Commit 26374c7b7dca1ff90607c83d9b82e917119f0456
Committed by
Andi Kleen
1 parent
0136611c62
Exists in
master
and in
4 other branches
[PATCH] Reload CS when startup_64 is used.
In long mode the %cs is largely a relic. However there are a few cases like iret where it matters that we have a valid value. Without this patch it is possible to enter the kernel in startup_64 without setting %cs to a valid value. With this patch we don't care what %cs value we enter the kernel with, so long as the cs shadow register indicates it is a privileged code segment. Thanks to Magnus Damm for finding this problem and posting the first workable patch. I have moved the jump to set %cs down a few instructions so we don't need to take an extra jump. Which keeps the code simpler. Signed-of-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Andi Kleen <ak@suse.de>
Showing 1 changed file with 7 additions and 4 deletions Side-by-side Diff
arch/x86_64/kernel/head.S
| ... | ... | @@ -185,12 +185,15 @@ |
| 185 | 185 | |
| 186 | 186 | /* Finally jump to run C code and to be on real kernel address |
| 187 | 187 | * Since we are running on identity-mapped space we have to jump |
| 188 | - * to the full 64bit address , this is only possible as indirect | |
| 189 | - * jump | |
| 188 | + * to the full 64bit address, this is only possible as indirect | |
| 189 | + * jump. In addition we need to ensure %cs is set so we make this | |
| 190 | + * a far return. | |
| 190 | 191 | */ |
| 191 | 192 | movq initial_code(%rip),%rax |
| 192 | - pushq $0 # fake return address | |
| 193 | - jmp *%rax | |
| 193 | + pushq $0 # fake return address to stop unwinder | |
| 194 | + pushq $__KERNEL_CS # set correct cs | |
| 195 | + pushq %rax # target address in negative space | |
| 196 | + lretq | |
| 194 | 197 | |
| 195 | 198 | /* SMP bootup changes these two */ |
| 196 | 199 | .align 8 |