From: Andrew Cooper <andrew.cooper3@citrix.com>
To: Xen-devel <xen-devel@lists.xenproject.org>
Cc: "Andrew Cooper" <andrew.cooper3@citrix.com>,
"Wei Liu" <wl@xen.org>, "Jan Beulich" <JBeulich@suse.com>,
"Roger Pau Monné" <roger.pau@citrix.com>
Subject: [PATCH 06/16] x86/traps: Implement #CP handler and extend #PF for shadow stacks
Date: Fri, 1 May 2020 23:58:28 +0100 [thread overview]
Message-ID: <20200501225838.9866-7-andrew.cooper3@citrix.com> (raw)
In-Reply-To: <20200501225838.9866-1-andrew.cooper3@citrix.com>
For now, any #CP exception or shadow stack #PF indicate a bug in Xen, but
attempt to recover if taken in guest context.
Drop the comment beside do_page_fault(). It's stale (missing PFEC_prot_key),
and inaccurate (PFEC_present being set means just that, not necesserily a
protection violation).
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Wei Liu <wl@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
---
xen/arch/x86/traps.c | 55 ++++++++++++++++++++++++++++++++++-------
xen/arch/x86/x86_64/entry.S | 7 +++++-
xen/include/asm-x86/processor.h | 2 ++
3 files changed, 54 insertions(+), 10 deletions(-)
diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index 737ab036d2..ddbe312f89 100644
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -158,7 +158,9 @@ void (* const exception_table[TRAP_nr])(struct cpu_user_regs *regs) = {
[TRAP_alignment_check] = do_trap,
[TRAP_machine_check] = (void *)do_machine_check,
[TRAP_simd_error] = do_trap,
- [TRAP_virtualisation ...
+ [TRAP_virtualisation] = do_reserved_trap,
+ [X86_EXC_CP] = do_entry_CP,
+ [X86_EXC_CP + 1 ...
(ARRAY_SIZE(exception_table) - 1)] = do_reserved_trap,
};
@@ -1427,14 +1429,6 @@ static int fixup_page_fault(unsigned long addr, struct cpu_user_regs *regs)
return 0;
}
-/*
- * #PF error code:
- * Bit 0: Protection violation (=1) ; Page not present (=0)
- * Bit 1: Write access
- * Bit 2: User mode (=1) ; Supervisor mode (=0)
- * Bit 3: Reserved bit violation
- * Bit 4: Instruction fetch
- */
void do_page_fault(struct cpu_user_regs *regs)
{
unsigned long addr;
@@ -1457,6 +1451,10 @@ void do_page_fault(struct cpu_user_regs *regs)
{
enum pf_type pf_type = spurious_page_fault(addr, regs);
+ /* Any fault on a shadow stack access is a bug in Xen. */
+ if ( error_code & PFEC_shstk )
+ goto fatal;
+
if ( (pf_type == smep_fault) || (pf_type == smap_fault) )
{
console_start_sync();
@@ -1476,6 +1474,7 @@ void do_page_fault(struct cpu_user_regs *regs)
return;
}
+ fatal:
if ( debugger_trap_fatal(TRAP_page_fault, regs) )
return;
@@ -1906,6 +1905,43 @@ void do_debug(struct cpu_user_regs *regs)
pv_inject_hw_exception(TRAP_debug, X86_EVENT_NO_EC);
}
+void do_entry_CP(struct cpu_user_regs *regs)
+{
+ static const char errors[][10] = {
+ [1] = "near ret",
+ [2] = "far/iret",
+ [3] = "endbranch",
+ [4] = "rstorssp",
+ [5] = "setssbsy",
+ };
+ const char *err = "??";
+ unsigned int ec = regs->error_code;
+
+ if ( debugger_trap_entry(TRAP_debug, regs) )
+ return;
+
+ /* Decode ec if possible */
+ if ( ec < ARRAY_SIZE(errors) && errors[ec][0] )
+ err = errors[ec];
+
+ /*
+ * For now, only supervisors shadow stacks should be active. A #CP from
+ * guest context is probably a Xen bug, but kill the guest in an attempt
+ * to recover.
