[PATCH 3/3] xen/x86: Use non-canonical pointers for ERR_PTR() errors

[Andrew Cooper <andrew.cooper3@citrix.com>]

The top of the virutal address space is owned by 64bit PV kernels.  Code which
fails to correctly check an ERR_PTR() value might follow the pointer into
guest space.

Mitigate this risk by sliding the ERR_PTR() error range into the non-canonical
region.

As this comes with a small overhead, and isn't necessary if 64bit PV guests
aren't used, provide a Kconfig opt-out for power users.

As an example, ERR_PTR(-EINVAL) has the value 0xbad0eee0ffffffea.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>

Ideally, the constant would read "bad err", but r's are hard in hex.
Alternative constant suggestions welcome.
---
 xen/arch/x86/Kconfig         | 18 ++++++++++++++++++
 xen/include/asm-x86/config.h |  8 ++++++++
 2 files changed, 26 insertions(+)

diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 96ca2bf..9aa9d3f 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -89,6 +89,24 @@ config TBOOT
 	  Technology (TXT)
 
 	  If unsure, say Y.
+
+config UNSAFE_ERRPTR
+       def_bool n
+       prompt "Unsafe ERR_PTR() constants" if EXPERT = "y"
+       ---help---
+         The ERR_PTR() infrastructure by default uses the top of virtual
+         address space for error information, but with 64bit PV guests, this
+         range belongs to the guest kernel.
+
+         Xen by default slides the error range elsewhere in virtual address
+         space, but this comes at the expense of a few extra instructions of
+         calculations.
+
+         If that overhead is too much, this option is safe to enable if no
+         64bit PV guests are in use, or all 64bit PV guests are fully trusted.
+
+         If unsure, say N.
+
 endmenu
 
 source "common/Kconfig"
diff --git a/xen/include/asm-x86/config.h b/xen/include/asm-x86/config.h
index 6fd84e7..2997ee3 100644
--- a/xen/include/asm-x86/config.h
+++ b/xen/include/asm-x86/config.h
@@ -87,6 +87,14 @@
 #define LIST_POISON1  ((void *)0x0100100100100100UL)
 #define LIST_POISON2  ((void *)0x0200200200200200UL)
 
+#if !defined(NDEBUG) || !defined(CONFIG_UNSAFE_ERRPTR)
+/*
+ * Always use safe pointers in debug builds.  Use safe pointers in release
+ * builds unless the user explicitly opts out.
+ */
+#define ARCH_ERR_PTR_SLIDE (-(unsigned long)0xbad0eee100000000ull)
+#endif
+
 #ifndef __ASSEMBLY__
 extern unsigned long trampoline_phys;
 #define bootsym_phys(sym)                                 \
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel