On Mon, Nov 13, 2017 at 11:22 AM, Dave Hansen <dave.han...@intel.com> wrote:
> On 11/10/2017 08:05 PM, Andy Lutomirski wrote:
>> diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
>> index fbc9b7f4e35e..8a9ba5553cab 100644
>> --- a/arch/x86/include/asm/fixmap.h
>> +++ b/arch/x86/include/asm/fixmap.h
>> @@ -52,6 +52,13 @@ extern unsigned long __FIXADDR_TOP;
>> struct cpu_entry_area
>> {
>> char gdt[PAGE_SIZE];
>> +
>> + /*
>> + * The gdt is just below cpu_tss and thus serves (on x86_64) as a
>> + * a read-only guard page for the SYSENTER stack at the bottom
>> + * of the TSS region.
>> + */
>> + struct tss_struct tss;
>> };
>>
>
> Aha, and here's the place that you need sizeof(tss_struct) to be nice
> and page-aligned.
>
> But why don't we just do:
>
> char tss_space[PAGE_SIZE*something];
The idea is to save some space. The TSS plus IO bitmap is slightly
over a page, so, if we're giving it a dedicated block of pages, we
have almost a page of unused space. I want to use some of that space
for the SYSENTER stack. To reliably detect overflow, that space
should be at the beginning.
It turns out that using almost a page is way too *big*: it masks bugs.
I want anything nontrivial that accidentally runs on the SYSENTER
stack to overflow and crash very quickly rather than having a decent
chance of working or of causing nasty corruption with a crash down the
road. So I'm going to make it much smaller and instead just add a
build-time assertion that we don't cross a page boundary.
