We have some rather arcane code to help when we IRET to 16-bit segments: the "espfix" code. This consists of a few per-cpu variables: espfix_stack: tells us where we allocated the stack (the bottom) espfix_waddr: tells us where we can actually point %rsp and the stack itself. We need all three things mapped for this to work. Note: the espfix code runs with a kernel GSBASE, but user (shadow) page tables. We could switch to the kernel page tables here and then not have to map any of this, but just user-pagetable-mapping is simpler. To switch over to the kernel copy, we would need some temporary storage which is in short supply at this point. The original KAISER patch missed this case. Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx> Cc: Moritz Lipp <moritz.lipp@xxxxxxxxxxxxxx> Cc: Daniel Gruss <daniel.gruss@xxxxxxxxxxxxxx> Cc: Michael Schwarz <michael.schwarz@xxxxxxxxxxxxxx> Cc: Andy Lutomirski <luto@xxxxxxxxxx> Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Cc: Kees Cook <keescook@xxxxxxxxxx> Cc: Hugh Dickins <hughd@xxxxxxxxxx> Cc: x86@xxxxxxxxxx --- b/arch/x86/kernel/espfix_64.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff -puN arch/x86/kernel/espfix_64.c~kaiser-user-map-espfix arch/x86/kernel/espfix_64.c --- a/arch/x86/kernel/espfix_64.c~kaiser-user-map-espfix 2017-10-31 15:03:55.601361577 -0700 +++ b/arch/x86/kernel/espfix_64.c 2017-10-31 15:03:55.605361766 -0700 @@ -33,6 +33,7 @@ #include <linux/init.h> #include <linux/init_task.h> +#include <linux/kaiser.h> #include <linux/kernel.h> #include <linux/percpu.h> #include <linux/gfp.h> @@ -41,7 +42,6 @@ #include <asm/pgalloc.h> #include <asm/setup.h> #include <asm/espfix.h> -#include <asm/kaiser.h> /* * Note: we only need 6*8 = 48 bytes for the espfix stack, but round @@ -61,8 +61,8 @@ #define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO) /* This contains the *bottom* address of the espfix stack */ -DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack); -DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr); +DEFINE_PER_CPU_USER_MAPPED(unsigned long, espfix_stack); +DEFINE_PER_CPU_USER_MAPPED(unsigned long, espfix_waddr); /* Initialization mutex - should this be a spinlock? */ static DEFINE_MUTEX(espfix_init_mutex); @@ -225,4 +225,5 @@ done: per_cpu(espfix_stack, cpu) = addr; per_cpu(espfix_waddr, cpu) = (unsigned long)stack_page + (addr & ~PAGE_MASK); + kaiser_add_mapping((unsigned long)stack_page, PAGE_SIZE, __PAGE_KERNEL); } _ -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
