| From d5a0fcd335821d7ec7e27acf6ae625a3ae41ba7b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 26 Nov 2021 18:11:21 +0800 |
| Subject: x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry() |
| |
| From: Lai Jiangshan <laijs@linux.alibaba.com> |
| |
| [ Upstream commit c07e45553da1808aa802e9f0ffa8108cfeaf7a17 ] |
| |
| Commit |
| |
| 18ec54fdd6d18 ("x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations") |
| |
| added FENCE_SWAPGS_{KERNEL|USER}_ENTRY for conditional SWAPGS. In |
| paranoid_entry(), it uses only FENCE_SWAPGS_KERNEL_ENTRY for both |
| branches. This is because the fence is required for both cases since the |
| CR3 write is conditional even when PTI is enabled. |
| |
| But |
| |
| 96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry") |
| |
| changed the order of SWAPGS and the CR3 write. And it missed the needed |
| FENCE_SWAPGS_KERNEL_ENTRY for the user gsbase case. |
| |
| Add it back by changing the branches so that FENCE_SWAPGS_KERNEL_ENTRY |
| can cover both branches. |
| |
| [ bp: Massage, fix typos, remove obsolete comment while at it. ] |
| |
| Fixes: 96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry") |
| Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com> |
| Signed-off-by: Borislav Petkov <bp@suse.de> |
| Link: https://lkml.kernel.org/r/20211126101209.8613-2-jiangshanlai@gmail.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| arch/x86/entry/entry_64.S | 16 +++++----------- |
| 1 file changed, 5 insertions(+), 11 deletions(-) |
| |
| diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S |
| index 166554a109aeb..a24ce5905ab82 100644 |
| --- a/arch/x86/entry/entry_64.S |
| +++ b/arch/x86/entry/entry_64.S |
| @@ -936,6 +936,7 @@ SYM_CODE_START_LOCAL(paranoid_entry) |
| .Lparanoid_entry_checkgs: |
| /* EBX = 1 -> kernel GSBASE active, no restore required */ |
| movl $1, %ebx |
| + |
| /* |
| * The kernel-enforced convention is a negative GSBASE indicates |
| * a kernel value. No SWAPGS needed on entry and exit. |
| @@ -943,21 +944,14 @@ SYM_CODE_START_LOCAL(paranoid_entry) |
| movl $MSR_GS_BASE, %ecx |
| rdmsr |
| testl %edx, %edx |
| - jns .Lparanoid_entry_swapgs |
| - ret |
| + js .Lparanoid_kernel_gsbase |
| |
| -.Lparanoid_entry_swapgs: |
| + /* EBX = 0 -> SWAPGS required on exit */ |
| + xorl %ebx, %ebx |
| swapgs |
| +.Lparanoid_kernel_gsbase: |
| |
| - /* |
| - * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an |
| - * unconditional CR3 write, even in the PTI case. So do an lfence |
| - * to prevent GS speculation, regardless of whether PTI is enabled. |
| - */ |
| FENCE_SWAPGS_KERNEL_ENTRY |
| - |
| - /* EBX = 0 -> SWAPGS required on exit */ |
| - xorl %ebx, %ebx |
| ret |
| SYM_CODE_END(paranoid_entry) |
| |
| -- |
| 2.33.0 |
| |
