| From 93f5997a2d59d8e4f299ad3143cc57fa9ec7bafb Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 26 Nov 2021 18:11:23 +0800 |
| Subject: x86/xen: Add xenpv_restore_regs_and_return_to_usermode() |
| |
| From: Lai Jiangshan <laijs@linux.alibaba.com> |
| |
| [ Upstream commit 5c8f6a2e316efebb3ba93d8c1af258155dcf5632 ] |
| |
| In the native case, PER_CPU_VAR(cpu_tss_rw + TSS_sp0) is the |
| trampoline stack. But XEN pv doesn't use trampoline stack, so |
| PER_CPU_VAR(cpu_tss_rw + TSS_sp0) is also the kernel stack. |
| |
| In that case, source and destination stacks are identical, which means |
| that reusing swapgs_restore_regs_and_return_to_usermode() in XEN pv |
| would cause %rsp to move up to the top of the kernel stack and leave the |
| IRET frame below %rsp. |
| |
| This is dangerous as it can be corrupted if #NMI / #MC hit as either of |
| these events occurring in the middle of the stack pushing would clobber |
| data on the (original) stack. |
| |
| And, with XEN pv, swapgs_restore_regs_and_return_to_usermode() pushing |
| the IRET frame on to the original address is useless and error-prone |
| when there is any future attempt to modify the code. |
| |
| [ bp: Massage commit message. ] |
| |
| Fixes: 7f2590a110b8 ("x86/entry/64: Use a per-CPU trampoline stack for IDT entries") |
| Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com> |
| Signed-off-by: Borislav Petkov <bp@suse.de> |
| Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> |
| Link: https://lkml.kernel.org/r/20211126101209.8613-4-jiangshanlai@gmail.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| arch/x86/entry/entry_64.S | 4 ++++ |
| arch/x86/xen/xen-asm.S | 20 ++++++++++++++++++++ |
| 2 files changed, 24 insertions(+) |
| |
| diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S |
| index a806d68b96990..de541ea2788eb 100644 |
| --- a/arch/x86/entry/entry_64.S |
| +++ b/arch/x86/entry/entry_64.S |
| @@ -575,6 +575,10 @@ SYM_INNER_LABEL(swapgs_restore_regs_and_return_to_usermode, SYM_L_GLOBAL) |
| ud2 |
| 1: |
| #endif |
| +#ifdef CONFIG_XEN_PV |
| + ALTERNATIVE "", "jmp xenpv_restore_regs_and_return_to_usermode", X86_FEATURE_XENPV |
| +#endif |
| + |
| POP_REGS pop_rdi=0 |
| |
| /* |
| diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S |
| index 53cf8aa35032d..011ec649f3886 100644 |
| --- a/arch/x86/xen/xen-asm.S |
| +++ b/arch/x86/xen/xen-asm.S |
| @@ -19,6 +19,7 @@ |
| |
| #include <linux/init.h> |
| #include <linux/linkage.h> |
| +#include <../entry/calling.h> |
| |
| /* |
| * Enable events. This clears the event mask and tests the pending |
| @@ -235,6 +236,25 @@ SYM_CODE_START(xen_sysret64) |
| jmp hypercall_iret |
| SYM_CODE_END(xen_sysret64) |
| |
| +/* |
| + * XEN pv doesn't use trampoline stack, PER_CPU_VAR(cpu_tss_rw + TSS_sp0) is |
| + * also the kernel stack. Reusing swapgs_restore_regs_and_return_to_usermode() |
| + * in XEN pv would cause %rsp to move up to the top of the kernel stack and |
| + * leave the IRET frame below %rsp, which is dangerous to be corrupted if #NMI |
| + * interrupts. And swapgs_restore_regs_and_return_to_usermode() pushing the IRET |
| + * frame at the same address is useless. |
| + */ |
| +SYM_CODE_START(xenpv_restore_regs_and_return_to_usermode) |
| + UNWIND_HINT_REGS |
| + POP_REGS |
| + |
| + /* stackleak_erase() can work safely on the kernel stack. */ |
| + STACKLEAK_ERASE_NOCLOBBER |
| + |
| + addq $8, %rsp /* skip regs->orig_ax */ |
| + jmp xen_iret |
| +SYM_CODE_END(xenpv_restore_regs_and_return_to_usermode) |
| + |
| /* |
| * Xen handles syscall callbacks much like ordinary exceptions, which |
| * means we have: |
| -- |
| 2.33.0 |
| |