From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
To: linux-kernel@vger.kernel.org, x86@kernel.org,
Andy Lutomirski <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Ravi Shankar <ravi.v.shankar@intel.com>,
Tony Luck <tony.luck@intel.com>,
Sohil Mehta <sohil.mehta@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Subject: [PATCH v3 08/12] x86/vsyscall: Add vsyscall emulation for #GP
Date: Fri, 9 Jun 2023 21:36:28 +0300 [thread overview]
Message-ID: <20230609183632.48706-9-alexander.shishkin@linux.intel.com> (raw)
In-Reply-To: <20230609183632.48706-1-alexander.shishkin@linux.intel.com>
From: Sohil Mehta <sohil.mehta@intel.com>
The legacy vsyscall page is mapped at a fixed address in the kernel
address range 0xffffffffff600000-0xffffffffff601000. Prior to LASS being
introduced, a legacy vsyscall page access from userspace would always
generate a page fault. The kernel emulates the execute (XONLY) accesses
in the page fault handler and returns back to userspace with the
appropriate register values.
Since LASS intercepts these accesses before the paging structures are
traversed it generates a general protection fault instead of a page
fault. The #GP fault doesn't provide much information in terms of the
error code. So, use the faulting RIP which is preserved in the user
registers to emulate the vsyscall access without going through complex
instruction decoding.
Signed-off-by: Sohil Mehta <sohil.mehta@intel.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
---
arch/x86/entry/vsyscall/vsyscall_64.c | 11 ++++++++++-
arch/x86/include/asm/vsyscall.h | 6 ++++++
arch/x86/kernel/traps.c | 4 ++++
3 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index dd112e538992..76e1344997d2 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -23,7 +23,7 @@
* soon be no new userspace code that will ever use a vsyscall.
*
* The code in this file emulates vsyscalls when notified of a page
- * fault to a vsyscall address.
+ * fault or a general protection fault to a vsyscall address.
*/
#include <linux/kernel.h>
@@ -309,6 +309,15 @@ bool emulate_vsyscall_pf(unsigned long error_code, struct pt_regs *regs,
return __emulate_vsyscall(regs, address);
}
+bool emulate_vsyscall_gp(struct pt_regs *regs)
+{
+ /* Emulate only if the RIP points to the vsyscall address */
+ if (!is_vsyscall_vaddr(regs->ip))
+ return false;
+
+ return __emulate_vsyscall(regs, regs->ip);
+}
+
/*
* A pseudo VMA to allow ptrace access for the vsyscall page. This only
* covers the 64bit vsyscall page now. 32bit has a real VMA now and does
diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
index 667b280afc1a..7180a849143f 100644
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -17,6 +17,7 @@ extern void set_vsyscall_pgtable_user_bits(pgd_t *root);
*/
extern bool emulate_vsyscall_pf(unsigned long error_code,
struct pt_regs *regs, unsigned long address);
+extern bool emulate_vsyscall_gp(struct pt_regs *regs);
#else
static inline void map_vsyscall(void) {}
static inline bool emulate_vsyscall_pf(unsigned long error_code,
@@ -24,6 +25,11 @@ static inline bool emulate_vsyscall_pf(unsigned long error_code,
{
return false;
}
+
+static inline bool emulate_vsyscall_gp(struct pt_regs *regs)
+{
+ return false;
+}
#endif
#endif /* _ASM_X86_VSYSCALL_H */
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index f3e619ce9fbd..42d13e17e068 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -65,6 +65,7 @@
#include <asm/vdso.h>
#include <asm/tdx.h>
#include <asm/cfi.h>
+#include <asm/vsyscall.h>
#ifdef CONFIG_X86_64
#include <asm/x86_init.h>
@@ -753,6 +754,9 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
if (cpu_feature_enabled(X86_FEATURE_UMIP) && fixup_umip_exception(regs))
goto exit;
+ if (cpu_feature_enabled(X86_FEATURE_LASS) && emulate_vsyscall_gp(regs))
+ goto exit;
+
gp_user_force_sig_segv(regs, X86_TRAP_GP, error_code, desc);
goto exit;
}
--
2.39.2
next prev parent reply other threads:[~2023-06-09 18:37 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-09 18:36 [PATCH v3 00/12] Enable Linear Address Space Separation support Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 01/12] x86/cpu: Enumerate the LASS feature bits Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 02/12] x86/asm: Introduce inline memcpy and memset Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 03/12] x86/alternatives: Disable LASS when patching kernel alternatives Alexander Shishkin
2023-07-31 22:41 ` Edgecombe, Rick P
2023-08-01 21:10 ` Sohil Mehta
2023-08-01 21:50 ` Edgecombe, Rick P
2023-06-09 18:36 ` [PATCH v3 04/12] x86/cpu: Enable LASS during CPU initialization Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 05/12] x86/cpu: Remove redundant comment during feature setup Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 06/12] x86/vsyscall: Reorganize the #PF emulation code Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 07/12] x86/traps: Consolidate user fixups in exc_general_protection() Alexander Shishkin
2023-06-09 18:36 ` Alexander Shishkin [this message]
2023-06-09 18:36 ` [PATCH v3 09/12] x86/vsyscall: Disable LASS if vsyscall mode is set to EMULATE Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 10/12] x86/vsyscall: Document the fact that vsyscall=emulate disables LASS Alexander Shishkin
2023-06-09 18:36 ` [PATCH v3 11/12] x86/cpu: Set LASS CR4 bit as pinning sensitive Alexander Shishkin
2023-06-09 18:36 ` [RFC v3 12/12] x86/efi: Disable LASS enforcement when switching to EFI MM Alexander Shishkin
2023-07-31 18:00 ` [PATCH v3 00/12] Enable Linear Address Space Separation support Alexander Shishkin
2023-07-31 22:36 ` Edgecombe, Rick P
2023-08-01 19:50 ` Sohil Mehta
2023-08-01 20:38 ` Edgecombe, Rick P
2023-08-04 23:52 ` Edgecombe, Rick P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230609183632.48706-9-alexander.shishkin@linux.intel.com \
--to=alexander.shishkin@linux.intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=ravi.v.shankar@intel.com \
--cc=sohil.mehta@intel.com \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).