Commit 5b06bbcf authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Ingo Molnar

x86/power: Fix some ordering bugs in __restore_processor_context()

__restore_processor_context() had a couple of ordering bugs.  It
restored GSBASE after calling load_gs_index(), and the latter can
call into tracing code.  It also tried to restore segment registers
before restoring the LDT, which is straight-up wrong.

Reorder the code so that we restore GSBASE, then the descriptor
tables, then the segments.

This fixes two bugs.  First, it fixes a regression that broke resume
under certain configurations due to irqflag tracing in
native_load_gs_index().  Second, it fixes resume when the userspace
process that initiated suspect had funny segments.  The latter can be
reproduced by compiling this:

// SPDX-License-Identifier: GPL-2.0
/*
 * ldt_echo.c - Echo argv[1] while using an LDT segment
 */

int main(int argc, char **argv)
{
	int ret;
	size_t len;
	char *buf;

	const struct user_desc desc = {
                .entry_number    = 0,
                .base_addr       = 0,
                .limit           = 0xfffff,
                .seg_32bit       = 1,
                .contents        = 0, /* Data, grow-up */
                .read_exec_only  = 0,
                .limit_in_pages  = 1,
                .seg_not_present = 0,
                .useable         = 0
        };

	if (argc != 2)
		errx(1, "Usage: %s STRING", argv[0]);

	len = asprintf(&buf, "%s\n", argv[1]);
	if (len < 0)
		errx(1, "Out of memory");

	ret = syscall(SYS_modify_ldt, 1, &desc, sizeof(desc));
	if (ret < -1)
		errno = -ret;
	if (ret)
		err(1, "modify_ldt");

	asm volatile ("movw %0, %%es" :: "rm" ((unsigned short)7));
	write(1, buf, len);
	return 0;
}

and running ldt_echo >/sys/power/mem

Without the fix, the latter causes a triple fault on resume.

Fixes: ca37e57b ("x86/entry/64: Add missing irqflags tracing to native_load_gs_index()")
Reported-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Tested-by: default avatarJarkko Nikula <jarkko.nikula@linux.intel.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lkml.kernel.org/r/6b31721ea92f51ea839e79bd97ade4a75b1eeea2.1512057304.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent ddec3bde
...@@ -226,8 +226,20 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) ...@@ -226,8 +226,20 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)
load_idt((const struct desc_ptr *)&ctxt->idt_limit); load_idt((const struct desc_ptr *)&ctxt->idt_limit);
#endif #endif
#ifdef CONFIG_X86_64
/* /*
* segment registers * We need GSBASE restored before percpu access can work.
* percpu access can happen in exception handlers or in complicated
* helpers like load_gs_index().
*/
wrmsrl(MSR_GS_BASE, ctxt->gs_base);
#endif
fix_processor_context();
/*
* Restore segment registers. This happens after restoring the GDT
* and LDT, which happen in fix_processor_context().
*/ */
#ifdef CONFIG_X86_32 #ifdef CONFIG_X86_32
loadsegment(es, ctxt->es); loadsegment(es, ctxt->es);
...@@ -248,13 +260,14 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) ...@@ -248,13 +260,14 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)
load_gs_index(ctxt->gs); load_gs_index(ctxt->gs);
asm volatile ("movw %0, %%ss" :: "r" (ctxt->ss)); asm volatile ("movw %0, %%ss" :: "r" (ctxt->ss));
/*
* Restore FSBASE and user GSBASE after reloading the respective
* segment selectors.
*/
wrmsrl(MSR_FS_BASE, ctxt->fs_base); wrmsrl(MSR_FS_BASE, ctxt->fs_base);
wrmsrl(MSR_GS_BASE, ctxt->gs_base);
wrmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base); wrmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base);
#endif #endif
fix_processor_context();
do_fpu_end(); do_fpu_end();
tsc_verify_tsc_adjust(true); tsc_verify_tsc_adjust(true);
x86_platform.restore_sched_clock_state(); x86_platform.restore_sched_clock_state();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment