Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 9 Sep 2012 14:02:55 +0300
From:      Konstantin Belousov <kostikbel@gmail.com>
To:        Michael Fuckner <michael@fuckner.net>
Cc:        amd64@freebsd.org, current@freebsd.org
Subject:   Re: Small Ivy features: FSGSBASE and SMEP.
Message-ID:  <20120909110255.GM33100@deviant.kiev.zoral.com.ua>
In-Reply-To: <504C3A5D.4020402@fuckner.net>
References:  <20120908181019.GK33100@deviant.kiev.zoral.com.ua> <504C3A5D.4020402@fuckner.net>

next in thread | previous in thread | raw e-mail | index | archive | help

--fFCOmqB+j1dkVc7M
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 09, 2012 at 08:42:37AM +0200, Michael Fuckner wrote:
> Hi all,
>=20
> I changed your patch slightly to apply to specialreh.h on STABLE
>=20
> root@c64:/root # diff smep.1.patch.bak smep.1.patch
> 80c80
> < diff --git a/sys/x86/include/specialreg.h b/sys/x86/include/specialreg.h
> ---
> > diff --git a/sys/amd64/include/specialreg.h=20
> b/sys/amd64/include/specialreg.h
> 82,83c82,83
> < --- a/sys/x86/include/specialreg.h
> < +++ b/sys/x86/include/specialreg.h
> ---
> > --- a/sys/amd64/include/specialreg.h
> > +++ b/sys/amd64/include/specialreg.h
>=20
> I got a new kernel, but it is stuck immediately (kerneltrap 9 with=20
> interrupts disabled), system doesn't boot on E3-1230 V2 on Supermicro=20
> X9SCM-IIF
>=20
> Anything else I could check?
I need the backtrace and the whole kernel messages.

>=20
> Regards,
>  Michael!
>=20
>=20
> On 09/08/2012 08:10 PM, Konstantin Belousov wrote:
> >Please find at
> >http://people.freebsd.org/~kib/misc/smep.1.patch
> >the patch which should enable the FSGSBASE and SMEP features
> >supposedly present in the IvyBridge CPUs.
> >
> >FSGSBASE are four new instructions available in the 64bit mode only.
> >They allow to access bases for %fs and %gs without touching MSRs.
> >This makes it possible to both read and write bases in the user mode,
> >or in ring 0 with lower overhead.
> >
> >At the moment, WRFSBASE/WRGSBASE instructions should work, but are
> >useless since any interrupt or context switch overrides bases with the
> >values set by the arch syscall. Still, RDFSBASE/RDGSBASE might be useful
> >for some code and I see no reason not to enable them.
> >
> >SMEP is the nice feature of the processor which makes it trap if ring
> >0 tries to execute an instruction from usermode-accessible page. It is
> >another mitigation for things like calling user-controllable function
> >pointer in kernel, as well as a protection for NULL function pointer
> >dereference.
> >
> >I am sure that we never execute anything in kernel from user page, but
> >I did not tested the patch since I have no Ivy machine.
> >
> >I need your reports about boot on Ivy with patch applied. Please include
> >the lines from verbose dmesg with CPU Features. In particular, the
> >'Standard Extended Features' report should appear in output.
> >
> >Thanks.
> >

--fFCOmqB+j1dkVc7M
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (FreeBSD)

iEYEARECAAYFAlBMd18ACgkQC3+MBN1Mb4glMwCdGhoZUpGm7pNrVtaWckOZDDOt
tbYAnAlMmwTeFVMWTWYHd2LkiaSdI7oB
=/M8M
-----END PGP SIGNATURE-----

--fFCOmqB+j1dkVc7M--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120909110255.GM33100>