Re: [RFC 6/7] x86/asm: Remap the TSS into the cpu entry area

[Andy Lutomirski]

On Mon, Nov 13, 2017 at 11:22 AM, Dave Hansen <dave.hansen@xxxxxxxxx> wrote:
> On 11/10/2017 08:05 PM, Andy Lutomirski wrote:
>> diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
>> index fbc9b7f4e35e..8a9ba5553cab 100644
>> --- a/arch/x86/include/asm/fixmap.h
>> +++ b/arch/x86/include/asm/fixmap.h
>> @@ -52,6 +52,13 @@ extern unsigned long __FIXADDR_TOP;
>>  struct cpu_entry_area
>>  {
>>       char gdt[PAGE_SIZE];
>> +
>> +     /*
>> +      * The gdt is just below cpu_tss and thus serves (on x86_64) as a
>> +      * a read-only guard page for the SYSENTER stack at the bottom
>> +      * of the TSS region.
>> +      */
>> +     struct tss_struct tss;
>>  };
>>
>
> Aha, and here's the place that you need sizeof(tss_struct) to be nice
> and page-aligned.
>
> But why don't we just do:
>
>         char tss_space[PAGE_SIZE*something];

The idea is to save some space.  The TSS plus IO bitmap is slightly
over a page, so, if we're giving it a dedicated block of pages, we
have almost a page of unused space.  I want to use some of that space
for the SYSENTER stack.  To reliably detect overflow, that space
should be at the beginning.

It turns out that using almost a page is way too *big*: it masks bugs.
I want anything nontrivial that accidentally runs on the SYSENTER
stack to overflow and crash very quickly rather than having a decent
chance of working or of causing nasty corruption with a crash down the
road.  So I'm going to make it much smaller and instead just add a
build-time assertion that we don't cross a page boundary.