diff options
| author | Sami Tolvanen <samitolvanen@google.com> | 2020-04-27 09:00:13 -0700 |
|---|---|---|
| committer | Will Deacon <will@kernel.org> | 2020-05-15 16:35:50 +0100 |
| commit | e73f02c6eb15729164b9dd5e19214b54446823ab (patch) | |
| tree | f232209ca98fd126e697706422af3d044a7ce24e | |
| parent | 6d37d81f449a103a8b43c5c972b5055b8936ef0e (diff) | |
| download | linux-e73f02c6eb15729164b9dd5e19214b54446823ab.tar.gz | |
arm64: efi: Restore register x18 if it was corrupted
If we detect a corrupted x18, restore the register before jumping back
to potentially SCS instrumented code. This is safe, because the wrapper
is called with preemption disabled and a separate shadow stack is used
for interrupt handling.
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
| -rw-r--r-- | arch/arm64/kernel/efi-rt-wrapper.S | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/arch/arm64/kernel/efi-rt-wrapper.S b/arch/arm64/kernel/efi-rt-wrapper.S index 3fc71106cb2b..6ca6c0dc11a1 100644 --- a/arch/arm64/kernel/efi-rt-wrapper.S +++ b/arch/arm64/kernel/efi-rt-wrapper.S @@ -34,5 +34,14 @@ ENTRY(__efi_rt_asm_wrapper) ldp x29, x30, [sp], #32 b.ne 0f ret -0: b efi_handle_corrupted_x18 // tail call +0: + /* + * With CONFIG_SHADOW_CALL_STACK, the kernel uses x18 to store a + * shadow stack pointer, which we need to restore before returning to + * potentially instrumented code. This is safe because the wrapper is + * called with preemption disabled and a separate shadow stack is used + * for interrupts. + */ + mov x18, x2 + b efi_handle_corrupted_x18 // tail call ENDPROC(__efi_rt_asm_wrapper) |