From patchwork Mon Feb 27 22:29:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13154235 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7D0EC64ED8 for ; Mon, 27 Feb 2023 22:31:37 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 70E896B007B; Mon, 27 Feb 2023 17:31:34 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 6E5816B007D; Mon, 27 Feb 2023 17:31:34 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 55CDD6B007E; Mon, 27 Feb 2023 17:31:34 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 460B46B007B for ; Mon, 27 Feb 2023 17:31:34 -0500 (EST) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 2239A140928 for ; Mon, 27 Feb 2023 22:31:34 +0000 (UTC) X-FDA: 80514519708.29.3314B35 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by imf13.hostedemail.com (Postfix) with ESMTP id 1BDAE20009 for ; Mon, 27 Feb 2023 22:31:31 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b="bp4/wOhm"; spf=pass (imf13.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.136 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1677537092; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:dkim-signature; bh=IwpMesFlHIDR54EkEjKtDtUDsVUQ1W/vfrUDOH5zIbg=; b=SPJUr4AsHt/YhNxMXweJd32aFkqQH7BSf9Y9OqoU66seO3BtzY14xrFwaRD9hi/liTVZg0 VhPokIsJrYWGDmc4R8p5UWaOAaGC+DBsAGkYu6GH/WxHDDYkkH4Z2SeknEKnmmxTbs2kCg Zlh7b+zY502C/oOuKCLjAU7tX8k8UEo= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b="bp4/wOhm"; spf=pass (imf13.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.136 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1677537092; a=rsa-sha256; cv=none; b=JgL1Py+3vpuNCWvH8zVrVZmVj7Azy73ByBNPdyPawh5AfI12VbKsmH76jZix/l8+NLiXSZ pFDBRwVBS0zfzWLqanxa+pABVDMhN6f0xMO5LuK57DO6BJFKM0AO4rvxIpzlktMpfSwwlr IDcyxc0JvcnwzK4kr6fRJWRpDCDB56w= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1677537092; x=1709073092; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=Bg+qgKp1F47Y8UIietH1jC4hvVo4rClMm1kv9uYsMSQ=; b=bp4/wOhm2V6fL0qXlaX+94pWqzoaB5zUU7e3HTpJP1zmE1I7qvNDUmaP p+E9tzoCO+0GecbbhJgjJ7pYUz6YIYTeP97u4OJiaONSVfreVxUpvoht4 bWWsm8n7xApU9c7e5hVa0Alcf0m+xZx/4qVyuEDAVUlA8zyMV+STb+WpF nBkYWJiRplNh4o4jvV1u+L27ngb2w2quICp93TyB6eFuS/wpQktTkH+y+ qF85U61PvzoiwEtRrGBKeR7PTag1Cqn4TYUDyt/ZLm9wxvR4dutfkQAqJ 1PClZ63pDzJ5VWje4opXTBwpP6Ns7pViRxuutKLwnLPi7UXXeqpk8/WFn w==; X-IronPort-AV: E=McAfee;i="6500,9779,10634"; a="313657074" X-IronPort-AV: E=Sophos;i="5.98,220,1673942400"; d="scan'208";a="313657074" Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Feb 2023 14:31:10 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10634"; a="848024368" X-IronPort-AV: E=Sophos;i="5.98,220,1673942400"; d="scan'208";a="848024368" Received: from leonqu-mobl1.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.209.72.19]) by orsmga005-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Feb 2023 14:31:09 -0800 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu Subject: [PATCH v7 04/41] x86/cpufeatures: Enable CET CR4 bit for shadow stack Date: Mon, 27 Feb 2023 14:29:20 -0800 Message-Id: <20230227222957.24501-5-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230227222957.24501-1-rick.p.edgecombe@intel.com> References: <20230227222957.24501-1-rick.p.edgecombe@intel.com> X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 1BDAE20009 X-Stat-Signature: ndub5akk855gieskiqrtd8ip8pztoknd X-Rspam-User: X-HE-Tag: 1677537091-715931 X-HE-Meta: