Re: Small Ivy features: FSGSBASE and SMEP.
--MUnXZt0Uv08c1hBe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun, Sep 09, 2012 at 11:29:05PM +0300, Konstantin Belousov wrote:
> On Sun, Sep 09, 2012 at 02:02:55PM +0300, Konstantin Belousov wrote:
> > On Sun, Sep 09, 2012 at 08:42:37AM +0200, Michael Fuckner wrote:
> > > Hi all,
> > >=20
> > > I changed your patch slightly to apply to specialreh.h on STABLE
> > >=20
> > > root@c64:/root # diff smep.1.patch.bak smep.1.patch
> > > 80c80
> > > < diff --git a/sys/x86/include/specialreg.h b/sys/x86/include/special=
reg.h
> > > ---
> > > > diff --git a/sys/amd64/include/specialreg.h=20
> > > b/sys/amd64/include/specialreg.h
> > > 82,83c82,83
> > > < --- a/sys/x86/include/specialreg.h
> > > < +++ b/sys/x86/include/specialreg.h
> > > ---
> > > > --- a/sys/amd64/include/specialreg.h
> > > > +++ b/sys/amd64/include/specialreg.h
> > >=20
> > > I got a new kernel, but it is stuck immediately (kerneltrap 9 with=20
> > > interrupts disabled), system doesn't boot on E3-1230 V2 on Supermicro=
=20
> > > X9SCM-IIF
> > >=20
> > > Anything else I could check?
> > I need the backtrace and the whole kernel messages.
> At least, there was a typo in the definition of CR4_FSGSBASE.
> I still need verbose dmesg and panic messages, if any, with the
> http://people.freebsd.org/~kib/misc/smep.2.patch=20
> version of the patch.
>=20
With a help from Andrey, who has access to the hardware supporting SMEP,
I fixed the issue with double-fault on SMEP enable. The issue was due
to loader(8) making a handoff to the kernel with 1GB identity mapping
which has the PG_U bit set. As a result, after enabling the CR4.SMEP,
the #pf was generated immediately. But since the handler, if any, is
also mapped with PG_U, double-fault happen and machine was reset.
Updated patch, also fixing other minor problems with the features display,
is at http://people.freebsd.org/~kib/misc/smep.3.patch .
Please test.
> >=20
> > >=20
> > > Regards,
> > > Michael!
> > >=20
> > >=20
> > > On 09/08/2012 08:10 PM, Konstantin Belousov wrote:
> > > >Please find at
> > > >http://people.freebsd.org/~kib/misc/smep.1.patch
> > > >the patch which should enable the FSGSBASE and SMEP features
> > > >supposedly present in the IvyBridge CPUs.
> > > >
> > > >FSGSBASE are four new instructions available in the 64bit mode only.
> > > >They allow to access bases for %fs and %gs without touching MSRs.
> > > >This makes it possible to both read and write bases in the user mode,
> > > >or in ring 0 with lower overhead.
> > > >
> > > >At the moment, WRFSBASE/WRGSBASE instructions should work, but are
> > > >useless since any interrupt or context switch overrides bases with t=
he
> > > >values set by the arch syscall. Still, RDFSBASE/RDGSBASE might be us=
eful
> > > >for some code and I see no reason not to enable them.
> > > >
> > > >SMEP is the nice feature of the processor which makes it trap if ring
> > > >0 tries to execute an instruction from usermode-accessible page. It =
is
> > > >another mitigation for things like calling user-controllable function
> > > >pointer in kernel, as well as a protection for NULL function pointer
> > > >dereference.
> > > >
> > > >I am sure that we never execute anything in kernel from user page, b=
ut
> > > >I did not tested the patch since I have no Ivy machine.
> > > >
> > > >I need your reports about boot on Ivy with patch applied. Please inc=
lude
> > > >the lines from verbose dmesg with CPU Features. In particular, the
> > > >'Standard Extended Features' report should appear in output.
> > > >
> > > >Thanks.
> > > >
>=20
>=20
--MUnXZt0Uv08c1hBe
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (FreeBSD)
iEYEARECAAYFAlCP7pYACgkQC3+MBN1Mb4i4XgCeMbWPn1gy9FTlpXgomSgRMzlm
JRsAoNo07WO49h+wnpyaOHBAO9d0Fb0T
=0ClT
-----END PGP SIGNATURE-----
--MUnXZt0Uv08c1hBe--
討論串 (同標題文章)
完整討論串 (本文為第 7 之 7 篇)：