From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Beulich" Subject: [PATCH 2/4] x86: suppress SMAP and SMEP while running 32-bit PV guest code Date: Fri, 04 Mar 2016 04:27:52 -0700 Message-ID: <56D97F4802000078000D9561@prv-mh.provo.novell.com> References: <56D97AC102000078000D9537@prv-mh.provo.novell.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=__PartBE893C28.2__=" Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.84) (envelope-from ) id 1abntk-0002nV-2H for xen-devel@lists.xenproject.org; Fri, 04 Mar 2016 11:27:56 +0000 In-Reply-To: <56D97AC102000078000D9537@prv-mh.provo.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: xen-devel Cc: Andrew Cooper , Keir Fraser , Feng Wu List-Id: xen-devel@lists.xenproject.org This is a MIME message. If you are reading this text, you may want to consider changing to a mail reader or gateway that understands how to properly handle MIME multipart messages. --=__PartBE893C28.2__= Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Since such guests' kernel code runs in ring 1, their memory accesses, at the paging layer, are supervisor mode ones, and hence subject to SMAP/SMEP checks. Such guests cannot be expected to be aware of those two features though (and so far we also don't expose the respective feature flags), and hence may suffer page faults they cannot deal with. While the placement of the re-enabling slightly weakens the intended protection, it was selected such that 64-bit paths would remain unaffected where possible. At the expense of a further performance hit the re-enabling could be put right next to the CLACs. Note that this introduces a number of extra TLB flushes - CR4.SMEP transitioning from 0 to 1 always causes a flush, and it transitioning from 1 to 0 may also do. Signed-off-by: Jan Beulich --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -67,6 +67,8 @@ boolean_param("smep", opt_smep); static bool_t __initdata opt_smap =3D 1; boolean_param("smap", opt_smap); =20 +unsigned long __read_mostly cr4_smep_smap_mask; + /* Boot dom0 in pvh mode */ static bool_t __initdata opt_dom0pvh; boolean_param("dom0pvh", opt_dom0pvh); @@ -1335,6 +1337,8 @@ void __init noreturn __start_xen(unsigne if ( cpu_has_smap ) set_in_cr4(X86_CR4_SMAP); =20 + cr4_smep_smap_mask =3D mmu_cr4_features & (X86_CR4_SMEP | X86_CR4_SMAP= ); + if ( cpu_has_fsgsbase ) set_in_cr4(X86_CR4_FSGSBASE); =20 @@ -1471,7 +1475,10 @@ void __init noreturn __start_xen(unsigne * copy_from_user(). */ if ( cpu_has_smap ) + { + cr4_smep_smap_mask &=3D ~X86_CR4_SMAP; write_cr4(read_cr4() & ~X86_CR4_SMAP); + } =20 printk("%sNX (Execute Disable) protection %sactive\n", cpu_has_nx ? XENLOG_INFO : XENLOG_WARNING "Warning: ", @@ -1488,7 +1495,10 @@ void __init noreturn __start_xen(unsigne panic("Could not set up DOM0 guest OS"); =20 if ( cpu_has_smap ) + { write_cr4(read_cr4() | X86_CR4_SMAP); + cr4_smep_smap_mask |=3D X86_CR4_SMAP; + } =20 /* Scrub RAM that is still free and so may go to an unprivileged = domain. */ scrub_heap_pages(); --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -16,14 +16,16 @@ ENTRY(compat_hypercall) ASM_CLAC pushq $0 SAVE_VOLATILE type=3DTRAP_syscall compat=3D1 + SMEP_SMAP_RESTORE =20 cmpb $0,untrusted_msi(%rip) UNLIKELY_START(ne, msi_check) movl $HYPERCALL_VECTOR,%edi call check_for_unexpected_msi - LOAD_C_CLOBBERED + LOAD_C_CLOBBERED compat=3D1 ax=3D0 UNLIKELY_END(msi_check) =20 + movl UREGS_rax(%rsp),%eax GET_CURRENT(%rbx) =20 cmpl $NR_hypercalls,%eax @@ -33,7 +35,6 @@ UNLIKELY_END(msi_check) pushq UREGS_rbx(%rsp); pushq %rcx; pushq %rdx; pushq %rsi; pushq = %rdi pushq UREGS_rbp+5*8(%rsp) leaq compat_hypercall_args_table(%rip),%r10 - movl %eax,%eax movl $6,%ecx subb (%r10,%rax,1),%cl movq %rsp,%rdi @@ -48,7 +49,6 @@ UNLIKELY_END(msi_check) #define SHADOW_BYTES 16 /* Shadow EIP + shadow hypercall # */ #else /* Relocate argument registers and zero-extend to 64 bits. */ - movl %eax,%eax /* Hypercall # */ xchgl %ecx,%esi /* Arg 2, Arg 4 */ movl %edx,%edx /* Arg 3 */ movl %edi,%r8d /* Arg 5 */ @@ -174,10 +174,43 @@ compat_bad_hypercall: /* %rbx: struct vcpu, interrupts disabled */ ENTRY(compat_restore_all_guest) ASSERT_INTERRUPTS_DISABLED +.Lcr4_orig: + ASM_NOP3 /* mov %cr4, %rax */ + ASM_NOP6 /* and $..., %rax */ + ASM_NOP3 /* mov %rax, %cr4 */ + .pushsection .altinstr_replacement, "ax" +.Lcr4_alt: + mov %cr4, %rax + and $~(X86_CR4_SMEP|X86_CR4_SMAP), %rax + mov %rax, %cr4 +.Lcr4_alt_end: + .section .altinstructions, "a" + altinstruction_entry .Lcr4_orig, .Lcr4_alt, X86_FEATURE_SMEP, 12, = \ + (.Lcr4_alt_end - .Lcr4_alt) + altinstruction_entry .Lcr4_orig, .Lcr4_alt, X86_FEATURE_SMAP, 12, = \ + (.Lcr4_alt_end - .Lcr4_alt) + .popsection RESTORE_ALL adj=3D8 compat=3D1 .Lft0: iretq _ASM_PRE_EXTABLE(.Lft0, handle_exception) =20 +/* This mustn't modify registers other than %rax. */ +ENTRY(cr4_smep_smap_restore) + mov %cr4, %rax + test $X86_CR4_SMEP|X86_CR4_SMAP,%eax + jnz 0f + or cr4_smep_smap_mask(%rip), %rax + mov %rax, %cr4 + ret +0: + and cr4_smep_smap_mask(%rip), %eax + cmp cr4_smep_smap_mask(%rip), %eax + je 1f + BUG +1: + xor %eax, %eax + ret + /* %rdx: trap_bounce, %rbx: struct vcpu */ ENTRY(compat_post_handle_exception) testb $TBF_EXCEPTION,TRAPBOUNCE_flags(%rdx) @@ -190,6 +223,7 @@ ENTRY(compat_post_handle_exception) /* See lstar_enter for entry register state. */ ENTRY(cstar_enter) sti + SMEP_SMAP_RESTORE movq 8(%rsp),%rax /* Restore %rax. */ movq $FLAT_KERNEL_SS,8(%rsp) pushq %r11 @@ -225,6 +259,7 @@ UNLIKELY_END(compat_syscall_gpf) jmp .Lcompat_bounce_exception =20 ENTRY(compat_sysenter) + SMEP_SMAP_RESTORE movq VCPU_trap_ctxt(%rbx),%rcx cmpb $TRAP_gp_fault,UREGS_entry_vector(%rsp) movzwl VCPU_sysenter_sel(%rbx),%eax @@ -238,6 +273,7 @@ ENTRY(compat_sysenter) jmp compat_test_all_events =20 ENTRY(compat_int80_direct_trap) + SMEP_SMAP_RESTORE call compat_create_bounce_frame jmp compat_test_all_events =20 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -434,6 +434,7 @@ ENTRY(dom_crash_sync_extable) =20 ENTRY(common_interrupt) SAVE_ALL CLAC + SMEP_SMAP_RESTORE movq %rsp,%rdi callq do_IRQ jmp ret_from_intr @@ -454,13 +455,64 @@ ENTRY(page_fault) GLOBAL(handle_exception) SAVE_ALL CLAC handle_exception_saved: + GET_CURRENT(%rbx) testb $X86_EFLAGS_IF>>8,UREGS_eflags+1(%rsp) jz exception_with_ints_disabled - sti + +.Lsmep_smap_orig: + jmp 0f + .if 0 // GAS bug (affecting at least 2.22 ... 2.26) + .org .Lsmep_smap_orig + (.Lsmep_smap_alt_end - .Lsmep_smap_alt), = 0xcc + .else + // worst case: rex + opcode + modrm + 4-byte displacement + .skip (1 + 1 + 1 + 4) - 2, 0xcc + .endif + .pushsection .altinstr_replacement, "ax" +.Lsmep_smap_alt: + mov VCPU_domain(%rbx),%rax +.Lsmep_smap_alt_end: + .section .altinstructions, "a" + altinstruction_entry .Lsmep_smap_orig, .Lsmep_smap_alt, \ + X86_FEATURE_SMEP, \ + (.Lsmep_smap_alt_end - .Lsmep_smap_alt), \ + (.Lsmep_smap_alt_end - .Lsmep_smap_alt) + altinstruction_entry .Lsmep_smap_orig, .Lsmep_smap_alt, \ + X86_FEATURE_SMAP, \ + (.Lsmep_smap_alt_end - .Lsmep_smap_alt), \ + (.Lsmep_smap_alt_end - .Lsmep_smap_alt) + .popsection + + testb $3,UREGS_cs(%rsp) + jz 0f + cmpb $0,DOMAIN_is_32bit_pv(%rax) + je 0f + call cr4_smep_smap_restore + /* + * An NMI or #MC may occur between clearing CR4.SMEP and CR4.SMAP = in + * compat_restore_all_guest and it actually returning to guest + * context, in which case the guest would run with the two = features + * enabled. The only bad that can happen from this is a kernel = mode + * #PF which the guest doesn't expect. Rather than trying to make = the + * NMI/#MC exit path honor the intended CR4 setting, simply check + * whether the wrong CR4 was in use when the #PF occurred, and = exit + * back to the guest (which will in turn clear the two CR4 bits) = to + * re-execute the instruction. If we get back here, the CR4 bits + * should then be found clear (unless another NMI/#MC occurred at + * exactly the right time), and we'll continue processing the + * exception as normal. + */ + test %rax,%rax + jnz 0f + mov $PFEC_page_present,%al + cmpb $TRAP_page_fault,UREGS_entry_vector(%rsp) + jne 0f + xor UREGS_error_code(%rsp),%eax + test $~(PFEC_write_access|PFEC_insn_fetch),%eax + jz compat_test_all_events +0: sti 1: movq %rsp,%rdi movzbl UREGS_entry_vector(%rsp),%eax leaq exception_table(%rip),%rdx - GET_CURRENT(%rbx) PERFC_INCR(exceptions, %rax, %rbx) callq *(%rdx,%rax,8) testb $3,UREGS_cs(%rsp) @@ -592,6 +644,7 @@ handle_ist_exception: SAVE_ALL CLAC testb $3,UREGS_cs(%rsp) jz 1f + SMEP_SMAP_RESTORE /* Interrupted guest context. Copy the context to stack bottom. = */ GET_CPUINFO_FIELD(guest_cpu_user_regs,%rdi) movq %rsp,%rsi --- a/xen/include/asm-x86/asm_defns.h +++ b/xen/include/asm-x86/asm_defns.h @@ -209,6 +209,16 @@ void ret_from_intr(void); =20 #define ASM_STAC ASM_AC(STAC) #define ASM_CLAC ASM_AC(CLAC) + +#define SMEP_SMAP_RESTORE \ + 667: ASM_NOP5; \ + .pushsection .altinstr_replacement, "ax"; \ + 668: call cr4_smep_smap_restore; \ + .section .altinstructions, "a"; \ + altinstruction_entry 667b, 668b, X86_FEATURE_SMEP, 5, 5; \ + altinstruction_entry 667b, 668b, X86_FEATURE_SMAP, 5, 5; \ + .popsection + #else static always_inline void clac(void) { @@ -308,14 +318,18 @@ static always_inline void stac(void) * * For the way it is used in RESTORE_ALL, this macro must preserve = EFLAGS.ZF. */ -.macro LOAD_C_CLOBBERED compat=3D0 +.macro LOAD_C_CLOBBERED compat=3D0 ax=3D1 .if !\compat movq UREGS_r11(%rsp),%r11 movq UREGS_r10(%rsp),%r10 movq UREGS_r9(%rsp),%r9 movq UREGS_r8(%rsp),%r8 -.endif +.if \ax movq UREGS_rax(%rsp),%rax +.endif +.elseif \ax + movl UREGS_rax(%rsp),%eax +.endif movq UREGS_rcx(%rsp),%rcx movq UREGS_rdx(%rsp),%rdx movq UREGS_rsi(%rsp),%rsi --- a/xen/include/asm-x86/processor.h +++ b/xen/include/asm-x86/processor.h @@ -134,12 +134,12 @@ #define TF_kernel_mode (1<<_TF_kernel_mode) =20 /* #PF error code values. */ -#define PFEC_page_present (1U<<0) -#define PFEC_write_access (1U<<1) -#define PFEC_user_mode (1U<<2) -#define PFEC_reserved_bit (1U<<3) -#define PFEC_insn_fetch (1U<<4) -#define PFEC_prot_key (1U<<5) +#define PFEC_page_present (_AC(1,U) << 0) +#define PFEC_write_access (_AC(1,U) << 1) +#define PFEC_user_mode (_AC(1,U) << 2) +#define PFEC_reserved_bit (_AC(1,U) << 3) +#define PFEC_insn_fetch (_AC(1,U) << 4) +#define PFEC_prot_key (_AC(1,U) << 5) /* Internally used only flags. */ #define PFEC_page_paged (1U<<16) #define PFEC_page_shared (1U<<17) --=__PartBE893C28.2__= Content-Type: text/plain; name="x86-32on64-suppress-SMAP-SMEP.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="x86-32on64-suppress-SMAP-SMEP.patch" x86: suppress SMAP and SMEP while running 32-bit PV guest code=0A=0ASince = such guests' kernel code runs in ring 1, their memory accesses,=0Aat the = paging layer, are supervisor mode ones, and hence subject to=0ASMAP/SMEP = checks. Such guests cannot be expected to be aware of those=0Atwo features = though (and so far we also don't expose the respective=0Afeature flags), = and hence may suffer page faults they cannot deal with.=0A=0AWhile the = placement of the re-enabling slightly weakens the intended=0Aprotection, = it was selected such that 64-bit paths would remain=0Aunaffected where = possible. At the expense of a further performance hit=0Athe re-enabling = could be put right next to the CLACs.=0A=0ANote that this introduces a = number of extra TLB flushes - CR4.SMEP=0Atransitioning from 0 to 1 always = causes a flush, and it transitioning=0Afrom 1 to 0 may also do.=0A=0ASigned= -off-by: Jan Beulich =0A=0A--- a/xen/arch/x86/setup.c=0A= +++ b/xen/arch/x86/setup.c=0A@@ -67,6 +67,8 @@ boolean_param("smep", = opt_smep);=0A static bool_t __initdata opt_smap =3D 1;=0A boolean_param("sm= ap", opt_smap);=0A =0A+unsigned long __read_mostly cr4_smep_smap_mask;=0A+= =0A /* Boot dom0 in pvh mode */=0A static bool_t __initdata opt_dom0pvh;=0A= boolean_param("dom0pvh", opt_dom0pvh);=0A@@ -1335,6 +1337,8 @@ void = __init noreturn __start_xen(unsigne=0A if ( cpu_has_smap )=0A = set_in_cr4(X86_CR4_SMAP);=0A =0A+ cr4_smep_smap_mask =3D mmu_cr4_feature= s & (X86_CR4_SMEP | X86_CR4_SMAP);=0A+=0A if ( cpu_has_fsgsbase )=0A = set_in_cr4(X86_CR4_FSGSBASE);=0A =0A@@ -1471,7 +1475,10 @@ void = __init noreturn __start_xen(unsigne=0A * copy_from_user().=0A = */=0A if ( cpu_has_smap )=0A+ {=0A+ cr4_smep_smap_mask &=3D = ~X86_CR4_SMAP;=0A write_cr4(read_cr4() & ~X86_CR4_SMAP);=0A+ = }=0A =0A printk("%sNX (Execute Disable) protection %sactive\n",=0A = cpu_has_nx ? XENLOG_INFO : XENLOG_WARNING "Warning: ",=0A@@ -1488,7 = +1495,10 @@ void __init noreturn __start_xen(unsigne=0A panic("Coul= d not set up DOM0 guest OS");=0A =0A if ( cpu_has_smap )=0A+ {=0A = write_cr4(read_cr4() | X86_CR4_SMAP);=0A+ cr4_smep_smap_mask = |=3D X86_CR4_SMAP;=0A+ }=0A =0A /* Scrub RAM that is still free and = so may go to an unprivileged domain. */=0A scrub_heap_pages();=0A--- = a/xen/arch/x86/x86_64/compat/entry.S=0A+++ b/xen/arch/x86/x86_64/compat/ent= ry.S=0A@@ -16,14 +16,16 @@ ENTRY(compat_hypercall)=0A ASM_CLAC=0A = pushq $0=0A SAVE_VOLATILE type=3DTRAP_syscall compat=3D1=0A+= SMEP_SMAP_RESTORE=0A =0A cmpb $0,untrusted_msi(%rip)=0A = UNLIKELY_START(ne, msi_check)=0A movl $HYPERCALL_VECTOR,%edi=0A = call check_for_unexpected_msi=0A- LOAD_C_CLOBBERED=0A+ = LOAD_C_CLOBBERED compat=3D1 ax=3D0=0A UNLIKELY_END(msi_check)=0A =0A+ = movl UREGS_rax(%rsp),%eax=0A GET_CURRENT(%rbx)=0A =0A = cmpl $NR_hypercalls,%eax=0A@@ -33,7 +35,6 @@ UNLIKELY_END(msi_check)=0A = pushq UREGS_rbx(%rsp); pushq %rcx; pushq %rdx; pushq %rsi; pushq = %rdi=0A pushq UREGS_rbp+5*8(%rsp)=0A leaq compat_hypercall= _args_table(%rip),%r10=0A- movl %eax,%eax=0A movl = $6,%ecx=0A subb (%r10,%rax,1),%cl=0A movq %rsp,%rdi=0A@@ = -48,7 +49,6 @@ UNLIKELY_END(msi_check)=0A #define SHADOW_BYTES 16 /* = Shadow EIP + shadow hypercall # */=0A #else=0A /* Relocate = argument registers and zero-extend to 64 bits. */=0A- movl = %eax,%eax /* Hypercall # */=0A xchgl %ecx,%esi = /* Arg 2, Arg 4 */=0A movl %edx,%edx /* Arg 3 = */=0A movl %edi,%r8d /* Arg 5 */=0A@@ = -174,10 +174,43 @@ compat_bad_hypercall:=0A /* %rbx: struct vcpu, = interrupts disabled */=0A ENTRY(compat_restore_all_guest)=0A = ASSERT_INTERRUPTS_DISABLED=0A+.Lcr4_orig:=0A+ ASM_NOP3 /* mov = %cr4, %rax */=0A+ ASM_NOP6 /* and $..., %rax */=0A+ = ASM_NOP3 /* mov %rax, %cr4 */=0A+ .pushsection .altinstr_replaceme= nt, "ax"=0A+.Lcr4_alt:=0A+ mov %cr4, %rax=0A+ and = $~(X86_CR4_SMEP|X86_CR4_SMAP), %rax=0A+ mov %rax, %cr4=0A+.Lcr4_al= t_end:=0A+ .section .altinstructions, "a"=0A+ altinstruction_= entry .Lcr4_orig, .Lcr4_alt, X86_FEATURE_SMEP, 12, \=0A+ = (.Lcr4_alt_end - .Lcr4_alt)=0A+ altinstruction_entry = .Lcr4_orig, .Lcr4_alt, X86_FEATURE_SMAP, 12, \=0A+ = (.Lcr4_alt_end - .Lcr4_alt)=0A+ .popsection=0A = RESTORE_ALL adj=3D8 compat=3D1=0A .Lft0: iretq=0A _ASM_PRE_EXTABLE= (.Lft0, handle_exception)=0A =0A+/* This mustn't modify registers other = than %rax. */=0A+ENTRY(cr4_smep_smap_restore)=0A+ mov %cr4, = %rax=0A+ test $X86_CR4_SMEP|X86_CR4_SMAP,%eax=0A+ jnz = 0f=0A+ or cr4_smep_smap_mask(%rip), %rax=0A+ mov %rax, = %cr4=0A+ ret=0A+0:=0A+ and cr4_smep_smap_mask(%rip), = %eax=0A+ cmp cr4_smep_smap_mask(%rip), %eax=0A+ je = 1f=0A+ BUG=0A+1:=0A+ xor %eax, %eax=0A+ ret=0A+=0A = /* %rdx: trap_bounce, %rbx: struct vcpu */=0A ENTRY(compat_post_handle_exce= ption)=0A testb $TBF_EXCEPTION,TRAPBOUNCE_flags(%rdx)=0A@@ -190,6 = +223,7 @@ ENTRY(compat_post_handle_exception)=0A /* See lstar_enter for = entry register state. */=0A ENTRY(cstar_enter)=0A sti=0A+ = SMEP_SMAP_RESTORE=0A movq 8(%rsp),%rax /* Restore %rax. */=0A = movq $FLAT_KERNEL_SS,8(%rsp)=0A pushq %r11=0A@@ -225,6 +259,7 = @@ UNLIKELY_END(compat_syscall_gpf)=0A jmp .Lcompat_bounce_except= ion=0A =0A ENTRY(compat_sysenter)=0A+ SMEP_SMAP_RESTORE=0A = movq VCPU_trap_ctxt(%rbx),%rcx=0A cmpb $TRAP_gp_fault,UREGS_entry= _vector(%rsp)=0A movzwl VCPU_sysenter_sel(%rbx),%eax=0A@@ -238,6 = +273,7 @@ ENTRY(compat_sysenter)=0A jmp compat_test_all_events=0A= =0A ENTRY(compat_int80_direct_trap)=0A+ SMEP_SMAP_RESTORE=0A = call compat_create_bounce_frame=0A jmp compat_test_all_events= =0A =0A--- a/xen/arch/x86/x86_64/entry.S=0A+++ b/xen/arch/x86/x86_64/entry.