Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25e2999e authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Greg Kroah-Hartman
Browse files

x86/entry/64: Make cpu_entry_area.tss read-only 



commit c482feefe1aeb150156248ba0fd3e029bc886605 upstream.

The TSS is a fairly juicy target for exploits, and, now that the TSS
is in the cpu_entry_area, it's no longer protected by kASLR.  Make it
read-only on x86_64.

On x86_32, it can't be RO because it's written by the CPU during task
switches, and we use a task gate for double faults.  I'd also be
nervous about errata if we tried to make it RO even on configurations
without double fault handling.

[ tglx: AMD confirmed that there is no problem on 64-bit with TSS RO.  So
  	it's probably safe to assume that it's a non issue, though Intel
  	might have been creative in that area. Still waiting for
  	confirmation. ]

Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reviewed-by: default avatarBorislav Petkov <bpetkov@suse.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Eduardo Valentin <eduval@amazon.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: aliguori@amazon.com
Cc: daniel.gruss@iaik.tugraz.at
Cc: hughd@google.com
Cc: keescook@google.com
Link: https://lkml.kernel.org/r/20171204150606.733700132@linutronix.de


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e313437c

arch/x86/entry/entry_32.S

+2 −2
Original line number Diff line number Diff line
@@ -942,7 +942,7 @@ ENTRY(debug) 


	/* Are we currently on the SYSENTER stack? */

	movl	PER_CPU_VAR(cpu_entry_area), %ecx

	addl	$CPU_ENTRY_AREA_tss + TSS_STRUCT_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx

	addl	$CPU_ENTRY_AREA_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx

	subl	%eax, %ecx	/* ecx = (end of SYSENTER_stack) - esp */

	cmpl	$SIZEOF_SYSENTER_stack, %ecx

	jb	.Ldebug_from_sysenter_stack
@@ -986,7 +986,7 @@ ENTRY(nmi) 


	/* Are we currently on the SYSENTER stack? */

	movl	PER_CPU_VAR(cpu_entry_area), %ecx

	addl	$CPU_ENTRY_AREA_tss + TSS_STRUCT_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx

	addl	$CPU_ENTRY_AREA_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx

	subl	%eax, %ecx	/* ecx = (end of SYSENTER_stack) - esp */

	cmpl	$SIZEOF_SYSENTER_stack, %ecx

	jb	.Lnmi_from_sysenter_stack

arch/x86/entry/entry_64.S

+4 −4
Original line number Diff line number Diff line
@@ -154,7 +154,7 @@ END(native_usergs_sysret64) 
	_entry_trampoline - CPU_ENTRY_AREA_entry_trampoline(%rip)



/* The top word of the SYSENTER stack is hot and is usable as scratch space. */

#define RSP_SCRATCH	CPU_ENTRY_AREA_tss + TSS_STRUCT_SYSENTER_stack + \

#define RSP_SCRATCH	CPU_ENTRY_AREA_SYSENTER_stack + \

			SIZEOF_SYSENTER_stack - 8 + CPU_ENTRY_AREA



ENTRY(entry_SYSCALL_64_trampoline)
@@ -390,7 +390,7 @@ syscall_return_via_sysret: 
	 * Save old stack pointer and switch to trampoline stack.

	 */

	movq	%rsp, %rdi

	movq	PER_CPU_VAR(cpu_tss + TSS_sp0), %rsp

	movq	PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp



	pushq	RSP-RDI(%rdi)	/* RSP */

	pushq	(%rdi)		/* RDI */
@@ -719,7 +719,7 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode) 
	 * Save old stack pointer and switch to trampoline stack.

	 */

	movq	%rsp, %rdi

	movq	PER_CPU_VAR(cpu_tss + TSS_sp0), %rsp

	movq	PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp



	/* Copy the IRET frame to the trampoline stack. */

	pushq	6*8(%rdi)	/* SS */
@@ -934,7 +934,7 @@ apicinterrupt IRQ_WORK_VECTOR irq_work_interrupt smp_irq_work_interrupt 
/*

 * Exception entry points.