U2FsdGVkX19j10Pw3ZU23jVyqGlxe1qRuVNZKfCJj9NZoQcvkcMXH3bQoTFxO1Cduo2/a25RIjdBK+xB6OZWBRX18fBetybG8VdO9XxAgD/okOzZU/lEAyQ6yel7X9PFhSU+Wf/Nn9DRYznCfHpaoiBbXanc6FK96pxE8I1gSufDB+FkOJkFQ/OrGB2nMjaG7tkl7hfvgspdlnXr2xcmPGOLQ93/GOQRZ2sVrVMWRbY+r3TCWzWiTQsPc2rPHdFhV2xjhlHS2McL1fGH3CJCiB5fpMcfMOjfHchmuRzDF7mUksMzZNazN8TPNJA72yTiZ4z3HbRjATnMg4amfoinQRFkgsQY2aFEha28pZxKQmcr2S3+K/+VGdzmWgjEI3xlwY+wbhnZaSI/zVCoCzeJhvsEg9MlNI/oiCWoFwTt2huulV9oIin26141GFrqB/ioJYZiP0UdxoYXzYaJvEIfGr7W3q3uFuc9MbZVftNnJT/I6x559Pcvd6LktNoQkpCrABzwhLaPhuvt3erBXHQXZZ8Z8fk7BOUeHhmzTkQ+LGWEy80IMq8byAdJentjLW3eoLu+BmGwwfP5nzwUZHB7Gvs1F9b5a0l6cq8lJGnrAmH5M8i58mtthgI/UBHE8jmVegXR82AurWEjkLV7D2PJsZVYidkzuB/GumslKuvkX2lAB7YWRcIIrnRwYnsYWg0qJRp7oCW8H8aN5xkLXf2u4+uq4t4AHcjhng0rGpBsUpM8PmigJDwy+/8YD+SSmX3xVKFCuKRLHn32ssgLUwJ2fOBYVm2o7/2HqZzf3A1gz3k4m3xmeXRrYFMwyFTRCMCCD7Mi0SfhowImDyPtxVwAQayrqC7BF3lyN91zVF3UGeqUEOhln94v2bNzpNXYfCqSlX4aU1SpoNqLAvMfBI/kbYGWJNIXgL4e0NNzRwHGplshUDKO2nKespjQqvSNR+Uu6NN5tsWZdxXqd+ux34U MJ+Qn+yO EJE1qUsvbgix6O6C3Vmsoq5ZslqwOXEb5WFW3zlDa2JRBUg2uVI7ZD4EErS/xg7YslpSf2LtLirISzhnymr2U+V8nyQMZgB4kJ8aglpIeA6YaecVGDzxClHOjE2AuDPvhtDQ4n30mqq6zbVwgaioHESMZ5MP71U0moyTsYo8NoZUK0DihTsysV0ftaeeV1+5WvBdt/+P6NLlbBr3xQma3U1fn3Ea3sh/If193qD4Tg2M5sX+40aaOJCQlhHzyufp/Jg4IDmeQXC8MV/D/0GEZsLx+PC5AQwbHQZ+NSp7VsSWn/pHMVubDpNnD+AhhcmH00X9GhQl5QuqlfAQASg1w+KQKyyoM0lkk9urD X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Yu-cheng Yu Setting CR4.CET is a prerequisite for utilizing any CET features, most of which also require setting MSRs. Kernel IBT already enables the CET CR4 bit when it detects IBT HW support and is configured with kernel IBT. However, future patches that enable userspace shadow stack support will need the bit set as well. So change the logic to enable it in either case. Clear MSR_IA32_U_CET in cet_disable() so that it can't live to see userspace in a new kexec-ed kernel that has CR4.CET set from kernel IBT. Tested-by: Pengfei Xu Tested-by: John Allen Tested-by: Kees Cook Acked-by: Mike Rapoport (IBM) Reviewed-by: Kees Cook Signed-off-by: Yu-cheng Yu Co-developed-by: Rick Edgecombe Signed-off-by: Rick Edgecombe Cc: Kees Cook --- v5: - Remove #ifdeffery (Boris) v4: - Add back dedicated command line disable: "nousershstk" (Boris) v3: - Remove stay new line (Boris) - Simplify commit log (Andrew Cooper) v2: - In the shadow stack case, go back to only setting CR4.CET if the kernel is compiled with user shadow stack support. - Clear MSR_IA32_U_CET as well. (PeterZ) --- arch/x86/kernel/cpu/common.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 8cd4126d8253..cc686e5039be 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -600,27 +600,43 @@ __noendbr void ibt_restore(u64 save) static __always_inline void setup_cet(struct cpuinfo_x86 *c) { - u64 msr = CET_ENDBR_EN; + bool user_shstk, kernel_ibt; - if (!HAS_KERNEL_IBT || - !cpu_feature_enabled(X86_FEATURE_IBT)) + if (!IS_ENABLED(CONFIG_X86_CET)) return; - wrmsrl(MSR_IA32_S_CET, msr); + kernel_ibt = HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT); + user_shstk = cpu_feature_enabled(X86_FEATURE_SHSTK) && + IS_ENABLED(CONFIG_X86_USER_SHADOW_STACK); + + if (!kernel_ibt && !user_shstk) + return; + + if (user_shstk) + set_cpu_cap(c, X86_FEATURE_USER_SHSTK); + + if (kernel_ibt) + wrmsrl(MSR_IA32_S_CET, CET_ENDBR_EN); + else + wrmsrl(MSR_IA32_S_CET, 0); + cr4_set_bits(X86_CR4_CET); - if (!ibt_selftest()) { + if (kernel_ibt && !ibt_selftest()) { pr_err("IBT selftest: Failed!\n"); wrmsrl(MSR_IA32_S_CET, 0); setup_clear_cpu_cap(X86_FEATURE_IBT); - return; } } __noendbr void cet_disable(void) { - if (cpu_feature_enabled(X86_FEATURE_IBT)) - wrmsrl(MSR_IA32_S_CET, 0); + if (!(cpu_feature_enabled(X86_FEATURE_IBT) || + cpu_feature_enabled(X86_FEATURE_SHSTK))) + return; + + wrmsrl(MSR_IA32_S_CET, 0); + wrmsrl(MSR_IA32_U_CET, 0); } /* @@ -1482,6 +1498,9 @@ static void __init cpu_parse_early_param(void) if (cmdline_find_option_bool(boot_command_line, "noxsaves")) setup_clear_cpu_cap(X86_FEATURE_XSAVES); + if (cmdline_find_option_bool(boot_command_line, "nousershstk")) + setup_clear_cpu_cap(X86_FEATURE_USER_SHSTK); + arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg)); if (arglen <= 0) return;