| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| From: Sami Tolvanen <samitolvanen@google.com> |
| Date: Wed, 2 May 2018 11:03:32 -0700 |
| Subject: FROMLIST: arm64: preserve x18 when CPU is suspended |
| |
| Don't lose the current task's shadow stack when the CPU is suspended. |
| |
| Bug: 145210207 |
| Change-Id: I8db58daadcc15a00a6f585580a3c97905c678eb3 |
| (am from https://lore.kernel.org/patchwork/patch/1149059/) |
| Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> |
| Reviewed-by: Kees Cook <keescook@chromium.org> |
| Reviewed-by: Mark Rutland <mark.rutland@arm.com> |
| Signed-off-by: Sami Tolvanen <samitolvanen@google.com> |
| --- |
| arch/arm64/include/asm/suspend.h | 2 +- |
| arch/arm64/mm/proc.S | 14 ++++++++++++++ |
| 2 files changed, 15 insertions(+), 1 deletion(-) |
| |
| diff --git a/arch/arm64/include/asm/suspend.h b/arch/arm64/include/asm/suspend.h |
| index 8939c87c4dce..0cde2f473971 100644 |
| --- a/arch/arm64/include/asm/suspend.h |
| +++ b/arch/arm64/include/asm/suspend.h |
| @@ -2,7 +2,7 @@ |
| #ifndef __ASM_SUSPEND_H |
| #define __ASM_SUSPEND_H |
| |
| -#define NR_CTX_REGS 12 |
| +#define NR_CTX_REGS 13 |
| #define NR_CALLEE_SAVED_REGS 12 |
| |
| /* |
| diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S |
| index fdabf40a83c8..5c8219c55948 100644 |
| --- a/arch/arm64/mm/proc.S |
| +++ b/arch/arm64/mm/proc.S |
| @@ -49,6 +49,8 @@ |
| * cpu_do_suspend - save CPU registers context |
| * |
| * x0: virtual address of context pointer |
| + * |
| + * This must be kept in sync with struct cpu_suspend_ctx in <asm/suspend.h>. |
| */ |
| ENTRY(cpu_do_suspend) |
| mrs x2, tpidr_el0 |
| @@ -73,6 +75,11 @@ alternative_endif |
| stp x8, x9, [x0, #48] |
| stp x10, x11, [x0, #64] |
| stp x12, x13, [x0, #80] |
| + /* |
| + * Save x18 as it may be used as a platform register, e.g. by shadow |
| + * call stack. |
| + */ |
| + str x18, [x0, #96] |
| ret |
| ENDPROC(cpu_do_suspend) |
| |
| @@ -89,6 +96,13 @@ ENTRY(cpu_do_resume) |
| ldp x9, x10, [x0, #48] |
| ldp x11, x12, [x0, #64] |
| ldp x13, x14, [x0, #80] |
| + /* |
| + * Restore x18, as it may be used as a platform register, and clear |
| + * the buffer to minimize the risk of exposure when used for shadow |
| + * call stack. |
| + */ |
| + ldr x18, [x0, #96] |
| + str xzr, [x0, #96] |
| msr tpidr_el0, x2 |
| msr tpidrro_el0, x3 |
| msr contextidr_el1, x4 |