Commit c8ed0812 authored by Peter Zijlstra's avatar Peter Zijlstra
Browse files

x86/hyperv: Use direct call to hypercall-page 



Instead of using an indirect call to the hypercall page, use a direct
call instead. This avoids all CFI problems, including the one where
the hypercall page doesn't have IBT on.

Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarMichael Kelley <mhklinux@outlook.com>
Acked-by: default avatarSean Christopherson <seanjc@google.com>
Link: https://lkml.kernel.org/r/20250714103441.011387946@infradead.org
parent 0e20f1f4

arch/x86/hyperv/hv_init.c

+30 −31
Original line number Diff line number Diff line
@@ -17,7 +17,6 @@ 
#include <asm/desc.h>

#include <asm/e820/api.h>

#include <asm/sev.h>

#include <asm/ibt.h>

#include <asm/hypervisor.h>

#include <hyperv/hvhdk.h>

#include <asm/mshyperv.h>
@@ -39,23 +38,41 @@ 
void *hv_hypercall_pg;



#ifdef CONFIG_X86_64

static u64 __hv_hyperfail(u64 control, u64 param1, u64 param2)

{

	return U64_MAX;

}



DEFINE_STATIC_CALL(__hv_hypercall, __hv_hyperfail);



u64 hv_std_hypercall(u64 control, u64 param1, u64 param2)

{

	u64 hv_status;



	if (!hv_hypercall_pg)

		return U64_MAX;



	register u64 __r8 asm("r8") = param2;

	asm volatile (CALL_NOSPEC

	asm volatile ("call " STATIC_CALL_TRAMP_STR(__hv_hypercall)

		      : "=a" (hv_status), ASM_CALL_CONSTRAINT,

		        "+c" (control), "+d" (param1), "+r" (__r8)

		      : THUNK_TARGET(hv_hypercall_pg)

		      : "cc", "memory", "r9", "r10", "r11");

		      : : "cc", "memory", "r9", "r10", "r11");



	return hv_status;

}



typedef u64 (*hv_hypercall_f)(u64 control, u64 param1, u64 param2);



static inline void hv_set_hypercall_pg(void *ptr)

{

	hv_hypercall_pg = ptr;



	if (!ptr)

		ptr = &__hv_hyperfail;

	static_call_update(__hv_hypercall, (hv_hypercall_f)ptr);

}

#else

static inline void hv_set_hypercall_pg(void *ptr)

{

	hv_hypercall_pg = ptr;

}

EXPORT_SYMBOL_GPL(hv_hypercall_pg);

#endif
@@ -350,7 +367,7 @@ static int hv_suspend(void) 
	 * pointer is restored on resume.

	 */

	hv_hypercall_pg_saved = hv_hypercall_pg;

	hv_hypercall_pg = NULL;

	hv_set_hypercall_pg(NULL);



	/* Disable the hypercall page in the hypervisor */

	rdmsrq(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
@@ -376,7 +393,7 @@ static void hv_resume(void) 
		vmalloc_to_pfn(hv_hypercall_pg_saved);

	wrmsrq(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);



	hv_hypercall_pg = hv_hypercall_pg_saved;

	hv_set_hypercall_pg(hv_hypercall_pg_saved);

	hv_hypercall_pg_saved = NULL;



	/*
@@ -496,8 +513,8 @@ void __init hyperv_init(void) 
	if (hv_isolation_type_tdx() && !ms_hyperv.paravisor_present)

		goto skip_hypercall_pg_init;



	hv_hypercall_pg = __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START,

			VMALLOC_END, GFP_KERNEL, PAGE_KERNEL_ROX,

	hv_hypercall_pg = __vmalloc_node_range(PAGE_SIZE, 1, MODULES_VADDR,

			MODULES_END, GFP_KERNEL, PAGE_KERNEL_ROX,

			VM_FLUSH_RESET_PERMS, NUMA_NO_NODE,

			__builtin_return_address(0));

	if (hv_hypercall_pg == NULL)
@@ -535,27 +552,9 @@ void __init hyperv_init(void) 
		wrmsrq(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);

	}



skip_hypercall_pg_init:

	/*

	 * Some versions of Hyper-V that provide IBT in guest VMs have a bug

	 * in that there's no ENDBR64 instruction at the entry to the

	 * hypercall page. Because hypercalls are invoked via an indirect call

	 * to the hypercall page, all hypercall attempts fail when IBT is

	 * enabled, and Linux panics. For such buggy versions, disable IBT.

	 *

	 * Fixed versions of Hyper-V always provide ENDBR64 on the hypercall

	 * page, so if future Linux kernel versions enable IBT for 32-bit

	 * builds, additional hypercall page hackery will be required here

	 * to provide an ENDBR32.

	 */

#ifdef CONFIG_X86_KERNEL_IBT

	if (cpu_feature_enabled(X86_FEATURE_IBT) &&

	    *(u32 *)hv_hypercall_pg != gen_endbr()) {

		setup_clear_cpu_cap(X86_FEATURE_IBT);

		pr_warn("Disabling IBT because of Hyper-V bug\n");

	}

#endif

	hv_set_hypercall_pg(hv_hypercall_pg);



skip_hypercall_pg_init:

	/*

	 * hyperv_init() is called before LAPIC is initialized: see

	 * apic_intr_mode_init() -> x86_platform.apic_post_init() and