From: Lai Jiangshan <jiangshanlai@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: Lai Jiangshan <laijs@linux.alibaba.com>,
Andy Lutomirski <luto@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>
Subject: [PATCH V2 41/41] x86/syscall/64: Move the checking for sysret to C code
Date: Sun, 26 Sep 2021 23:08:38 +0800 [thread overview]
Message-ID: <20210926150838.197719-42-jiangshanlai@gmail.com> (raw)
In-Reply-To: <20210926150838.197719-1-jiangshanlai@gmail.com>
From: Lai Jiangshan <laijs@linux.alibaba.com>
Like do_fast_syscall_32() which checks whether it can return to userspace
via fast instructions before the function returns, do_syscall_64()
also checks whether it can use sysret to return to userspace before
do_syscall_64() returns via C code. And a bunch of ASM code can be
removed.
No functional change intended.
Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
---
arch/x86/entry/calling.h | 10 +----
arch/x86/entry/common.c | 73 ++++++++++++++++++++++++++++++-
arch/x86/entry/entry_64.S | 78 ++--------------------------------
arch/x86/include/asm/syscall.h | 2 +-
4 files changed, 78 insertions(+), 85 deletions(-)
diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 6f9de1c6da73..05da3ef48ee4 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -109,27 +109,19 @@ For 32-bit we have the following conventions - kernel is built with
CLEAR_REGS
.endm
-.macro POP_REGS pop_rdi=1 skip_r11rcx=0
+.macro POP_REGS pop_rdi=1
popq %r15
popq %r14
popq %r13
popq %r12
popq %rbp
popq %rbx
- .if \skip_r11rcx
- popq %rsi
- .else
popq %r11
- .endif
popq %r10
popq %r9
popq %r8
popq %rax
- .if \skip_r11rcx
- popq %rsi
- .else
popq %rcx
- .endif
popq %rdx
popq %rsi
.if \pop_rdi
diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 6c2826417b33..718045b7a53c 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -70,7 +70,77 @@ static __always_inline bool do_syscall_x32(struct pt_regs *regs, int nr)
return false;
}
-__visible noinstr void do_syscall_64(struct pt_regs *regs, int nr)
+/*
+ * Change top bits to match the most significant bit (47th or 56th bit
+ * depending on paging mode) in the address to get canonical address.
+ *
+ * If width of "canonical tail" ever becomes variable, this will need
+ * to be updated to remain correct on both old and new CPUs.
+ */
+static __always_inline u64 canonical_address(u64 vaddr)
+{
+ if (IS_ENABLED(CONFIG_X86_5LEVEL) && static_cpu_has(X86_FEATURE_LA57))
+ return ((s64)vaddr << (64 - 57)) >> (64 - 57);
+ else
+ return ((s64)vaddr << (64 - 48)) >> (64 - 48);
+}
+
+/*
+ * Check if it can use SYSRET.
+ *
+ * Try to use SYSRET instead of IRET if we're returning to
+ * a completely clean 64-bit userspace context.
+ *
+ * Returns 0 to return using IRET or 1 to return using SYSRET.
+ */
+static __always_inline int can_sysret(struct pt_regs *regs)
+{
+ /* In the Xen PV case we must use iret anyway. */
+ if (static_cpu_has(X86_FEATURE_XENPV))
+ return 0;
+
+ /* SYSRET requires RCX == RIP && R11 == RFLAGS */
+ if (regs->ip != regs->cx || regs->flags != regs->r11)
+ return 0;
+
+ /* CS and SS must match SYSRET */
+ if (regs->cs != __USER_CS || regs->ss != __USER_DS)
+ return 0;
+
+ /*
+ * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP
+ * in kernel space. This essentially lets the user take over
+ * the kernel, since userspace controls RSP.
+ */
+ if (regs->cx != canonical_address(regs->cx))
+ return 0;
+
+ /*
+ * SYSCALL clears RF when it saves RFLAGS in R11 and SYSRET cannot
+ * restore RF properly. If the slowpath sets it for whatever reason, we
+ * need to restore it correctly.
+ *
+ * SYSRET can restore TF, but unlike IRET, restoring TF results in a
+ * trap from userspace immediately after SYSRET. This would cause an
+ * infinite loop whenever #DB happens with register state that satisfies
+ * the opportunistic SYSRET conditions. For example, single-stepping
+ * this user code:
+ *
+ * movq $stuck_here, %rcx
+ * pushfq
+ * popq %r11
+ * stuck_here:
+ *
+ * would never get past 'stuck_here'.
