Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.14\))
Subject: Re: [PATCH] x86/umip: Add emulation/spoofing for SLDT and STR
 instructions
From:   Brendan Shanks <bshanks@codeweavers.com>
In-Reply-To: <20200605224231.GA7466@ranerica-svr.sc.intel.com>
Date:   Mon, 8 Jun 2020 11:13:44 -0700
Cc:     Andy Lutomirski <luto@amacapital.net>,
        LKML <linux-kernel@vger.kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        "H. Peter Anvin" <hpa@zytor.com>, X86 ML <x86@kernel.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Andreas Rammhold <andi@notmuch.email>,
        "Moger, Babu" <Babu.Moger@amd.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <44E6353E-FFC1-4414-A5D7-2EF249A090BE@codeweavers.com>
References: <20200602184212.10813-1-bshanks@codeweavers.com>
 <20200604001243.GA24742@ranerica-svr.sc.intel.com>
 <CALCETrXrvNZQUqfjF+-=jh1TMBpdB0PT-8J5wWDO83+i3B5Q1w@mail.gmail.com>
 <E32838F8-665E-488F-96E4-040DD7BDA284@codeweavers.com>
 <20200605224231.GA7466@ranerica-svr.sc.intel.com>
To:     Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Jun 5, 2020, at 3:42 PM, Ricardo Neri =
<ricardo.neri-calderon@linux.intel.com> wrote:
>=20
> On Fri, Jun 05, 2020 at 11:58:13AM -0700, Brendan Shanks wrote:
>>=20
>>> On Jun 3, 2020, at 9:39 PM, Andy Lutomirski <luto@amacapital.net> =
wrote:
>>>=20
>>> On Wed, Jun 3, 2020 at 5:12 PM Ricardo Neri
>>> <ricardo.neri-calderon@linux.intel.com =
<mailto:ricardo.neri-calderon@linux.intel.com>> wrote:
>>>>=20
>>>> On Tue, Jun 02, 2020 at 11:42:12AM -0700, Brendan Shanks wrote:
>>>>> Add emulation/spoofing of SLDT and STR for both 32- and 64-bit
>>>>> processes.
>>>>>=20
>>>>> Wine users have found a small number of Windows apps using SLDT =
that
>>>>> were crashing when run on UMIP-enabled systems.
>>>>>=20
>>>>> Reported-by: Andreas Rammhold <andi@notmuch.email>
>>>>> Originally-by: Ricardo Neri =
<ricardo.neri-calderon@linux.intel.com>
>>>>> Signed-off-by: Brendan Shanks <bshanks@codeweavers.com>
>>>>> ---
>>>>> arch/x86/kernel/umip.c | 23 ++++++++++++++---------
>>>>> 1 file changed, 14 insertions(+), 9 deletions(-)
>>>>>=20
>>>>> diff --git a/arch/x86/kernel/umip.c b/arch/x86/kernel/umip.c
>>>>> index 8d5cbe1bbb3b..59dfceac5cc0 100644
>>>>> --- a/arch/x86/kernel/umip.c
>>>>> +++ b/arch/x86/kernel/umip.c
>>>>> @@ -64,6 +64,8 @@
>>>>> #define UMIP_DUMMY_GDT_BASE 0xfffffffffffe0000ULL
>>>>> #define UMIP_DUMMY_IDT_BASE 0xffffffffffff0000ULL
>>>>>=20
>>>>> +#define UMIP_DUMMY_TASK_REGISTER_SELECTOR 0x40
>>>>> +
>>>>> /*
>>>>> * The SGDT and SIDT instructions store the contents of the global =
descriptor
>>>>> * table and interrupt table registers, respectively. The =
destination is a
>>>>> @@ -244,16 +246,24 @@ static int emulate_umip_insn(struct insn =
*insn, int umip_inst,
>>>>>             *data_size +=3D UMIP_GDT_IDT_LIMIT_SIZE;
>>>>>             memcpy(data, &dummy_limit, UMIP_GDT_IDT_LIMIT_SIZE);
>>>>>=20
>>>>> -     } else if (umip_inst =3D=3D UMIP_INST_SMSW) {
>>>>> -             unsigned long dummy_value =3D CR0_STATE;
>>>>> +     } else if (umip_inst =3D=3D UMIP_INST_SMSW || umip_inst =3D=3D=
 UMIP_INST_SLDT ||
>>>>> +                umip_inst =3D=3D UMIP_INST_STR) {
>>>>> +             unsigned long dummy_value;
>>>>> +
>>>>> +             if (umip_inst =3D=3D UMIP_INST_SMSW)
>>>>> +                     dummy_value =3D CR0_STATE;
>>>>> +             else if (umip_inst =3D=3D UMIP_INST_STR)
>>>>> +                     dummy_value =3D =
UMIP_DUMMY_TASK_REGISTER_SELECTOR;
>>>>> +             else
>>>>> +                     dummy_value =3D 0;
>>>>=20
>>>> Perhaps you can return a non-zero value for SLDT if it has an LDT, =
as
>>>> Andy had suggested. Maybe this can be implemented by looking at
>>>> current->mm->context.ldt
>>>>=20
>>>> I guess the non-zero value can be (GDT_ENTRY_LDT*8).
>>>=20
>>> You could probably even get away with always returning a nonzero
>>> value.  After all, an empty LDT is quite similar to no LDT.
>>=20
>>=20
>> Is something like this what you both had in mind?
>=20
>> I don=E2=80=99t have any software handy to test the LDT-present case =
though.
>=20
> Perhaps you can insert a test in the kernel selftest. Something like
> this (based on Andreas' test program):
>=20
> --- a/tools/testing/selftests/x86/ldt_gdt.c
> +++ b/tools/testing/selftests/x86/ldt_gdt.c
> @@ -220,12 +220,23 @@ static void install_invalid(const struct =
user_desc *desc, bool oldmode)
> 	}
> }
>=20
> +unsigned long test(void)
> +{
> +	 unsigned char ldtr[5] =3D "\xef\xbe\xad\xde";
> +	 unsigned long ldt =3D 0;
> +	 asm("sldt %0\n" : "=3Dm" (ldtr));
> +	 ldt =3D *((unsigned long *)&ldtr[0]);
> +	 printf ("LDT base: 0x%lx\n", ldt);
> +	 return (ldt);
> +}
> +
> static int safe_modify_ldt(int func, struct user_desc *ptr,
>                           unsigned long bytecount)
> {
> 	int ret =3D syscall(SYS_modify_ldt, 0x11, ptr, bytecount);
> 	if (ret < -1)
> 	errno =3D -ret;
> +	test();
> 	return ret;
> }

Thanks for the tip, I gave that a try and got the same results under =
UMIP and a non-UMIP system. I=E2=80=99ll send this next version of the =
patch out.

Brendan Shanks
CodeWeavers