| Message ID | 20191206221351.38241-12-samitolvanen@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v6,01/15] arm64: mm: avoid x18 in idmap_kpti_install_ng_mappings | expand |
On Fri, Dec 06, 2019 at 02:13:47PM -0800, Sami Tolvanen wrote: > If we detect a corrupted x18 and SCS is enabled, restore the register > before jumping back to instrumented code. This is safe, because the > wrapper is called with preemption disabled and a separate shadow stack > is used for interrupt handling. > > Signed-off-by: Sami Tolvanen <samitolvanen@google.com> > Reviewed-by: Kees Cook <keescook@chromium.org> > --- > arch/arm64/kernel/efi-rt-wrapper.S | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/arch/arm64/kernel/efi-rt-wrapper.S b/arch/arm64/kernel/efi-rt-wrapper.S > index 3fc71106cb2b..62f0260f5c17 100644 > --- a/arch/arm64/kernel/efi-rt-wrapper.S > +++ b/arch/arm64/kernel/efi-rt-wrapper.S > @@ -34,5 +34,14 @@ ENTRY(__efi_rt_asm_wrapper) > ldp x29, x30, [sp], #32 > b.ne 0f > ret > -0: b efi_handle_corrupted_x18 // tail call > +0: > +#ifdef CONFIG_SHADOW_CALL_STACK > + /* > + * Restore x18 before returning to instrumented code. This is > + * safe because the wrapper is called with preemption disabled and > + * a separate shadow stack is used for interrupts. > + */ > + mov x18, x2 > +#endif Why not restore it regardless of CONFIG_SHADOW_CALL_STACK? Will
On Thu, Jan 16, 2020 at 9:45 AM Will Deacon <will@kernel.org> wrote: > > On Fri, Dec 06, 2019 at 02:13:47PM -0800, Sami Tolvanen wrote: > > -0: b efi_handle_corrupted_x18 // tail call > > +0: > > +#ifdef CONFIG_SHADOW_CALL_STACK > > + /* > > + * Restore x18 before returning to instrumented code. This is > > + * safe because the wrapper is called with preemption disabled and > > + * a separate shadow stack is used for interrupts. > > + */ > > + mov x18, x2 > > +#endif > > Why not restore it regardless of CONFIG_SHADOW_CALL_STACK? The ifdefs are here only because restoring the register without SCS isn't actually necessary, but I'm fine with dropping them (and editing the comment) in the next version if you prefer. Sami
diff --git a/arch/arm64/kernel/efi-rt-wrapper.S b/arch/arm64/kernel/efi-rt-wrapper.S index 3fc71106cb2b..62f0260f5c17 100644 --- a/arch/arm64/kernel/efi-rt-wrapper.S +++ b/arch/arm64/kernel/efi-rt-wrapper.S @@ -34,5 +34,14 @@ ENTRY(__efi_rt_asm_wrapper) ldp x29, x30, [sp], #32 b.ne 0f ret -0: b efi_handle_corrupted_x18 // tail call +0: +#ifdef CONFIG_SHADOW_CALL_STACK + /* + * Restore x18 before returning to instrumented code. This is + * safe because the wrapper is called with preemption disabled and + * a separate shadow stack is used for interrupts. + */ + mov x18, x2 +#endif + b efi_handle_corrupted_x18 // tail call ENDPROC(__efi_rt_asm_wrapper)