From nobody Thu Sep 19 00:15:58 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1722008337; cv=none; d=zohomail.com; s=zohoarc; b=iB/HBcU+HQk3QxCT2b37yJJsIBHgXx1KsUMmNg10oyv3GopQf86/ByRtroOaJjBkm6/bnso3KpfOyjjJrq5SM2lHO0JZtt7diJHj+xKUvMjZtw5R0Q2GP+IiKi/q6UnvK/iCu6Vql1X1s9ZpuAfF8RluCcAWfWG8yCXx54XpbZ0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1722008337; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ujxzWIZCxxgOdDMzOO3f1hDHb8R0sblL5/6JViBiwPw=; b=oGM9emkFX6T4s+Tu4GxdTCC09smw7uJ3y9HyPrehtDztDDJ4MO/5qpwDKKkkEVTFRFLtuMr5NZlOg4Yz5zev9tcGguMz1TJwIjfaWA13xFZvpSZYj1I6FCxzN4RZqpNUS0e7frefIM5QZTvBDTXV9ID+aTJWvBmfFZ2ZjXu5X5Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1722008337860465.7101788841396; Fri, 26 Jul 2024 08:38:57 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.765593.1176266 (Exim 4.92) (envelope-from ) id 1sXN1f-0000Vt-Aq; Fri, 26 Jul 2024 15:38:35 +0000 Received: by outflank-mailman (output) from mailman id 765593.1176266; Fri, 26 Jul 2024 15:38:35 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1sXN1f-0000Vm-86; Fri, 26 Jul 2024 15:38:35 +0000 Received: by outflank-mailman (input) for mailman id 765593; Fri, 26 Jul 2024 15:38:34 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1sXMva-00084T-CI for xen-devel@lists.xenproject.org; Fri, 26 Jul 2024 15:32:18 +0000 Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [2607:f8b0:4864:20::82e]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 3ce06ce3-4b64-11ef-8776-851b0ebba9a2; Fri, 26 Jul 2024 17:32:16 +0200 (CEST) Received: by mail-qt1-x82e.google.com with SMTP id d75a77b69052e-44fe11dedb3so3920871cf.1 for ; Fri, 26 Jul 2024 08:32:16 -0700 (PDT) Received: from localhost ([213.195.124.163]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-44fe817b704sm14134541cf.49.2024.07.26.08.32.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jul 2024 08:32:14 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 3ce06ce3-4b64-11ef-8776-851b0ebba9a2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1722007935; x=1722612735; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ujxzWIZCxxgOdDMzOO3f1hDHb8R0sblL5/6JViBiwPw=; b=uFw+QpwwhbidcC77uubDdoH10eC9LJ8xXKwzJft22lAaUcosgJsLS7RCHZUjkpVGAS iHxdSEKLPSAVfDq255QRkfR+413yKhucswkHIcSknLgWYBGE4MmbR+de0Bt8hlzFGdiX ZzeB5uikKdL/4lSZILCpvqB1FENyTjSOctGUY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722007935; x=1722612735; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ujxzWIZCxxgOdDMzOO3f1hDHb8R0sblL5/6JViBiwPw=; b=h2KjDLnxAGZW+OlhgD9z0thvgimw98plLnZsK8n6WhBNykZpgFPE0yIgClpwHRXICn l628cNbawypjDA8dH4Pyx/Q0gWifQ2Pg+5R7tnpPn4MexWDR258kndkiajLvqiL8qnqY ciEqWudbTUJU3ciM2Jdd0CM/ni8HxsP29/tdrXUPqfV+wVWGfERqer4g6C+O3FLGkPt5 Grrwy7dZxWBDVdogq6mTW2zuXwU7tjqJTopHpR3TUnicOCGAR3UXF/O/BCv24Guxn5Uv OEmXsWMmomjZspvFX0kS6jgTc094fdkWYzEQQ/BRvJjtUbEAEnxqmCzDks1OcUTOWaZi HBiA== X-Gm-Message-State: AOJu0YyJ85eMMOJGVyTymBUXyuCB0NWg8/g4RTL+8PlHl0TuF6AIKWmI 7KVAGV9N8L+mGNfiSJFAQbiwZapPXzo0JX10Y0GsAPj7PqvmpcQrMdXE/UzPkXNjieVbstlAyyJ T X-Google-Smtp-Source: