48 ff 05 08 09 aa 0b    incq   0xbaa0908(%rip)        # ffffffff8cb2c9d8 <__gcov0.__switch_to+0xc8>
ffffffff8108c0d0:       eb 70                   jmp    ffffffff8108c142 <__switch_to+0x838>
ffffffff8108c0d2:       48 ff 05 07 09 aa 0b    incq   0xbaa0907(%rip)        # ffffffff8cb2c9e0 <__gcov0.__switch_to+0xd0>
ffffffff8108c0d9:       48 ff 05 08 09 aa 0b    incq   0xbaa0908(%rip)        # ffffffff8cb2c9e8 <__gcov0.__switch_to+0xd8>
ffffffff8108c0e0:       48 ff 05 11 09 aa 0b    incq   0xbaa0911(%rip)        # ffffffff8cb2c9f8 <__gcov0.__switch_to+0xe8>
ffffffff8108c0e7:       66 8c d0                mov    %ss,%ax
ffffffff8108c0ea:       66 83 f8 18             cmp    $0x18,%ax
ffffffff8108c0ee:       75 17                   jne    ffffffff8108c107 <__switch_to+0x7fd>
ffffffff8108c0f0:       eb 57                   jmp    ffffffff8108c149 <__switch_to+0x83f>
ffffffff8108c0f2:       48 ff 05 cf 08 aa 0b    incq   0xbaa08cf(%rip)        # ffffffff8cb2c9c8 <__gcov0.__switch_to+0xb8>
ffffffff8108c0f9:       e8 db b0 01 00          callq  ffffffff810a71d9 <warn_pre_alternatives>
ffffffff8108c0fe:       48 ff 05 eb 08 aa 0b    incq   0xbaa08eb(%rip)        # ffffffff8cb2c9f0 <__gcov0.__switch_to+0xe0>
ffffffff8108c105:       eb 3b                   jmp    ffffffff8108c142 <__switch_to+0x838>
ffffffff8108c107:       48 ff 05 fa 08 aa 0b    incq   0xbaa08fa(%rip)        # ffffffff8cb2ca08 <__gcov0.__switch_to+0xf8>
ffffffff8108c10e:       b8 18 00 00 00          mov    $0x18,%eax
ffffffff8108c113:       8e d0                   mov    %eax,%ss
ffffffff8108c115:       48 ff 05 f4 08 aa 0b    incq   0xbaa08f4(%rip)        # ffffffff8cb2ca10 <__gcov0.__switch_to+0x100>
ffffffff8108c11c:       eb 2b                   jmp    ffffffff8108c149 <__switch_to+0x83f>
ffffffff8108c11e:       48 ff 05 9b 02 aa 0b    incq   0xbaa029b(%rip)        # ffffffff8cb2c3c0 <__gcov0.copy_xregs_to_kernel+0x30>
ffffffff8108c125:       e9 91 f9 ff ff          jmpq   ffffffff8108babb <__switch_to+0x1b1>
ffffffff8108c12a:       48 ff 05 bf 02 aa 0b    incq   0xbaa02bf(%rip)        # ffffffff8cb2c3f0 <__gcov0.copy_kernel_to_xregs+0x20>
ffffffff8108c131:       e9 84 fe ff ff          jmpq   ffffffff8108bfba <__switch_to+0x6b0>
ffffffff8108c136:       48 ff 05 43 02 aa 0b    incq   0xbaa0243(%rip)        # ffffffff8cb2c380 <__gcov0.copy_kernel_to_fxregs+0x20>
ffffffff8108c13d:       e9 db fe ff ff          jmpq   ffffffff8108c01d <__switch_to+0x713>
ffffffff8108c142:       48 ff 05 b7 08 aa 0b    incq   0xbaa08b7(%rip)        # ffffffff8cb2ca00 <__gcov0.__switch_to+0xf0>
ffffffff8108c149:       48 83 c4 28             add    $0x28,%rsp
ffffffff8108c14d:       4c 89 e0                mov    %r12,%rax
ffffffff8108c150:       5b                      pop    %rbx
ffffffff8108c151:       41 5c                   pop    %r12
ffffffff8108c153:       41 5d                   pop    %r13
ffffffff8108c155:       41 5e                   pop    %r14
ffffffff8108c157:       41 5f                   pop    %r15
ffffffff8108c159:       5d                      pop    %rbp
ffffffff8108c15a:       c3                      retq


-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix ImendÃrffer, Jane Smithard, Graham Norton, HRB 21284 (AG NÃrnberg)
--