+ */
+ if (regs->r11 & (X86_EFLAGS_RF | X86_EFLAGS_TF))
+ return 0;
+
+ return 1;
+}
+
+/* Returns 0 to return using IRET or 1 to return using SYSRET. */
+__visible noinstr int do_syscall_64(struct pt_regs *regs, int nr)
{
add_random_kstack_offset();
nr = syscall_enter_from_user_mode(regs, nr);
@@ -84,6 +154,7 @@ __visible noinstr void do_syscall_64(struct pt_regs *regs, int nr)
instrumentation_end();
syscall_exit_to_user_mode(regs);
+ return can_sysret(regs);
}
#endif
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 260be3c9da7d..777fbf7c3939 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -112,85 +112,15 @@ SYM_INNER_LABEL(entry_SYSCALL_64_after_hwframe, SYM_L_GLOBAL)
movslq %eax, %rsi
call do_syscall_64 /* returns with IRQs disabled */
- /*
- * Try to use SYSRET instead of IRET if we're returning to
- * a completely clean 64-bit userspace context. If we're not,
- * go to the slow exit path.
- * In the Xen PV case we must use iret anyway.
- */
-
- ALTERNATIVE "", "jmp swapgs_restore_regs_and_return_to_usermode", \
- X86_FEATURE_XENPV
-
- movq RCX(%rsp), %rcx
- movq RIP(%rsp), %r11
-
- cmpq %rcx, %r11 /* SYSRET requires RCX == RIP */
- jne swapgs_restore_regs_and_return_to_usermode
+ testl %eax, %eax
+ jz swapgs_restore_regs_and_return_to_usermode
/*
- * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP
- * in kernel space. This essentially lets the user take over
- * the kernel, since userspace controls RSP.
- *
- * If width of "canonical tail" ever becomes variable, this will need
- * to be updated to remain correct on both old and new CPUs.
- *
- * Change top bits to match most significant bit (47th or 56th bit
- * depending on paging mode) in the address.
- */
-#ifdef CONFIG_X86_5LEVEL
- ALTERNATIVE "shl $(64 - 48), %rcx; sar $(64 - 48), %rcx", \
- "shl $(64 - 57), %rcx; sar $(64 - 57), %rcx", X86_FEATURE_LA57
-#else
- shl $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
- sar $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
-#endif
-
- /* If this changed %rcx, it was not canonical */
- cmpq %rcx, %r11
- jne swapgs_restore_regs_and_return_to_usermode
-
- cmpq $__USER_CS, CS(%rsp) /* CS must match SYSRET */
- jne swapgs_restore_regs_and_return_to_usermode
-
- movq R11(%rsp), %r11
- cmpq %r11, EFLAGS(%rsp) /* R11 == RFLAGS */
- jne swapgs_restore_regs_and_return_to_usermode
-
- /*
- * SYSCALL clears RF when it saves RFLAGS in R11 and SYSRET cannot
- * restore RF properly. If the slowpath sets it for whatever reason, we
- * need to restore it correctly.
- *
- * SYSRET can restore TF, but unlike IRET, restoring TF results in a
- * trap from userspace immediately after SYSRET. This would cause an
- * infinite loop whenever #DB happens with register state that satisfies
- * the opportunistic SYSRET conditions. For example, single-stepping
- * this user code:
- *
- * movq $stuck_here, %rcx
- * pushfq
- * popq %r11
- * stuck_here:
- *
- * would never get past 'stuck_here'.
- */
- testq $(X86_EFLAGS_RF|X86_EFLAGS_TF), %r11
- jnz swapgs_restore_regs_and_return_to_usermode
-
- /* nothing to check for RSP */
-
- cmpq $__USER_DS, SS(%rsp) /* SS must match SYSRET */
- jne swapgs_restore_regs_and_return_to_usermode
-
- /*
- * We win! This label is here just for ease of understanding
+ * This label is here just for ease of understanding
* perf profiles. Nothing jumps here.
*/
syscall_return_via_sysret:
- /* rcx and r11 are already restored (see code above) */
- POP_REGS pop_rdi=0 skip_r11rcx=1
+ POP_REGS pop_rdi=0
/*
* Now all regs are restored except RSP and RDI.
