From patchwork Sat Feb 18 21:13:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13145642 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0617C64ED8 for ; Sat, 18 Feb 2023 21:16:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 54A15280001; Sat, 18 Feb 2023 16:16:06 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 4F8306B0078; Sat, 18 Feb 2023 16:16:06 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3A2F5280001; Sat, 18 Feb 2023 16:16:06 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 2D32A6B0075 for ; Sat, 18 Feb 2023 16:16:06 -0500 (EST) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id A3E03AAD71 for ; Sat, 18 Feb 2023 21:16:05 +0000 (UTC) X-FDA: 80481670290.28.940AEB2 Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by imf16.hostedemail.com (Postfix) with ESMTP id 7BB5318000B for ; Sat, 18 Feb 2023 21:16:03 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=lcK4Gt4K; spf=pass (imf16.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.43 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1676754964; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:dkim-signature; bh=rj6t87CMrj6ldVU2qcRajQjKqhDovVUzliCKYD1NMbk=; b=avkN3NshRD8vaCBvp2b3zUdF29P+1cELwgmnlExeoptaHRKQH7mXwx2dNdH5dNuKrBCXFq SD8Uh1C+em2MAvxmfd0aMBOE5t+slH2d1P+jg7zLwNartCdcdf4k0szBuhSQUxnj46zXrh 5VAj901G6EfCcOKlrIBea2sXGPQADWc= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=lcK4Gt4K; spf=pass (imf16.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.43 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1676754964; a=rsa-sha256; cv=none; b=RpxRs/hYJlVH4cGIgl1wHogNokQaKOjwcEAopjwfjK8ytC3kKzuIX1Y1jD8UdCaev7jfkD 15VbUNTAy8ZUtynVqPWSRgML2o4q5BNDRdO11bSrcVuxS0AHK/grmz5MncbcWcJdk5cGwX f4Pv0ERxfGIxK9Tl0cnf+d/KFS0RuzI= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1676754963; x=1708290963; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=P0vRMRHavNRGpizZkq3RL8rMxSsVzWcbrEXvoEvUKSg=; b=lcK4Gt4KNR75XiiKK4mv0TwvsKnQXH8l9gUk/uRARYHw2F4/hoKgPnUl zIfDDgOXyYpconISNDd5Pt8vmLrBdGD9LuNot5ULCzjkUB92wDLDDWpzz cimRvcJ9hJYFgB2wkEoX7lXdBr3jxErNTvQrl9UXozSCWDdUqPfNp4MWt 6k2VCt2dk3Ii2IlOMGiemgJic9I234/og+TWBcZnS4FWlDzKCLvn10MtU JhHgQCK02Rf6sppgHuAAnnkzAoSPH8n7QWplIv0J+3l6ZD8/DG2E95Sre GXPDKy+aAIDHfRsehlsIqRdfjFbwFEQJ83UoRPjH+bN8EuaIQTgUzq5rX Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10625"; a="418427167" X-IronPort-AV: E=Sophos;i="5.97,309,1669104000"; d="scan'208";a="418427167" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Feb 2023 13:16:00 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10625"; a="664241585" X-IronPort-AV: E=Sophos;i="5.97,309,1669104000"; d="scan'208";a="664241585" Received: from adityava-mobl1.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.209.80.223]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Feb 2023 13:15:59 -0800 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu Subject: [PATCH v6 04/41] x86/cpufeatures: Enable CET CR4 bit for shadow stack Date: Sat, 18 Feb 2023 13:13:56 -0800 Message-Id: <20230218211433.26859-5-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230218211433.26859-1-rick.p.edgecombe@intel.com> References: <20230218211433.26859-1-rick.p.edgecombe@intel.com> X-Rspamd-Queue-Id: 7BB5318000B X-Stat-Signature: qyhsbqotd1eefoh4emky461toea4h1md X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1676754963-7609 X-HE-Meta: U2FsdGVkX183V+zqw59Nq3fdpuloXmHTZbWRARtVLpKrqrgyYGCqmgK7uZxEdb11qASjlEmsjHK3LMs3TPzapv36zRWHU5FhZU7gzi9weKqLOaROOGigoYB8l+4OF6aMA3CFIGidj14ouSFpcs6CBLAD+cBg6xxJ4qAHMwYqDKs73dL6NuPoH8iTTEcO5A2KicpwKsV8HPv3TxEweTJzTNZFn6/P3hPEp2qfSyMSx9hkUug2+UfJ9GexjKtUbTpR3DLcIwLXkCKb5tEZN0m/TPRPeGgkZ3RRYsI3a8fQeZQb9bq85VUiF53kxRIdD3VElM1F+w5r1ikfthiurrsURicuLhsJZtJVnZhQ3KCNBhwMFsnXZ++kaHRT/gvmr1wmmWD/OtMsCRWzsE2ihpNMDvMopQWpxx1BEu4fJdMNN4tL21VljrHXPOX4lT7AtClQ0jpqTeVnM+CW813cR225/VLpvuFYEd3OmG8dvinZpK/nmPpqsnf6pqud1wUROeDxEjSTm5oIpVrLMY5MXqLQTda2ZNz+jX3c5GEnwromKxT0MPB9HnWiHTCp/xUiA/dL76NIOYPysg0PuHOA+bQm3vNUd8MyMoWP8p14VhGeAOjAQVOSki5jra84lsrFllxn+jS9vOBeHsFzHkAo327V9sL5ii0YIyzeNpzr1htLQI3FEtVGIePiFSGNNs4YseTYhNDJEzUlXXpw3ezNyy56LDAt3kcBAYxQXaKxAZSdZvnFfphZU1CNCwhs4ka7qj1K9UG0s5hdiIrwnzX5POmqXKprRq8waTUpsBJGK30dohIzvZpZOupGFgktxuz9i2bxsjc9u+kbkixzHD18r+9I48m+C4r8C9iP/doRMAP8feteSPYL7b0a+sLU1nDXOzhJkZrAPsraymcCtEuEIHvDLnNy67iXbk7JYKCq1EX3oHm1f6kvSu7TEZmrp039oHwIwj5zGwpNTAeMAysQevW 8VgdGia0 Uxx21EE7KKIXjuBZ7vKNOxmLLJmlODAUhj5TDkEIzHuHXoTyrPlo25fQCM3iiSVIHzLj54DHNhi4XS/QM0O56YjbSc10x/BgSZ8VarSy3cgWXK948XB/4cPZXy0+l/GOkU/VbpCHiGk6DULt4vCBbh+t5mmnbJoT1slfr6VORzp4xDKfGX0wp3/jr7/tyvfY93YVhAFkMQA33GDNvkm5RMGxTZis4FtcmcLSOS9WNH2/sHNd0epJGpPByWsIOKM2DdG+80x4nrqeN193VWDJo1PanIlEeP8GzdRul X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Yu-cheng Yu Setting CR4.CET is a prerequisite for utilizing any CET features, most of which also require setting MSRs. Kernel IBT already enables the CET CR4 bit when it detects IBT HW support and is configured with kernel IBT. However, future patches that enable userspace shadow stack support will need the bit set as well. So change the logic to enable it in either case. Clear MSR_IA32_U_CET in cet_disable() so that it can't live to see userspace in a new kexec-ed kernel that has CR4.CET set from kernel IBT. Tested-by: Pengfei Xu Tested-by: John Allen Reviewed-by: Kees Cook Signed-off-by: Yu-cheng Yu Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Cc: Kees Cook --- v5: - Remove #ifdeffery (Boris) v4: - Add back dedicated command line disable: "nousershstk" (Boris) v3: - Remove stay new line (Boris) - Simplify commit log (Andrew Cooper) v2: - In the shadow stack case, go back to only setting CR4.CET if the kernel is compiled with user shadow stack support. - Clear MSR_IA32_U_CET as well. (PeterZ) --- arch/x86/kernel/cpu/common.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 38646f1b5f14..30c524cd8cad 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -599,27 +599,43 @@ __noendbr void ibt_restore(u64 save) static __always_inline void setup_cet(struct cpuinfo_x86 *c) { - u64 msr = CET_ENDBR_EN; + bool user_shstk, kernel_ibt; - if (!HAS_KERNEL_IBT || - !cpu_feature_enabled(X86_FEATURE_IBT)) + if (!IS_ENABLED(CONFIG_X86_CET)) return; - wrmsrl(MSR_IA32_S_CET, msr); + kernel_ibt = HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT); + user_shstk = cpu_feature_enabled(X86_FEATURE_SHSTK) && + IS_ENABLED(CONFIG_X86_USER_SHADOW_STACK); + + if (!kernel_ibt && !user_shstk) + return; + + if (user_shstk) + set_cpu_cap(c, X86_FEATURE_USER_SHSTK); + + if (kernel_ibt) + wrmsrl(MSR_IA32_S_CET, CET_ENDBR_EN); + else + wrmsrl(MSR_IA32_S_CET, 0); + cr4_set_bits(X86_CR4_CET); - if (!ibt_selftest()) { + if (kernel_ibt && !ibt_selftest()) { pr_err("IBT selftest: Failed!\n"); wrmsrl(MSR_IA32_S_CET, 0); setup_clear_cpu_cap(X86_FEATURE_IBT); - return; } } __noendbr void cet_disable(void) { - if (cpu_feature_enabled(X86_FEATURE_IBT)) - wrmsrl(MSR_IA32_S_CET, 0); + if (!(cpu_feature_enabled(X86_FEATURE_IBT) || + cpu_feature_enabled(X86_FEATURE_SHSTK))) + return; + + wrmsrl(MSR_IA32_S_CET, 0); + wrmsrl(MSR_IA32_U_CET, 0); } /* @@ -1476,6 +1492,9 @@ static void __init cpu_parse_early_param(void) if (cmdline_find_option_bool(boot_command_line, "noxsaves")) setup_clear_cpu_cap(X86_FEATURE_XSAVES); + if (cmdline_find_option_bool(boot_command_line, "nousershstk")) + setup_clear_cpu_cap(X86_FEATURE_USER_SHSTK); + arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg)); if (arglen <= 0) return;