lkml.org 
[lkml]   [2021]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 173/207] x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
    Date
    From: Lai Jiangshan <laijs@linux.alibaba.com>

    [ Upstream commit c07e45553da1808aa802e9f0ffa8108cfeaf7a17 ]

    Commit

    18ec54fdd6d18 ("x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations")

    added FENCE_SWAPGS_{KERNEL|USER}_ENTRY for conditional SWAPGS. In
    paranoid_entry(), it uses only FENCE_SWAPGS_KERNEL_ENTRY for both
    branches. This is because the fence is required for both cases since the
    CR3 write is conditional even when PTI is enabled.

    But

    96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry")

    changed the order of SWAPGS and the CR3 write. And it missed the needed
    FENCE_SWAPGS_KERNEL_ENTRY for the user gsbase case.

    Add it back by changing the branches so that FENCE_SWAPGS_KERNEL_ENTRY
    can cover both branches.

    [ bp: Massage, fix typos, remove obsolete comment while at it. ]

    Fixes: 96b2371413e8f ("x86/entry/64: Switch CR3 before SWAPGS in paranoid entry")
    Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Link: https://lkml.kernel.org/r/20211126101209.8613-2-jiangshanlai@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/entry/entry_64.S | 16 +++++-----------
    1 file changed, 5 insertions(+), 11 deletions(-)

    diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
    index e38a4cf795d96..f1a8b5b2af964 100644
    --- a/arch/x86/entry/entry_64.S
    +++ b/arch/x86/entry/entry_64.S
    @@ -890,6 +890,7 @@ SYM_CODE_START_LOCAL(paranoid_entry)
    .Lparanoid_entry_checkgs:
    /* EBX = 1 -> kernel GSBASE active, no restore required */
    movl $1, %ebx
    +
    /*
    * The kernel-enforced convention is a negative GSBASE indicates
    * a kernel value. No SWAPGS needed on entry and exit.
    @@ -897,21 +898,14 @@ SYM_CODE_START_LOCAL(paranoid_entry)
    movl $MSR_GS_BASE, %ecx
    rdmsr
    testl %edx, %edx
    - jns .Lparanoid_entry_swapgs
    - ret
    + js .Lparanoid_kernel_gsbase

    -.Lparanoid_entry_swapgs:
    + /* EBX = 0 -> SWAPGS required on exit */
    + xorl %ebx, %ebx
    swapgs
    +.Lparanoid_kernel_gsbase:

    - /*
    - * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an
    - * unconditional CR3 write, even in the PTI case. So do an lfence
    - * to prevent GS speculation, regardless of whether PTI is enabled.
    - */
    FENCE_SWAPGS_KERNEL_ENTRY
    -
    - /* EBX = 0 -> SWAPGS required on exit */
    - xorl %ebx, %ebx
    ret
    SYM_CODE_END(paranoid_entry)

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-12-06 17:10    [W:4.194 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site