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index f7e2d82d24fb..477adea7bac0 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h
@@ -159,7 +159,7 @@ static inline int syscall_get_arch(struct task_struct *task)
? AUDIT_ARCH_I386 : AUDIT_ARCH_X86_64;
}
-void do_syscall_64(struct pt_regs *regs, int nr);
+int do_syscall_64(struct pt_regs *regs, int nr);
void do_int80_syscall_32(struct pt_regs *regs);
long do_fast_syscall_32(struct pt_regs *regs);
--
2.19.1.6.gb485710b
prev parent reply other threads:[~2021-09-26 15:13 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-26 15:07 [PATCH V2 00/41] x86/entry/64: Convert a bunch of ASM entry code into C code Lai Jiangshan
2021-09-26 15:07 ` [PATCH V2 01/41] x86/entry: Fix swapgs fence Lai Jiangshan
2021-09-26 20:43 ` Thomas Gleixner
2021-09-27 1:10 ` Lai Jiangshan
2021-09-27 3:27 ` Lai Jiangshan
2021-09-27 7:50 ` Thomas Gleixner
2021-09-26 15:07 ` [PATCH V2 02/41] x86/traps: Remove stack-protector from traps.c Lai Jiangshan
2021-09-27 10:19 ` Borislav Petkov
2021-09-27 10:49 ` Lai Jiangshan
2021-09-27 11:01 ` Borislav Petkov
2021-09-27 14:38 ` Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 03/41] compiler_types.h: Add __noinstr_section() for noinstr Lai Jiangshan
2021-09-27 18:09 ` Kees Cook
2021-09-26 15:08 ` [PATCH V2 04/41] x86/entry: Introduce __entry_text for entry code written in C Lai Jiangshan
2021-09-30 11:49 ` Borislav Petkov
2021-09-26 15:08 ` [PATCH V2 05/41] x86/entry: Move PTI_USER_* to arch/x86/include/asm/processor-flags.h Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 06/41] x86: Mark __native_read_cr3() & native_write_cr3() as __always_inline Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 07/41] x86/traps: Move the declaration of native_irq_return_iret into proto.h Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 08/41] x86/entry: Add arch/x86/entry/entry64.c for C entry code Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 09/41] x86/entry: Expose the address of .Lgs_change to entry64.c Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 10/41] x86/entry: Add C verion of SWITCH_TO_KERNEL_CR3 as switch_to_kernel_cr3() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 11/41] x86/entry: Add C user_entry_swapgs_and_fence() and kernel_entry_fence_no_swapgs() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 12/41] x86/traps: Move pt_regs only in fixup_bad_iret() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 13/41] x86/entry: Switch the stack after error_entry() returns Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 14/41] x86/entry: move PUSH_AND_CLEAR_REGS out of error_entry Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 15/41] objtool: Allow .entry.text function using CLD instruction Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 16/41] x86/entry: Implement the whole error_entry() as C code Lai Jiangshan
2021-09-28 21:34 ` Brian Gerst
2021-09-29 8:45 ` Peter Zijlstra
2021-09-26 15:08 ` [PATCH V2 17/41] x86/entry: Make paranoid_exit() callable Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 18/41] x86/entry: Call paranoid_exit() in asm_exc_nmi() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 19/41] x86/entry: move PUSH_AND_CLEAR_REGS out of paranoid_entry Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 20/41] x86/entry: Add the C version ist_switch_to_kernel_cr3() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 21/41] x86/entry: Add the C version ist_restore_cr3() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 22/41] x86/entry: Add the C version get_percpu_base() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 23/41] x86/entry: Add the C version ist_switch_to_kernel_gsbase() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 24/41] x86/entry: Implement the C version ist_paranoid_entry() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 25/41] x86/entry: Implement the C version ist_paranoid_exit() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 26/41] x86/entry: Add a C macro to define the function body for IST in .entry.text Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 27/41] x86/mce: Remove stack protector from mce/core.c Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 28/41] x86/debug, mce: Use C entry code Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 29/41] x86/idtentry.h: Move the definitions *IDTENTRY_{MCE|DEBUG}* up Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 30/41] x86/nmi: Use DEFINE_IDTENTRY_NMI for nmi Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 31/41] x86/nmi: Remove stack protector from nmi.c Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 32/41] x86/nmi: Use C entry code Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 33/41] x86/entry: Add a C macro to define the function body for IST in .entry.text with an error code Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 34/41] x86/doublefault: Use C entry code Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 35/41] x86/sev: Add and use ist_vc_switch_off_ist() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 36/41] x86/sev: Remove stack protector from sev.c Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 37/41] x86/sev: Use C entry code Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 38/41] x86/entry: Remove ASM function paranoid_entry() and paranoid_exit() Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 39/41] x86/entry: Remove the unused ASM macros Lai Jiangshan
2021-09-26 15:08 ` [PATCH V2 40/41] x86/entry: Remove save_ret from PUSH_AND_CLEAR_REGS Lai Jiangshan
2021-09-26 15:08 ` Lai Jiangshan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210926150838.197719-42-jiangshanlai@gmail.com \
--to=jiangshanlai@gmail.com \
--cc=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=laijs@linux.alibaba.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).