From: Jan Beulich <jbeulich@suse.com>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Xen-devel <xen-devel@lists.xenproject.org>,
"Wei Liu" <wl@xen.org>, "Roger Pau Monné" <roger.pau@citrix.com>
Subject: Re: [PATCH 09/16] x86/cpu: Adjust enable_nmis() to be shadow stack compatible
Date: Tue, 5 May 2020 16:48:37 +0200 [thread overview]
Message-ID: <478340f1-4238-1419-eeb7-c8c2ed7103a6@suse.com> (raw)
In-Reply-To: <20200501225838.9866-10-andrew.cooper3@citrix.com>
On 02.05.2020 00:58, Andrew Cooper wrote:
> When executing an IRET-to-self, the shadow stack must agree with the regular
> stack. We can't manipulate SSP directly, so have to fake a shadow IRET frame
> by executing 3 CALLs, then editing the result to look correct.
>
> This is not a fastpath, is called on the BSP long before CET can be set up,
> and may be called on the crash path after CET is disabled. Use the fact that
> INCSSP is allocated from the hint nop space to construct a test for CET being
> active which is safe on all processors.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
albeit with a question which may make a further change necessary:
> --- a/xen/include/asm-x86/processor.h
> +++ b/xen/include/asm-x86/processor.h
> @@ -544,17 +544,40 @@ static inline void enable_nmis(void)
> {
> unsigned long tmp;
>
> - asm volatile ( "mov %%rsp, %[tmp] \n\t"
> - "push %[ss] \n\t"
> - "push %[tmp] \n\t"
> - "pushf \n\t"
> - "push %[cs] \n\t"
> - "lea 1f(%%rip), %[tmp] \n\t"
> - "push %[tmp] \n\t"
> - "iretq; 1: \n\t"
> - : [tmp] "=&r" (tmp)
> + asm volatile ( "mov %%rsp, %[rsp] \n\t"
> + "lea .Ldone(%%rip), %[rip] \n\t"
> +#ifdef CONFIG_XEN_SHSTK
> + /* Check for CET-SS being active. */
> + "mov $1, %k[ssp] \n\t"
> + "rdsspq %[ssp] \n\t"
> + "cmp $1, %k[ssp] \n\t"
> + "je .Lshstk_done \n\t"
> +
> + /* Push 3 words on the shadow stack */
> + ".rept 3 \n\t"
> + "call 1f; nop; 1: \n\t"
> + ".endr \n\t"
> +
> + /* Fixup to be an IRET shadow stack frame */
> + "wrssq %q[cs], -1*8(%[ssp]) \n\t"
> + "wrssq %[rip], -2*8(%[ssp]) \n\t"
> + "wrssq %[ssp], -3*8(%[ssp]) \n\t"
> +
> + ".Lshstk_done:"
> +#endif
> + /* Write an IRET regular frame */
> + "push %[ss] \n\t"
> + "push %[rsp] \n\t"
> + "pushf \n\t"
> + "push %q[cs] \n\t"
> + "push %[rip] \n\t"
> + "iretq \n\t"
> + ".Ldone: \n\t"
> + : [rip] "=&r" (tmp),
> + [rsp] "=&r" (tmp),
> + [ssp] "=&r" (tmp)
Even after an hour of reading and searching through the gcc docs
I can't convince myself that this utilizes defined behavior. We
do tie multiple outputs to the same C variable elsewhere, yes,
but only in cases where we don't really care about the register,
or where the register is a fixed one anyway. What I can't find
is a clear statement that gcc wouldn't ever, now or in the
future, use the same register for all three outputs. I think one
can deduce this in certain ways, and experimentation also seems
to confirm it, but still.
