On 05/22/2018 12:10 PM, Jan Beulich wrote: >>>> On 22.05.18 at 17:15, <brge...@gmail.com> wrote: >> On Tue, May 22, 2018 at 9:57 AM, Jan Beulich <jbeul...@suse.com> wrote: >>>>>> On 22.05.18 at 15:45, <brge...@gmail.com> wrote: >>>> On Mon, May 21, 2018 at 11:54 PM, Boris Ostrovsky >>>> <boris.ostrov...@oracle.com> wrote: >>>>> @@ -98,6 +101,12 @@ ENTRY(pvh_start_xen) >>>>> /* 64-bit entry point. */ >>>>> .code64 >>>>> 1: >>>>> + /* Set base address in stack canary descriptor. */ >>>>> + mov $MSR_GS_BASE,%ecx >>>>> + mov $canary, %rax >>>>> + cdq >>>>> + wrmsr >>>> CDQ only sign-extends EAX to RAX. What you really want is to move the >>>> high 32-bits to EDX (or zero EDX if we can guarantee it is loaded >>>> below 4G). >>> What you describe is CDQE (AT&T name: CLTD); CDQ (AT&T: CLTQ) >>> sign-extends EAX to EDX:EAX. >> But that would still be wrong, as it would set EDX to 0xFFFFFFFF if >> the kernel was loaded between 2G and 4G. Looking closer at the code, >> we just left 32-bit mode, so we must have been loaded below 4G, >> therefore EDX must be zero. > Ah, yes, indeed.
We are loading virtual address for $canary so we will always have EDX set to 0xffffffff. Isn't that what we want? -borsi
