Print this page
11859 need swapgs mitigation
Reviewed by: Robert Mustacchi <rm@fingolfin.org>
Reviewed by: Dan McDonald <danmcd@joyent.com>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Reviewed by: Robert Mustacchi <rm@fingolfin.org>


   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  *
  26  * Copyright 2018 Joyent, Inc.
  27  */
  28 
  29 /*
  30  * Debugger entry and exit for both master and slave CPUs. kdi_idthdl.s contains
  31  * the IDT stubs that drop into here (mainly via kdi_cmnint).
  32  */
  33 
  34 #if defined(__lint)
  35 #include <sys/types.h>
  36 #else
  37 
  38 #include <sys/segments.h>
  39 #include <sys/asm_linkage.h>
  40 #include <sys/controlregs.h>
  41 #include <sys/x86_archext.h>
  42 #include <sys/privregs.h>
  43 #include <sys/machprivregs.h>
  44 #include <sys/kdi_regs.h>
  45 #include <sys/psw.h>
  46 #include <sys/uadmin.h>


 254         subq    $REG_OFF(KDIREG_TRAPNO), %rsp
 255         KDI_SAVE_REGS(%rsp)
 256 
 257 #ifdef __xpv
 258         /*
 259          * Clear saved_upcall_mask in unused byte of cs slot on stack.
 260          * It can only confuse things.
 261          */
 262         movb    $0, REG_OFF(KDIREG_CS)+4(%rsp)
 263 #endif
 264 
 265 #if !defined(__xpv)
 266         /*
 267          * Switch to the kernel's GSBASE.  Neither GSBASE nor the ill-named
 268          * KGSBASE can be trusted, as the kernel may or may not have already
 269          * done a swapgs.  All is not lost, as the kernel can divine the correct
 270          * value for us.  Note that the previous GSBASE is saved in the
 271          * KDI_SAVE_REGS macro to prevent a usermode process's GSBASE from being
 272          * blown away.  On the hypervisor, we don't need to do this, since it's
 273          * ensured we're on our requested kernel GSBASE already.



 274          */
 275         subq    $10, %rsp
 276         sgdt    (%rsp)
 277         movq    2(%rsp), %rdi   /* gdt base now in %rdi */
 278         addq    $10, %rsp
 279         call    kdi_gdt2gsbase  /* returns kernel's GSBASE in %rax */
 280 
 281         movq    %rax, %rdx
 282         shrq    $32, %rdx
 283         movl    $MSR_AMD_GSBASE, %ecx
 284         wrmsr
 285 
 286         /*
 287          * In the trampoline we stashed the incoming %cr3. Copy this into
 288          * the kdiregs for restoration and later use.
 289          */
 290         mov     %gs:(CPU_KPTI_DBG+KPTI_TR_CR3), %rdx
 291         mov     %rdx, REG_OFF(KDIREG_CR3)(%rsp)
 292         /*
 293          * Switch to the kernel's %cr3. From the early interrupt handler




   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  *
  26  * Copyright 2019 Joyent, Inc.
  27  */
  28 
  29 /*
  30  * Debugger entry and exit for both master and slave CPUs. kdi_idthdl.s contains
  31  * the IDT stubs that drop into here (mainly via kdi_cmnint).
  32  */
  33 
  34 #if defined(__lint)
  35 #include <sys/types.h>
  36 #else
  37 
  38 #include <sys/segments.h>
  39 #include <sys/asm_linkage.h>
  40 #include <sys/controlregs.h>
  41 #include <sys/x86_archext.h>
  42 #include <sys/privregs.h>
  43 #include <sys/machprivregs.h>
  44 #include <sys/kdi_regs.h>
  45 #include <sys/psw.h>
  46 #include <sys/uadmin.h>


 254         subq    $REG_OFF(KDIREG_TRAPNO), %rsp
 255         KDI_SAVE_REGS(%rsp)
 256 
 257 #ifdef __xpv
 258         /*
 259          * Clear saved_upcall_mask in unused byte of cs slot on stack.
 260          * It can only confuse things.
 261          */
 262         movb    $0, REG_OFF(KDIREG_CS)+4(%rsp)
 263 #endif
 264 
 265 #if !defined(__xpv)
 266         /*
 267          * Switch to the kernel's GSBASE.  Neither GSBASE nor the ill-named
 268          * KGSBASE can be trusted, as the kernel may or may not have already
 269          * done a swapgs.  All is not lost, as the kernel can divine the correct
 270          * value for us.  Note that the previous GSBASE is saved in the
 271          * KDI_SAVE_REGS macro to prevent a usermode process's GSBASE from being
 272          * blown away.  On the hypervisor, we don't need to do this, since it's
 273          * ensured we're on our requested kernel GSBASE already.
 274          *
 275          * No need to worry about swapgs speculation here as it's unconditional
 276          * and via wrmsr anyway.
 277          */
 278         subq    $10, %rsp
 279         sgdt    (%rsp)
 280         movq    2(%rsp), %rdi   /* gdt base now in %rdi */
 281         addq    $10, %rsp
 282         call    kdi_gdt2gsbase  /* returns kernel's GSBASE in %rax */
 283 
 284         movq    %rax, %rdx
 285         shrq    $32, %rdx
 286         movl    $MSR_AMD_GSBASE, %ecx
 287         wrmsr
 288 
 289         /*
 290          * In the trampoline we stashed the incoming %cr3. Copy this into
 291          * the kdiregs for restoration and later use.
 292          */
 293         mov     %gs:(CPU_KPTI_DBG+KPTI_TR_CR3), %rdx
 294         mov     %rdx, REG_OFF(KDIREG_CR3)(%rsp)
 295         /*
 296          * Switch to the kernel's %cr3. From the early interrupt handler