+ */
+ if ( guest_mode(regs) )
+ {
+ gprintk(XENLOG_ERR, "Hit #CP[%04x] in guest context %04x:%p\n",
+ ec, regs->cs, _p(regs->rip));
+ ASSERT_UNREACHABLE();
+ domain_crash(current->domain);
+ return;
+ }
+
+ show_execution_state(regs);
+ panic("CONTROL-FLOW PROTECTION FAULT: #CP[%04x] %s\n", ec, err);
+}
+
static void __init noinline __set_intr_gate(unsigned int n,
uint32_t dpl, void *addr)
{
@@ -1995,6 +2031,7 @@ void __init init_idt_traps(void)
set_intr_gate(TRAP_alignment_check,&alignment_check);
set_intr_gate(TRAP_machine_check,&machine_check);
set_intr_gate(TRAP_simd_error,&simd_coprocessor_error);
+ set_intr_gate(X86_EXC_CP, entry_CP);
/* Specify dedicated interrupt stacks for NMI, #DF, and #MC. */
enable_each_ist(idt_table);
diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
index a3ce298529..6403c0ab92 100644
--- a/xen/arch/x86/x86_64/entry.S
+++ b/xen/arch/x86/x86_64/entry.S
@@ -795,6 +795,10 @@ ENTRY(alignment_check)
movl $TRAP_alignment_check,4(%rsp)
jmp handle_exception
+ENTRY(entry_CP)
+ movl $X86_EXC_CP, 4(%rsp)
+ jmp handle_exception
+
ENTRY(double_fault)
movl $TRAP_double_fault,4(%rsp)
/* Set AC to reduce chance of further SMAP faults */
@@ -940,7 +944,8 @@ autogen_stubs: /* Automatically generated stubs. */
entrypoint 1b
/* Reserved exceptions, heading towards do_reserved_trap(). */
- .elseif vec == TRAP_copro_seg || vec == TRAP_spurious_int || (vec > TRAP_simd_error && vec < TRAP_nr)
+ .elseif vec == TRAP_copro_seg || vec == TRAP_spurious_int || \
+ vec == TRAP_virtualisation || (vec > X86_EXC_CP && vec < TRAP_nr)
1: test $8,%spl /* 64bit exception frames are 16 byte aligned, but the word */
jz 2f /* size is 8 bytes. Check whether the processor gave us an */
diff --git a/xen/include/asm-x86/processor.h b/xen/include/asm-x86/processor.h
index 12b55e1022..5e8a0fb649 100644
--- a/xen/include/asm-x86/processor.h
+++ b/xen/include/asm-x86/processor.h
@@ -68,6 +68,7 @@
#define PFEC_reserved_bit (_AC(1,U) << 3)
#define PFEC_insn_fetch (_AC(1,U) << 4)
#define PFEC_prot_key (_AC(1,U) << 5)
+#define PFEC_shstk (_AC(1,U) << 6)
#define PFEC_arch_mask (_AC(0xffff,U)) /* Architectural PFEC values. */
/* Internally used only flags. */
#define PFEC_page_paged (1U<<16)
@@ -529,6 +530,7 @@ DECLARE_TRAP_HANDLER(coprocessor_error);
DECLARE_TRAP_HANDLER(simd_coprocessor_error);
DECLARE_TRAP_HANDLER_CONST(machine_check);
DECLARE_TRAP_HANDLER(alignment_check);
+DECLARE_TRAP_HANDLER(entry_CP);
DECLARE_TRAP_HANDLER(entry_int82);
--
2.11.0
next prev parent reply other threads:[~2020-05-01 22:59 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-01 22:58 [PATCH 00/16] x86: Support for CET Supervisor Shadow Stacks Andrew Cooper
2020-05-01 22:58 ` [PATCH 01/16] x86/traps: Drop last_extable_addr Andrew Cooper
2020-05-04 12:44 ` Jan Beulich
2020-05-11 14:53 ` Andrew Cooper
2020-05-11 15:00 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 02/16] x86/traps: Clean up printing in do_reserved_trap()/fatal_trap() Andrew Cooper
2020-05-04 13:08 ` Jan Beulich
2020-05-11 15:01 ` Andrew Cooper
2020-05-11 15:09 ` Jan Beulich
