Re: [PATCH v4 1/2] xen/PVH: Set up GS segment for stack canary

[Brian Gerst]

On Tue, May 22, 2018 at 9:57 AM, Jan Beulich <JBeulich@xxxxxxxx> wrote:
>>>> On 22.05.18 at 15:45, <brgerst@xxxxxxxxx> wrote:
>> On Mon, May 21, 2018 at 11:54 PM, Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx> wrote:
>>> @@ -98,6 +101,12 @@ ENTRY(pvh_start_xen)
>>>         /* 64-bit entry point. */
>>>         .code64
>>>  1:
>>> +       /* Set base address in stack canary descriptor. */
>>> +       mov $MSR_GS_BASE,%ecx
>>> +       mov $canary, %rax
>>> +       cdq
>>> +       wrmsr
>>
>> CDQ only sign-extends EAX to RAX.  What you really want is to move the
>> high 32-bits to EDX (or zero EDX if we can guarantee it is loaded
>> below 4G).
>
> What you describe is CDQE (AT&T name: CLTD); CDQ (AT&T: CLTQ)
> sign-extends EAX to EDX:EAX.

But that would still be wrong, as it would set EDX to 0xFFFFFFFF if
the kernel was loaded between 2G and 4G.  Looking closer at the code,
we just left 32-bit mode, so we must have been loaded below 4G,
therefore EDX must be zero.

--
Brian Gerst