AGHT+IEN0Eq8CDQ5Cb603qPnp/JwUedIQCyO4aYdsNBLQFTLNZuf7mCOphfab1I5CFzTJfvm3Gvhew== X-Received: by 2002:a05:622a:1309:b0:447:df6b:b8c5 with SMTP id d75a77b69052e-45004db298amr1640751cf.33.1722007935174; Fri, 26 Jul 2024 08:32:15 -0700 (PDT) From: Roger Pau Monne To: xen-devel@lists.xenproject.org Cc: alejandro.vallejo@cloud.com, Roger Pau Monne , Jan Beulich , Andrew Cooper Subject: [PATCH 22/22] x86/mm: zero stack on stack switch or reset Date: Fri, 26 Jul 2024 17:22:06 +0200 Message-ID: <20240726152206.28411-23-roger.pau@citrix.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240726152206.28411-1-roger.pau@citrix.com> References: <20240726152206.28411-1-roger.pau@citrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) X-ZM-MESSAGEID: 1722008339254116600 With the stack mapped on a per-CPU basis there's no risk of other CPUs being able to read the stack contents, but vCPUs running on the current pCPU could read stack rubble from operations of previous vCPUs. The #DF stack is not zeroed because handling of #DF results in a panic. Signed-off-by: Roger Pau Monn=C3=A9 --- xen/arch/x86/include/asm/current.h | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/include/asm/current.h b/xen/arch/x86/include/asm/= current.h index 75b9a341f814..02b4118b03ef 100644 --- a/xen/arch/x86/include/asm/current.h +++ b/xen/arch/x86/include/asm/current.h @@ -177,6 +177,14 @@ unsigned long get_stack_dump_bottom (unsigned long sp); # define SHADOW_STACK_WORK "" #endif =20 +#define ZERO_STACK \ + "test %[stk_size], %[stk_size];" \ + "jz .L_skip_zeroing.%=3D;" \ + "std;" \ + "rep stosb;" \ + "cld;" \ + ".L_skip_zeroing.%=3D:" + #if __GNUC__ >=3D 9 # define ssaj_has_attr_noreturn(fn) __builtin_has_attribute(fn, __noreturn= __) #else @@ -187,10 +195,24 @@ unsigned long get_stack_dump_bottom (unsigned long sp= ); #define switch_stack_and_jump(fn, instr, constr) \ ({ \ unsigned int tmp; \ + bool zero_stack =3D current->domain->arch.asi; \ BUILD_BUG_ON(!ssaj_has_attr_noreturn(fn)); \ + ASSERT(IS_ALIGNED((unsigned long)guest_cpu_user_regs() - \ + PRIMARY_STACK_SIZE + \ + sizeof(struct cpu_info), PAGE_SIZE)); \ + if ( zero_stack ) \ + { \ + unsigned long stack_top =3D get_stack_bottom() & \ + ~(STACK_SIZE - 1); \ + \ + clear_page((void *)stack_top + IST_MCE * PAGE_SIZE); \ + clear_page((void *)stack_top + IST_NMI * PAGE_SIZE); \ + clear_page((void *)stack_top + IST_DB * PAGE_SIZE); \ + } \ __asm__ __volatile__ ( \ SHADOW_STACK_WORK \ "mov %[stk], %%rsp;" \ + ZERO_STACK \ CHECK_FOR_LIVEPATCH_WORK \ instr "[fun]" \ : [val] "=3D&r" (tmp), \ @@ -201,7 +223,13 @@ unsigned long get_stack_dump_bottom (unsigned long sp); ((PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8), \ [stack_mask] "i" (STACK_SIZE - 1), \ _ASM_BUGFRAME_INFO(BUGFRAME_bug, __LINE__, \ - __FILE__, NULL) \ + __FILE__, NULL), \ + /* For stack zeroing. */ \ + "D" ((void *)guest_cpu_user_regs() - 1), \ + [stk_size] "c" \ + (zero_stack ? PRIMARY_STACK_SIZE - sizeof(struct cpu_info)\ + : 0), \ + "a" (0) \ : "memory" ); \ unreachable(); \ }) --=20 2.45.2