From patchwork Tue Jun 13 00:11:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13277753 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D5F4C7EE2E for ; Tue, 13 Jun 2023 00:13:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E868E8E0027; Mon, 12 Jun 2023 20:12:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E0D798E0023; Mon, 12 Jun 2023 20:12:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B77208E0027; Mon, 12 Jun 2023 20:12:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 948008E0023 for ; Mon, 12 Jun 2023 20:12:45 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 6E6861A0385 for ; Tue, 13 Jun 2023 00:12:45 +0000 (UTC) X-FDA: 80895798690.03.CBF809E Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by imf08.hostedemail.com (Postfix) with ESMTP id 5C75416001F for ; Tue, 13 Jun 2023 00:12:43 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=IilS7xHE; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf08.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 134.134.136.65 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1686615163; a=rsa-sha256; cv=none; b=m1LsbP+8WGv1D9tTmMLWRmHfn7jkwmOa9klRubSq3GtwzjWear77MyCrhyNgD9k9HJnlkH 69I9Pa6OiOv8Yw431ABcPkKLNE3KdNHmUuniz3+T8TGaWe4xuNLGHM0yEJZlqYhfTZ781n 8Xiv/XkootMISJ+NRxg5IZQpnaxbEqg= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=IilS7xHE; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf08.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 134.134.136.65 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1686615163; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ggbaxEIISLmgT7I/30ANB4iH1d2bu4GVx9rE6ZdVsLQ=; b=Lhyp2aydDvqXJlFeeezNJEfyJheqylO4KmBDbbriRSVnda78bWCkpMqklAIEsaeWEvlJ/G P22TnPVRFoieO9Fff1TwWbvlzjnqEA4pFS+ixR8GFAw83Wiwv0EKf96HGh3HThZpQv6t+T JzyC1/Nw89BhplpzL1Bzi+uBg7YTmPI= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1686615163; x=1718151163; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Umo485lkaXi+aij5vBJ9ejxN8cdryMJacLabCk9dyEI=; b=IilS7xHEjltuwXw5JsVVZ8tmX8m40aOvTJAOsF5FRHNLAdIFUjq3GcV4 eLqwY21FkcZIXIpC1iI7LTIrxkG4XYuoD4X2hjtcuICOo6mz5DeS5R5XN cZG8rqDcX1+gUXJTH9VC3idr0ovPxlnrzAKeI+2F0LBm61lthYxPMSLWa tZgzKIxuHUJElDxIDlF2OAa33dyrz696BB8jOCzJnMzjPT3q16OvKrYAv sdAVMYOHxnuVmAxgPAp5ZkZbONjTdf15bOB5oSm6Iuctz27CiLqN9ss0+ uz5/jQcuComrHrhzcOsiE/riBp80rNeYljIkDIP5ojU2NPqGB+I+dXfGk A==; X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="361557575" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="361557575" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:41 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="835671162" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="835671162" Received: from almeisch-mobl1.amr.corp.intel.com (HELO rpedgeco-desk4.amr.corp.intel.com) ([10.209.42.242]) by orsmga004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:40 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com, szabolcs.nagy@arm.com, torvalds@linux-foundation.org, broonie@kernel.org Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu , Pengfei Xu Subject: [PATCH v9 38/42] x86/cpufeatures: Enable CET CR4 bit for shadow stack Date: Mon, 12 Jun 2023 17:11:04 -0700 Message-Id: <20230613001108.3040476-39-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> References: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 5C75416001F X-Stat-Signature: zqgrgq8z89j1hbxorq99g1rm4zgujcfs X-HE-Tag: 1686615163-258029 X-HE-Meta: U2FsdGVkX18MKf1XKg/DLl587E28v5jzjqPYCLprFtMT7GMc3j6biPu1YPYOU2vD5qIO/g1F7v4dPIT7dG/0bIyVmLm83pM2ai8xBb8pR8/TXk3TDsk95gye/CBnJG+zZD452GBTfPqOlBSgho1+FCr2vBnOlNZELD0u8Hh9W2q5QO/2SnxTiUmE/AwFjpY7DJQX91/UmwocS5uJGtzfFn9lae/Xx1dvvLFagiVYWAtBDtaHSELQEKoxErNMlIdmn7swLQ4TRgqt6j4BiS1vvxk4Zi1Eiv6zoYdatF239l23enmAhvI4rcDNhRL0KI2BT0qisa5R/UdBj9UaPHke07lUPbdxwAeBadPi+xciNbMLg1A0kwtTZ1iNLQMrLWjUOcm07pCO7flytN7JscsnapoaH+llKNc9SP9XuzBlR5q3Ow5z3a47UFWKz3oa5CZlQ6So+2B8QveHcJpmv5k51Ya62iZdg3dVa0gXnmZRGs6Yhtj+oqy0Yn6q6VycoTHxcCfW4u89QwDjW5c3yUYT0RKYawF0jlH308982BCtzKrZyo66wUZqpX2sHEtwdIVv0v0qY2SJvJLjXojSvkysNFSlK3uSnqA9C07WVn2dW1XYfQrN7Ai72K9PM89/mOk4XnG86k5v/wXncYVkEqzBrvndeT7J6vSKV97/muWJIVUq1rNMXdLR/7vLPHQ4sw2YwDWxtN32pEWHzuqSIQssPKgrsJDQq/WG4SNIEuYGjvJTacxda7ihbNkwRmooi3i7yL3Hm+J3E5Y1KKAoA9F8e33CW8S/wWp0lCks/xjadS5jlMJtUfEowLAcBJKsTgKBJ1CT0AxTDF2+vb++vcmPmjmaTitZB5LjNyiT3ThT95IrL3jf16e/CvFnTnl6aN+ZBwU+wjf7D8T7Z32PL2Bw0xDw3lyhg1bUiMixw+ufmi56TGMwwbCXJtLduYhX//xP+LhaM+Yg1IpJwoPyG+Q xPRacY6U YV3cMljkZGPOuOHucwusFQ04A2Sx//gV7Zi8DdQnAUMSUfs33AK4LKzkYdVnV1LwT9105KEpyWruBsNIzEeOFfmq5FXgV1j0BdoBGrGuU9vvFvpuMthwxY9ckHuPfQGT5a/aEipCyyJrK6oQlg1aXabzrCr2GUI+z9lZBG3X5GKEIqO16SKaRNPaj3PAhQYGNeF2rslYU2BVu8FAYhueGJKZzlybVEjQN+z2+C2BXwHJZkszIh7X0xaV1D5Iyb/6okh/fv/WD+F8DmRCyuIIJluWxhR6Toat3UxDWXWWbXrj9ujTL5N6BB+g1qDiU7gRwSU/6AKZav+grRjz874+8LiDRw14FqYj4eZm50rvmxhYwHR5KFdXx8nTa3A== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Setting CR4.CET is a prerequisite for utilizing any CET features, most of which also require setting MSRs. Kernel IBT already enables the CET CR4 bit when it detects IBT HW support and is configured with kernel IBT. However, future patches that enable userspace shadow stack support will need the bit set as well. So change the logic to enable it in either case. Clear MSR_IA32_U_CET in cet_disable() so that it can't live to see userspace in a new kexec-ed kernel that has CR4.CET set from kernel IBT. Co-developed-by: Yu-cheng Yu Signed-off-by: Yu-cheng Yu Signed-off-by: Rick Edgecombe Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Kees Cook Acked-by: Mike Rapoport (IBM) Tested-by: Pengfei Xu Tested-by: John Allen Tested-by: Kees Cook --- arch/x86/kernel/cpu/common.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 80710a68ef7d..3ea06b0b4570 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -601,27 +601,43 @@ __noendbr void ibt_restore(u64 save) static __always_inline void setup_cet(struct cpuinfo_x86 *c) { - u64 msr = CET_ENDBR_EN; + bool user_shstk, kernel_ibt; - if (!HAS_KERNEL_IBT || - !cpu_feature_enabled(X86_FEATURE_IBT)) + if (!IS_ENABLED(CONFIG_X86_CET)) return; - wrmsrl(MSR_IA32_S_CET, msr); + kernel_ibt = HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT); + user_shstk = cpu_feature_enabled(X86_FEATURE_SHSTK) && + IS_ENABLED(CONFIG_X86_USER_SHADOW_STACK); + + if (!kernel_ibt && !user_shstk) + return; + + if (user_shstk) + set_cpu_cap(c, X86_FEATURE_USER_SHSTK); + + if (kernel_ibt) + wrmsrl(MSR_IA32_S_CET, CET_ENDBR_EN); + else + wrmsrl(MSR_IA32_S_CET, 0); + cr4_set_bits(X86_CR4_CET); - if (!ibt_selftest()) { + if (kernel_ibt && !ibt_selftest()) { pr_err("IBT selftest: Failed!\n"); wrmsrl(MSR_IA32_S_CET, 0); setup_clear_cpu_cap(X86_FEATURE_IBT); - return; } } __noendbr void cet_disable(void) { - if (cpu_feature_enabled(X86_FEATURE_IBT)) - wrmsrl(MSR_IA32_S_CET, 0); + if (!(cpu_feature_enabled(X86_FEATURE_IBT) || + cpu_feature_enabled(X86_FEATURE_SHSTK))) + return; + + wrmsrl(MSR_IA32_S_CET, 0); + wrmsrl(MSR_IA32_U_CET, 0); } /* @@ -1483,6 +1499,9 @@ static void __init cpu_parse_early_param(void) if (cmdline_find_option_bool(boot_command_line, "noxsaves")) setup_clear_cpu_cap(X86_FEATURE_XSAVES); + if (cmdline_find_option_bool(boot_command_line, "nousershstk")) + setup_clear_cpu_cap(X86_FEATURE_USER_SHSTK); + arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg)); if (arglen <= 0) return;