= S=0A@@ -434,6 +434,7 @@ ENTRY(dom_crash_sync_extable)=0A =0A ENTRY(common_i= nterrupt)=0A SAVE_ALL CLAC=0A+ SMEP_SMAP_RESTORE=0A = movq %rsp,%rdi=0A callq do_IRQ=0A jmp ret_from_intr=0A@@ = -454,13 +455,64 @@ ENTRY(page_fault)=0A GLOBAL(handle_exception)=0A = SAVE_ALL CLAC=0A handle_exception_saved:=0A+ GET_CURRENT(%rbx)=0A = testb $X86_EFLAGS_IF>>8,UREGS_eflags+1(%rsp)=0A jz = exception_with_ints_disabled=0A- sti=0A+=0A+.Lsmep_smap_orig:=0A+ = jmp 0f=0A+ .if 0 // GAS bug (affecting at least 2.22 ... = 2.26)=0A+ .org .Lsmep_smap_orig + (.Lsmep_smap_alt_end - .Lsmep_smap= _alt), 0xcc=0A+ .else=0A+ // worst case: rex + opcode + = modrm + 4-byte displacement=0A+ .skip (1 + 1 + 1 + 4) - 2, 0xcc=0A+ = .endif=0A+ .pushsection .altinstr_replacement, "ax"=0A+.Lsmep= _smap_alt:=0A+ mov VCPU_domain(%rbx),%rax=0A+.Lsmep_smap_alt_end:= =0A+ .section .altinstructions, "a"=0A+ altinstruction_entry = .Lsmep_smap_orig, .Lsmep_smap_alt, \=0A+ = X86_FEATURE_SMEP, \=0A+ (.Lsmep_smap_alt_end - = .Lsmep_smap_alt), \=0A+ (.Lsmep_smap_alt_end - = .Lsmep_smap_alt)=0A+ altinstruction_entry .Lsmep_smap_orig, = .Lsmep_smap_alt, \=0A+ X86_FEATURE_SMAP, \=0A+ = (.Lsmep_smap_alt_end - .Lsmep_smap_alt), \=0A+ = (.Lsmep_smap_alt_end - .Lsmep_smap_alt)=0A+ = .popsection=0A+=0A+ testb $3,UREGS_cs(%rsp)=0A+ jz = 0f=0A+ cmpb $0,DOMAIN_is_32bit_pv(%rax)=0A+ je 0f=0A+ = call cr4_smep_smap_restore=0A+ /*=0A+ * An NMI or #MC = may occur between clearing CR4.SMEP and CR4.SMAP in=0A+ * = compat_restore_all_guest and it actually returning to guest=0A+ * = context, in which case the guest would run with the two features=0A+ = * enabled. The only bad that can happen from this is a kernel mode=0A+ = * #PF which the guest doesn't expect. Rather than trying to make = the=0A+ * NMI/#MC exit path honor the intended CR4 setting, simply = check=0A+ * whether the wrong CR4 was in use when the #PF = occurred, and exit=0A+ * back to the guest (which will in turn = clear the two CR4 bits) to=0A+ * re-execute the instruction. If we = get back here, the CR4 bits=0A+ * should then be found clear = (unless another NMI/#MC occurred at=0A+ * exactly the right time), = and we'll continue processing the=0A+ * exception as normal.