From: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx> There are times where the kernel is entered but there is not a safe stack, like at SYSCALL entry. To obtain a safe stack, the per-cpu variables 'rsp_scratch' and 'cpu_current_top_of_stack' are used to save the old %rsp value and to find where the kernel stack should start. You can not directly manipulate the CR3 register. You can only 'MOV' to it from another register, which means a register must be clobbered in order to do any CR3 manipulation. User-mapping these variables allows us to obtain a safe stack and use it for temporary storage *before* CR3 is switched. Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx> Cc: Moritz Lipp <moritz.lipp@xxxxxxxxxxxxxx> Cc: Daniel Gruss <daniel.gruss@xxxxxxxxxxxxxx> Cc: Michael Schwarz <michael.schwarz@xxxxxxxxxxxxxx> Cc: Richard Fellner <richard.fellner@xxxxxxxxxxxxxxxxx> Cc: Andy Lutomirski <luto@xxxxxxxxxx> Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Cc: Kees Cook <keescook@xxxxxxxxxx> Cc: Hugh Dickins <hughd@xxxxxxxxxx> Cc: x86@xxxxxxxxxx --- b/arch/x86/kernel/cpu/common.c | 2 +- b/arch/x86/kernel/process_64.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff -puN arch/x86/kernel/cpu/common.c~kaiser-user-map-stack-helper-vars arch/x86/kernel/cpu/common.c --- a/arch/x86/kernel/cpu/common.c~kaiser-user-map-stack-helper-vars 2017-11-22 15:45:50.128619736 -0800 +++ b/arch/x86/kernel/cpu/common.c 2017-11-22 15:45:50.134619736 -0800 @@ -1524,7 +1524,7 @@ EXPORT_PER_CPU_SYMBOL(__preempt_count); * the top of the kernel stack. Use an extra percpu variable to track the * top of the kernel stack directly. */ -DEFINE_PER_CPU(unsigned long, cpu_current_top_of_stack) = +DEFINE_PER_CPU_USER_MAPPED(unsigned long, cpu_current_top_of_stack) = (unsigned long)&init_thread_union + THREAD_SIZE; EXPORT_PER_CPU_SYMBOL(cpu_current_top_of_stack); diff -puN arch/x86/kernel/process_64.c~kaiser-user-map-stack-helper-vars arch/x86/kernel/process_64.c --- a/arch/x86/kernel/process_64.c~kaiser-user-map-stack-helper-vars 2017-11-22 15:45:50.130619736 -0800 +++ b/arch/x86/kernel/process_64.c 2017-11-22 15:45:50.134619736 -0800 @@ -59,7 +59,7 @@ #include <asm/unistd_32_ia32.h> #endif -__visible DEFINE_PER_CPU(unsigned long, rsp_scratch); +__visible DEFINE_PER_CPU_USER_MAPPED(unsigned long, rsp_scratch); /* Prints also some state that isn't saved in the pt_regs */ void __show_regs(struct pt_regs *regs, int all) _ -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
