Skip to content

Commit

Permalink
objtool,x86: Fix uaccess PUSHF/POPF validation
Browse files Browse the repository at this point in the history
Commit ab234a2 ("x86/pv: Rework arch_local_irq_restore() to not
use popf") replaced "push %reg; popf" with something like: "test
$0x200, %reg; jz 1f; sti; 1:", which breaks the pushf/popf symmetry
that commit ea24213 ("objtool: Add UACCESS validation") relies
on.

The result is:

  drivers/gpu/drm/amd/amdgpu/si.o: warning: objtool: si_common_hw_init()+0xf36: PUSHF stack exhausted

Meanwhile, commit c9c324d ("objtool: Support stack layout changes
in alternatives") makes that we can actually use stack-ops in
alternatives, which means we can revert 1ff865e ("x86,smap: Fix
smap_{save,restore}() alternatives").

That in turn means we can limit the PUSHF/POPF handling of
ea24213 to those instructions that are in alternatives.

Fixes: ab234a2 ("x86/pv: Rework arch_local_irq_restore() to not use popf")
Reported-by: Borislav Petkov <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Acked-by: Josh Poimboeuf <[email protected]>
Link: https://lkml.kernel.org/r/[email protected]
  • Loading branch information
Peter Zijlstra committed Mar 12, 2021
1 parent a38fd87 commit ba08abc
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 6 deletions.
10 changes: 4 additions & 6 deletions arch/x86/include/asm/smap.h
Original file line number Diff line number Diff line change
Expand Up @@ -58,9 +58,8 @@ static __always_inline unsigned long smap_save(void)
unsigned long flags;

asm volatile ("# smap_save\n\t"
ALTERNATIVE("jmp 1f", "", X86_FEATURE_SMAP)
"pushf; pop %0; " __ASM_CLAC "\n\t"
"1:"
ALTERNATIVE("", "pushf; pop %0; " __ASM_CLAC "\n\t",
X86_FEATURE_SMAP)
: "=rm" (flags) : : "memory", "cc");

return flags;
Expand All @@ -69,9 +68,8 @@ static __always_inline unsigned long smap_save(void)
static __always_inline void smap_restore(unsigned long flags)
{
asm volatile ("# smap_restore\n\t"
ALTERNATIVE("jmp 1f", "", X86_FEATURE_SMAP)
"push %0; popf\n\t"
"1:"
ALTERNATIVE("", "push %0; popf\n\t",
X86_FEATURE_SMAP)
: : "g" (flags) : "memory", "cc");
}

Expand Down
3 changes: 3 additions & 0 deletions tools/objtool/check.c
Original file line number Diff line number Diff line change
Expand Up @@ -2442,6 +2442,9 @@ static int handle_insn_ops(struct instruction *insn, struct insn_state *state)
if (update_cfi_state(insn, &state->cfi, op))
return 1;

if (!insn->alt_group)
continue;

if (op->dest.type == OP_DEST_PUSHF) {
if (!state->uaccess_stack) {
state->uaccess_stack = 1;
Expand Down

0 comments on commit ba08abc

Please sign in to comment.