 */

#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss) + (TSS_ist + ((x) - 1) * 8)

#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss_rw) + (TSS_ist + ((x) - 1) * 8)



/*

 * Switch to the thread stack.  This is called with the IRET frame and

arch/x86/include/asm/fixmap.h

+9 −4
Original line number Diff line number Diff line
@@ -56,9 +56,14 @@ struct cpu_entry_area { 
	char gdt[PAGE_SIZE];



	/*

	 * The GDT is just below cpu_tss and thus serves (on x86_64) as a

	 * a read-only guard page for the SYSENTER stack at the bottom

	 * of the TSS region.

	 * The GDT is just below SYSENTER_stack and thus serves (on x86_64) as

	 * a a read-only guard page.

	 */

	struct SYSENTER_stack_page SYSENTER_stack_page;



	/*

	 * On x86_64, the TSS is mapped RO.  On x86_32, it's mapped RW because

	 * we need task switches to work, and task switches write to the TSS.

	 */

	struct tss_struct tss;
@@ -247,7 +252,7 @@ static inline struct cpu_entry_area *get_cpu_entry_area(int cpu) 


static inline struct SYSENTER_stack *cpu_SYSENTER_stack(int cpu)

{

	return &get_cpu_entry_area(cpu)->tss.SYSENTER_stack;

	return &get_cpu_entry_area(cpu)->SYSENTER_stack_page.stack;

}



#endif /* !__ASSEMBLY__ */

arch/x86/include/asm/processor.h

+8 −9
Original line number Diff line number Diff line
@@ -340,13 +340,11 @@ struct SYSENTER_stack { 
	unsigned long		words[64];

};



struct tss_struct {

	/*

	 * Space for the temporary SYSENTER stack, used for SYSENTER

	 * and the entry trampoline as well.

	 */

	struct SYSENTER_stack	SYSENTER_stack;

struct SYSENTER_stack_page {

	struct SYSENTER_stack stack;

} __aligned(PAGE_SIZE);



struct tss_struct {

	/*

	 * The fixed hardware portion.  This must not cross a page boundary

	 * at risk of violating the SDM's advice and potentially triggering
@@ -363,7 +361,7 @@ struct tss_struct { 
	unsigned long		io_bitmap[IO_BITMAP_LONGS + 1];

} __aligned(PAGE_SIZE);



DECLARE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss);

DECLARE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss_rw);



/*

 * sizeof(unsigned long) coming from an extra "long" at the end
@@ -378,7 +376,8 @@ DECLARE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss); 
#ifdef CONFIG_X86_32

DECLARE_PER_CPU(unsigned long, cpu_current_top_of_stack);

#else

#define cpu_current_top_of_stack cpu_tss.x86_tss.sp1

/* The RO copy can't be accessed with this_cpu_xyz(), so use the RW copy. */

#define cpu_current_top_of_stack cpu_tss_rw.x86_tss.sp1

#endif



/*
@@ -538,7 +537,7 @@ static inline void native_set_iopl_mask(unsigned mask) 
static inline void

native_load_sp0(unsigned long sp0)

{

	this_cpu_write(cpu_tss.x86_tss.sp0, sp0);

	this_cpu_write(cpu_tss_rw.x86_tss.sp0, sp0);

}



static inline void native_swapgs(void)

arch/x86/include/asm/switch_to.h

+2 −2
Original line number Diff line number Diff line
@@ -79,10 +79,10 @@ do { \ 
static inline void refresh_sysenter_cs(struct thread_struct *thread)

{

	/* Only happens when SEP is enabled, no need to test "SEP"arately: */

	if (unlikely(this_cpu_read(cpu_tss.x86_tss.ss1) == thread->sysenter_cs))

	if (unlikely(this_cpu_read(cpu_tss_rw.x86_tss.ss1) == thread->sysenter_cs))

		return;



	this_cpu_write(cpu_tss.x86_tss.ss1, thread->sysenter_cs);

	this_cpu_write(cpu_tss_rw.x86_tss.ss1, thread->sysenter_cs);

	wrmsr(MSR_IA32_SYSENTER_CS, thread->sysenter_cs, 0);

}

#endif