diff options
| author | Joerg Roedel <jroedel@suse.de> | 2020-04-28 17:16:22 +0200 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2020-05-04 19:53:08 +0200 |
| commit | 34bb49229f19399a5b45c323afb5749f31f7876c (patch) | |
| tree | f0611bd624af6d4fbae8921ef378642f4108f803 /arch/x86/boot | |
| parent | 40ba9309c76f29d012a5cc0cf938f8ff7dc6fef2 (diff) | |
x86/boot/compressed/64: Switch to __KERNEL_CS after GDT is loaded
When the pre-decompression code loads its first GDT in startup_64(), it
is still running on the CS value of the previous GDT. In the case of
SEV-ES, this is the EFI GDT but it can be anything depending on what has
loaded the kernel (boot loader, container runtime, etc.)
To make exception handling work (especially IRET) the CPU needs to
switch to a CS value in the current GDT, so jump to __KERNEL_CS after
the first GDT is loaded. This is prudent also as a general sanitization
of CS to a known good value.
[ bp: Massage commit message. ]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20200428151725.31091-13-joro@8bytes.org
Diffstat (limited to 'arch/x86/boot')
| -rw-r--r-- | arch/x86/boot/compressed/head_64.S | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S index 4f7e6b84be07..6b11060c3a0f 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -393,6 +393,14 @@ SYM_CODE_START(startup_64) addq %rax, 2(%rax) lgdt (%rax) + /* Reload CS so IRET returns to a CS actually in the GDT */ + pushq $__KERNEL_CS + leaq .Lon_kernel_cs(%rip), %rax + pushq %rax + lretq + +.Lon_kernel_cs: + /* * paging_prepare() sets up the trampoline and checks if we need to * enable 5-level paging. |