Subject: Re: [RFC PATCH] x86: Make sure verify_cpu has a good stack
To: Borislav Petkov <bp@alien8.de>
References: <1456917606-4979-1-git-send-email-bp@alien8.de>
 <CAMzpN2jsSaQDtnMSbPq7W5GY_1WUmjts9-9kq45E29=nXAV7rw@mail.gmail.com>
 <20160302162530.GA8362@pd.tnic>
 <086BE61B-DCCC-4105-90A2-295A487C7F6F@zytor.com>
 <20160302181556.GD8362@pd.tnic>
Cc: Brian Gerst <brgerst@gmail.com>, X86 ML <x86@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Tom Lendacky <thomas.lendacky@amd.com>
From: "H. Peter Anvin" <hpa@zytor.com>
Message-ID: <56D73349.3020609@zytor.com>
Date: Wed, 2 Mar 2016 10:39:05 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <20160302181556.GD8362@pd.tnic>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 819
Lines: 27

On 03/02/16 10:15, Borislav Petkov wrote:
> On Wed, Mar 02, 2016 at 09:53:28AM -0800, H. Peter Anvin wrote:
>> Please explain why we can't use rip-relative addressing in some form...
> 
> We *can* do almost what Brian suggested:
> 
>         movq    stack_start(%rip), %rsp
>         subq    $__START_KERNEL_map, %rsp
> 
> But we still have to subtract __START_KERNEL_map.
> 

Well, we definitely should use %rip-relative addressing if we can.

However, even so I believe this breaks if the kernel is loaded anywhere
but its default load address.  I think we need to do something like:

	movq	stack_start(%rip), %rax
	leaq	__START_KERNEL_map(%rip), %rdx
	subq	%rdx, %rax
	movq	%rax, %rsp

The use of temporary registers avoids clobbering a valid stack pointer
for even a single instruction if we are given one.

	-hpa