Jan
next prev parent reply other threads:[~2020-05-05 14:48 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-01 22:58 [PATCH 00/16] x86: Support for CET Supervisor Shadow Stacks Andrew Cooper
2020-05-01 22:58 ` [PATCH 01/16] x86/traps: Drop last_extable_addr Andrew Cooper
2020-05-04 12:44 ` Jan Beulich
2020-05-11 14:53 ` Andrew Cooper
2020-05-11 15:00 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 02/16] x86/traps: Clean up printing in do_reserved_trap()/fatal_trap() Andrew Cooper
2020-05-04 13:08 ` Jan Beulich
2020-05-11 15:01 ` Andrew Cooper
2020-05-11 15:09 ` Jan Beulich
2020-05-18 16:54 ` Andrew Cooper
2020-05-19 8:50 ` Jan Beulich
2020-05-26 15:38 ` Andrew Cooper
2020-05-27 6:54 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 03/16] x86/traps: Factor out exception_fixup() and make printing consistent Andrew Cooper
2020-05-04 13:20 ` Jan Beulich
2020-05-11 15:14 ` Andrew Cooper
2020-05-12 13:05 ` Jan Beulich
2020-05-26 18:06 ` Andrew Cooper
2020-05-27 7:01 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 04/16] x86/smpboot: Write the top-of-stack block in cpu_smpboot_alloc() Andrew Cooper
2020-05-04 13:22 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 05/16] x86/shstk: Introduce Supervisor Shadow Stack support Andrew Cooper
2020-05-04 13:52 ` Jan Beulich
2020-05-11 15:46 ` Andrew Cooper
2020-05-12 13:54 ` Jan Beulich
2020-05-15 16:21 ` Anthony PERARD
2020-05-01 22:58 ` [PATCH 06/16] x86/traps: Implement #CP handler and extend #PF for shadow stacks Andrew Cooper
2020-05-04 14:10 ` Jan Beulich
2020-05-11 17:20 ` Andrew Cooper
2020-05-12 13:58 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 07/16] x86/shstk: Re-layout the stack block " Andrew Cooper
2020-05-04 14:24 ` Jan Beulich
2020-05-11 17:48 ` Andrew Cooper
2020-05-12 14:07 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 08/16] x86/shstk: Create " Andrew Cooper
2020-05-04 14:55 ` Jan Beulich
2020-05-04 15:08 ` Andrew Cooper
2020-05-01 22:58 ` [PATCH 09/16] x86/cpu: Adjust enable_nmis() to be shadow stack compatible Andrew Cooper
2020-05-05 14:48 ` Jan Beulich [this message]
2020-05-11 18:48 ` Andrew Cooper
2020-05-01 22:58 ` [PATCH 10/16] x86/cpu: Adjust reset_stack_and_jump() " Andrew Cooper
2020-05-07 13:17 ` Jan Beulich
2020-05-11 20:07 ` Andrew Cooper
2020-05-01 22:58 ` [PATCH 11/16] x86/spec-ctrl: Adjust DO_OVERWRITE_RSB " Andrew Cooper
2020-05-07 13:22 ` Jan Beulich
2020-05-07 13:25 ` Andrew Cooper
2020-05-07 13:38 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 12/16] x86/extable: Adjust extable handling " Andrew Cooper
2020-05-07 13:35 ` Jan Beulich
2020-05-11 21:09 ` Andrew Cooper
2020-05-12 14:31 ` Jan Beulich
2020-05-12 16:14 ` Andrew Cooper
2020-05-13 9:22 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 13/16] x86/ioemul: Rewrite stub generation " Andrew Cooper
2020-05-07 13:46 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 14/16] x86/alt: Adjust _alternative_instructions() to not create shadow stacks Andrew Cooper
2020-05-07 13:49 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 15/16] x86/entry: Adjust guest paths to be shadow stack compatible Andrew Cooper
2020-05-07 14:12 ` Jan Beulich
2020-05-07 15:50 ` Andrew Cooper
2020-05-07 16:15 ` Jan Beulich
2020-05-11 21:45 ` Andrew Cooper
2020-05-12 14:56 ` Jan Beulich
2020-05-01 22:58 ` [PATCH 16/16] x86/shstk: Activate Supervisor Shadow Stacks Andrew Cooper
2020-05-07 14:54 ` Jan Beulich
2020-05-11 23:46 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=478340f1-4238-1419-eeb7-c8c2ed7103a6@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).