=0A+ = */=0A+ test %rax,%rax=0A+ jnz 0f=0A+ mov = $PFEC_page_present,%al=0A+ cmpb $TRAP_page_fault,UREGS_entry_vector= (%rsp)=0A+ jne 0f=0A+ xor UREGS_error_code(%rsp),%eax=0A+= test $~(PFEC_write_access|PFEC_insn_fetch),%eax=0A+ jz = compat_test_all_events=0A+0: sti=0A 1: movq %rsp,%rdi=0A = movzbl UREGS_entry_vector(%rsp),%eax=0A leaq exception_table(%rip= ),%rdx=0A- GET_CURRENT(%rbx)=0A PERFC_INCR(exceptions, = %rax, %rbx)=0A callq *(%rdx,%rax,8)=0A testb $3,UREGS_cs(%r= sp)=0A@@ -592,6 +644,7 @@ handle_ist_exception:=0A SAVE_ALL = CLAC=0A testb $3,UREGS_cs(%rsp)=0A jz 1f=0A+ = SMEP_SMAP_RESTORE=0A /* Interrupted guest context. Copy the = context to stack bottom. */=0A GET_CPUINFO_FIELD(guest_cpu_user_reg= s,%rdi)=0A movq %rsp,%rsi=0A--- a/xen/include/asm-x86/asm_defns.h= =0A+++ b/xen/include/asm-x86/asm_defns.h=0A@@ -209,6 +209,16 @@ void = ret_from_intr(void);=0A =0A #define ASM_STAC ASM_AC(STAC)=0A #define = ASM_CLAC ASM_AC(CLAC)=0A+=0A+#define SMEP_SMAP_RESTORE = \=0A+ 667: ASM_NOP5; = \=0A+ .pushsection .altinstr_replacement, = "ax"; \=0A+ 668: call cr4_smep_smap_restore; = \=0A+ .section .altinstructions, "a"; = \=0A+ altinstruction_entry 667b, 668b, = X86_FEATURE_SMEP, 5, 5; \=0A+ altinstruction_entry 667b, = 668b, X86_FEATURE_SMAP, 5, 5; \=0A+ .popsection=0A+=0A = #else=0A static always_inline void clac(void)=0A {=0A@@ -308,14 +318,18 @@ = static always_inline void stac(void)=0A *=0A * For the way it is used in = RESTORE_ALL, this macro must preserve EFLAGS.ZF.=0A */=0A-.macro = LOAD_C_CLOBBERED compat=3D0=0A+.macro LOAD_C_CLOBBERED compat=3D0 = ax=3D1=0A .if !\compat=0A movq UREGS_r11(%rsp),%r11=0A = movq UREGS_r10(%rsp),%r10=0A movq UREGS_r9(%rsp),%r9=0A = movq UREGS_r8(%rsp),%r8=0A-.endif=0A+.if \ax=0A movq UREGS_rax(%r= sp),%rax=0A+.endif=0A+.elseif \ax=0A+ movl UREGS_rax(%rsp),%eax=0A+= .endif=0A movq UREGS_rcx(%rsp),%rcx=0A movq UREGS_rdx(%rs= p),%rdx=0A movq UREGS_rsi(%rsp),%rsi=0A--- a/xen/include/asm-x86/p= rocessor.h=0A+++ b/xen/include/asm-x86/processor.h=0A@@ -134,12 +134,12 = @@=0A #define TF_kernel_mode (1<<_TF_kernel_mode)=0A =0A /* #PF = error code values. */=0A-#define PFEC_page_present (1U<<0)=0A-#define = PFEC_write_access (1U<<1)=0A-#define PFEC_user_mode (1U<<2)=0A-#defi= ne PFEC_reserved_bit (1U<<3)=0A-#define PFEC_insn_fetch (1U<<4)=0A-#d= efine PFEC_prot_key (1U<<5)=0A+#define PFEC_page_present (_AC(1,U) = << 0)=0A+#define PFEC_write_access (_AC(1,U) << 1)=0A+#define PFEC_user_m= ode (_AC(1,U) << 2)=0A+#define PFEC_reserved_bit (_AC(1,U) << = 3)=0A+#define PFEC_insn_fetch (_AC(1,U) << 4)=0A+#define PFEC_prot_key = (_AC(1,U) << 5)=0A /* Internally used only flags. */=0A #define = PFEC_page_paged (1U<<16)=0A #define PFEC_page_shared (1U<<17)=0A --=__PartBE893C28.2__= Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KWGVuLWRldmVs IG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9yZwpodHRwOi8vbGlzdHMueGVuLm9y Zy94ZW4tZGV2ZWwK --=__PartBE893C28.2__=--