2020-05-18 16:54 ` Andrew Cooper
2020-05-19 8:50 ` Jan Beulich
2020-05-26 15:38 ` Andrew Cooper
2020-05-27 6:54 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 03/16] x86/traps: Factor out exception_fixup() and make printing consistent Andrew Cooper
2020-05-04 13:20 ` Jan Beulich
2020-05-11 15:14 ` Andrew Cooper
2020-05-12 13:05 ` Jan Beulich
2020-05-26 18:06 ` Andrew Cooper
2020-05-27 7:01 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 04/16] x86/smpboot: Write the top-of-stack block in cpu_smpboot_alloc() Andrew Cooper
2020-05-04 13:22 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 05/16] x86/shstk: Introduce Supervisor Shadow Stack support Andrew Cooper
2020-05-04 13:52 ` Jan Beulich
2020-05-11 15:46 ` Andrew Cooper
2020-05-12 13:54 ` Jan Beulich
2020-05-15 16:21 ` Anthony PERARD
2020-05-01 22:58 ` Andrew Cooper [this message]
2020-05-04 14:10 ` [PATCH 06/16] x86/traps: Implement #CP handler and extend #PF for shadow stacks Jan Beulich
2020-05-11 17:20 ` Andrew Cooper
2020-05-12 13:58 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 07/16] x86/shstk: Re-layout the stack block " Andrew Cooper
2020-05-04 14:24 ` Jan Beulich
2020-05-11 17:48 ` Andrew Cooper
2020-05-12 14:07 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 08/16] x86/shstk: Create " Andrew Cooper
2020-05-04 14:55 ` Jan Beulich
2020-05-04 15:08 ` Andrew Cooper
2020-05-01 22:58 ` [PATCH 09/16] x86/cpu: Adjust enable_nmis() to be shadow stack compatible Andrew Cooper
2020-05-05 14:48 ` Jan Beulich
2020-05-11 18:48 ` Andrew Cooper
2020-05-01 22:58 ` [PATCH 10/16] x86/cpu: Adjust reset_stack_and_jump() " Andrew Cooper
2020-05-07 13:17 ` Jan Beulich
2020-05-11 20:07 ` Andrew Cooper
2020-05-01 22:58 ` [PATCH 11/16] x86/spec-ctrl: Adjust DO_OVERWRITE_RSB " Andrew Cooper
2020-05-07 13:22 ` Jan Beulich
2020-05-07 13:25 ` Andrew Cooper
2020-05-07 13:38 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 12/16] x86/extable: Adjust extable handling " Andrew Cooper
2020-05-07 13:35 ` Jan Beulich
2020-05-11 21:09 ` Andrew Cooper
2020-05-12 14:31 ` Jan Beulich
2020-05-12 16:14 ` Andrew Cooper
2020-05-13 9:22 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 13/16] x86/ioemul: Rewrite stub generation " Andrew Cooper
2020-05-07 13:46 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 14/16] x86/alt: Adjust _alternative_instructions() to not create shadow stacks Andrew Cooper
2020-05-07 13:49 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 15/16] x86/entry: Adjust guest paths to be shadow stack compatible Andrew Cooper
2020-05-07 14:12 ` Jan Beulich
2020-05-07 15:50 ` Andrew Cooper
2020-05-07 16:15 ` Jan Beulich
2020-05-11 21:45 ` Andrew Cooper
2020-05-12 14:56 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 16/16] x86/shstk: Activate Supervisor Shadow Stacks Andrew Cooper
2020-05-07 14:54 ` Jan Beulich
2020-05-11 23:46 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200501225838.9866-7-andrew.cooper3@citrix.com \
--to=andrew.cooper3@citrix.com \
--cc=JBeulich@suse.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).