patches/kernel/0138-x86-insn-eval-Add-utility-functions-to-get-segment-s.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Ingo Molnar <mingo@kernel.org>
   3 Date: Sat, 23 Dec 2017 13:14:25 +0100
   4 Subject: [PATCH] x86/insn-eval: Add utility functions to get segment selector
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 When computing a linear address and segmentation is used, we need to know
  12 the base address of the segment involved in the computation. In most of
  13 the cases, the segment base address will be zero as in USER_DS/USER32_DS.
  14 However, it may be possible that a user space program defines its own
  15 segments via a local descriptor table. In such a case, the segment base
  16 address may not be zero. Thus, the segment base address is needed to
  17 calculate correctly the linear address.
  18
  19 If running in protected mode, the segment selector to be used when
  20 computing a linear address is determined by either any of segment override
  21 prefixes in the instruction or inferred from the registers involved in the
  22 computation of the effective address; in that order. Also, there are cases
  23 when the segment override prefixes shall be ignored (i.e., code segments
  24 are always selected by the CS segment register; string instructions always
  25 use the ES segment register when using rDI register as operand). In long
  26 mode, segment registers are ignored, except for FS and GS. In these two
  27 cases, base addresses are obtained from the respective MSRs.
  28
  29 For clarity, this process can be split into four steps (and an equal
  30 number of functions): determine if segment prefixes overrides can be used;
  31 parse the segment override prefixes, and use them if found; if not found
  32 or cannot be used, use the default segment registers associated with the
  33 operand registers. Once the segment register to use has been identified,
  34 read its value to obtain the segment selector.
  35
  36 The method to obtain the segment selector depends on several factors. In
  37 32-bit builds, segment selectors are saved into a pt_regs structure
  38 when switching to kernel mode. The same is also true for virtual-8086
  39 mode. In 64-bit builds, segmentation is mostly ignored, except when
  40 running a program in 32-bit legacy mode. In this case, CS and SS can be
  41 obtained from pt_regs. DS, ES, FS and GS can be read directly from
  42 the respective segment registers.
  43
  44 In order to identify the segment registers, a new set of #defines is
  45 introduced. It also includes two special identifiers. One of them
  46 indicates when the default segment register associated with instruction
  47 operands shall be used. Another one indicates that the contents of the
  48 segment register shall be ignored; this identifier is used when in long
  49 mode.
  50
  51 Improvements-by: Borislav Petkov <bp@suse.de>
  52 Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
  53 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  54 Reviewed-by: Borislav Petkov <bp@suse.de>
  55 Cc: "Michael S. Tsirkin" <mst@redhat.com>
  56 Cc: Peter Zijlstra <peterz@infradead.org>
  57 Cc: Dave Hansen <dave.hansen@linux.intel.com>
  58 Cc: ricardo.neri@intel.com
  59 Cc: Adrian Hunter <adrian.hunter@intel.com>
  60 Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
  61 Cc: Huang Rui <ray.huang@amd.com>
  62 Cc: Qiaowei Ren <qiaowei.ren@intel.com>
  63 Cc: Shuah Khan <shuah@kernel.org>
  64 Cc: Kees Cook <keescook@chromium.org>
  65 Cc: Jonathan Corbet <corbet@lwn.net>
  66 Cc: Jiri Slaby <jslaby@suse.cz>
  67 Cc: Dmitry Vyukov <dvyukov@google.com>
  68 Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
  69 Cc: Chris Metcalf <cmetcalf@mellanox.com>
  70 Cc: Brian Gerst <brgerst@gmail.com>
  71 Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
  72 Cc: Andy Lutomirski <luto@kernel.org>
  73 Cc: Colin Ian King <colin.king@canonical.com>
  74 Cc: Chen Yucong <slaoub@gmail.com>
  75 Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
  76 Cc: Vlastimil Babka <vbabka@suse.cz>
  77 Cc: Lorenzo Stoakes <lstoakes@gmail.com>
  78 Cc: Masami Hiramatsu <mhiramat@kernel.org>
  79 Cc: Paolo Bonzini <pbonzini@redhat.com>
  80 Cc: Andrew Morton <akpm@linux-foundation.org>
  81 Cc: Thomas Garnier <thgarnie@google.com>
  82 Link: https://lkml.kernel.org/r/1509135945-13762-14-git-send-email-ricardo.neri-calderon@linux.intel.com
  83 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  84
  85 (Partially cherry picked from commit 32d0b95300db03c2b23b2ea2c94769a4a138e79d)
  86
  87 (cherry picked from commit ca2c18cb10c8beb56dfe21321abdddc724cec4de)
  88 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  89 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  90 (cherry picked from commit abd7780592a3687eacc0a295d4d2959bb11ff75f)
  91 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  92 ---
  93  arch/x86/include/asm/inat.h | 10 ++++++++++
  94  1 file changed, 10 insertions(+)
  95
  96 diff --git a/arch/x86/include/asm/inat.h b/arch/x86/include/asm/inat.h
  97 index 02aff0867211..1c78580e58be 100644
  98 --- a/arch/x86/include/asm/inat.h
  99 +++ b/arch/x86/include/asm/inat.h
 100 @@ -97,6 +97,16 @@
 101  #define INAT_MAKE_GROUP(grp)   ((grp << INAT_GRP_OFFS) | INAT_MODRM)
 102  #define INAT_MAKE_IMM(imm)     (imm << INAT_IMM_OFFS)
 103
 104 +/* Identifiers for segment registers */
 105 +#define INAT_SEG_REG_IGNORE    0
 106 +#define INAT_SEG_REG_DEFAULT   1
 107 +#define INAT_SEG_REG_CS                2
 108 +#define INAT_SEG_REG_SS                3
 109 +#define INAT_SEG_REG_DS                4
 110 +#define INAT_SEG_REG_ES                5
 111 +#define INAT_SEG_REG_FS                6
 112 +#define INAT_SEG_REG_GS                7
 113 +
 114  /* Attribute search APIs */
 115  extern insn_attr_t inat_get_opcode_attribute(insn_byte_t opcode);
 116  extern int inat_get_last_prefix_id(insn_byte_t last_pfx);
 117 --
 118 2.14.2
 119