Module Name: src
Committed By: maxv
Date: Sun Oct 15 13:34:24 UTC 2017
Modified Files:
src/sys/arch/amd64/amd64: machdep.c
Log Message:
Mmh, don't forget to clear the TLS gdt slots on Xen. Otherwise, when doing
a lwp32->lwp64 context switch, the new lwp can use the slots to reconstruct
the address of the previous lwp's TLS space (and defeat ASLR?).
To generate a diff of this commit:
cvs rdiff -u -r1.266 -r1.267 src/sys/arch/amd64/amd64/machdep.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/amd64/amd64/machdep.c
diff -u src/sys/arch/amd64/amd64/machdep.c:1.266 src/sys/arch/amd64/amd64/machdep.c:1.267
--- src/sys/arch/amd64/amd64/machdep.c:1.266 Sun Oct 15 12:49:53 2017
+++ src/sys/arch/amd64/amd64/machdep.c Sun Oct 15 13:34:24 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: machdep.c,v 1.266 2017/10/15 12:49:53 maxv Exp $ */
+/* $NetBSD: machdep.c,v 1.267 2017/10/15 13:34:24 maxv Exp $ */
/*
* Copyright (c) 1996, 1997, 1998, 2000, 2006, 2007, 2008, 2011
@@ -110,7 +110,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.266 2017/10/15 12:49:53 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.267 2017/10/15 13:34:24 maxv Exp $");
/* #define XENDEBUG_LOW */
@@ -431,6 +431,7 @@ x86_64_tls_switch(struct lwp *l)
struct cpu_info *ci = curcpu();
struct pcb *pcb = lwp_getpcb(l);
struct trapframe *tf = l->l_md.md_regs;
+ uint64_t zero = 0;
/*
* Raise the IPL to IPL_HIGH.
@@ -453,6 +454,8 @@ x86_64_tls_switch(struct lwp *l)
setfs(tf->tf_fs);
HYPERVISOR_set_segment_base(SEGBASE_GS_USER_SEL, tf->tf_gs);
} else {
+ update_descriptor(&curcpu()->ci_gdt[GUFS_SEL], &zero);
+ update_descriptor(&curcpu()->ci_gdt[GUGS_SEL], &zero);
setfs(0);
HYPERVISOR_set_segment_base(SEGBASE_GS_USER_SEL, 0);
HYPERVISOR_set_segment_base(SEGBASE_FS, pcb->pcb_fs);
