From: Andi Kleen <andi@firstfloor.org>
To: Kees Cook <keescook@chromium.org>
Cc: Andi Kleen <andi@firstfloor.org>,
Peter Zijlstra <peterz@infradead.org>,
Greg KH <gregkh@linuxfoundation.org>,
x86@kernel.org, linux-kernel@vger.kernel.org, sashal@kernel.org,
Andi Kleen <ak@linux.intel.com>,
stable@vger.kernel.org
Subject: Re: [PATCH v1] x86: Pin cr4 FSGSBASE
Date: Tue, 26 May 2020 16:14:25 -0700 [thread overview]
Message-ID: <20200526231423.qcsolcpll534sgro@two.firstfloor.org> (raw)
In-Reply-To: <202005260935.EB11D3EB7@keescook>
> And if this is going to be more permanent, we can separate the mask
> (untested):
The FSGSBASE one should not be permanent, it will be replaced
with the full FSGSBASE patches that set that bit correctly.
I was a bit wary of enforcing it for all bits, there might be other
CR4 bits which have benign uses. But I guess the risk of breaking
something there is low.
-Andi
>
>
> diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
> index bed0cb83fe24..ead64f7420a5 100644
> --- a/arch/x86/kernel/cpu/common.c
> +++ b/arch/x86/kernel/cpu/common.c
> @@ -347,6 +347,8 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c)
> cr4_clear_bits(X86_CR4_UMIP);
> }
>
> +static const unsigned long cr4_pinned_mask =
> + X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP | X86_CR4_FSGSBASE;
> static DEFINE_STATIC_KEY_FALSE_RO(cr_pinning);
> static unsigned long cr4_pinned_bits __ro_after_init;
>
> @@ -371,20 +373,20 @@ EXPORT_SYMBOL(native_write_cr0);
>
> void native_write_cr4(unsigned long val)
> {
> - unsigned long bits_missing = 0;
> + unsigned long bits_changed = 0;
>
> set_register:
> asm volatile("mov %0,%%cr4": "+r" (val), "+m" (cr4_pinned_bits));
>
> if (static_branch_likely(&cr_pinning)) {
> - if (unlikely((val & cr4_pinned_bits) != cr4_pinned_bits)) {
> - bits_missing = ~val & cr4_pinned_bits;
> - val |= bits_missing;
> + if (unlikely((val & cr4_pinned_mask) != cr4_pinned_bits)) {
> + bits_changed = ~val & cr4_pinned_mask;
> + val = (val & ~cr4_pinned_mask) | cr4_pinned_bits;
> goto set_register;
> }
> /* Warn after we've set the missing bits. */
> - WARN_ONCE(bits_missing, "CR4 bits went missing: %lx!?\n",
> - bits_missing);
> + WARN_ONCE(bits_changed, "pinned CR4 bits changed: %lx!?\n",
> + bits_changed);
> }
> }
> EXPORT_SYMBOL(native_write_cr4);
> @@ -396,7 +398,7 @@ void cr4_init(void)
> if (boot_cpu_has(X86_FEATURE_PCID))
> cr4 |= X86_CR4_PCIDE;
> if (static_branch_likely(&cr_pinning))
> - cr4 |= cr4_pinned_bits;
> + cr4 = (cr4 & ~cr4_pinned_mask) | cr4_pinned_bits;
>
> __write_cr4(cr4);
>
> @@ -411,10 +413,7 @@ void cr4_init(void)
> */
> static void __init setup_cr_pinning(void)
> {
> - unsigned long mask;
> -
> - mask = (X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP);
> - cr4_pinned_bits = this_cpu_read(cpu_tlbstate.cr4) & mask;
> + cr4_pinned_bits = this_cpu_read(cpu_tlbstate.cr4) & cr4_pinned_mask;
> static_key_enable(&cr_pinning.key);
> }
>
>
> --
> Kees Cook
>
next prev parent reply other threads:[~2020-05-26 23:22 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-26 5:28 [PATCH v1] x86: Pin cr4 FSGSBASE Andi Kleen
2020-05-26 6:56 ` Greg KH
2020-05-26 7:57 ` Peter Zijlstra
2020-05-26 8:17 ` Greg KH
2020-05-26 9:17 ` Peter Zijlstra
2020-05-26 10:16 ` Greg KH
2020-05-26 15:48 ` Andi Kleen
2020-05-26 16:20 ` Kees Cook
2020-05-26 16:32 ` Greg KH
2020-05-26 17:24 ` Wojtek Porczyk
2020-05-27 7:07 ` Greg KH
2020-05-27 10:58 ` Wojtek Porczyk
2020-05-26 16:15 ` Kees Cook
2020-05-26 21:16 ` Greg KH
2020-05-26 16:38 ` Kees Cook
2020-05-26 23:14 ` Andi Kleen [this message]
2020-05-27 10:31 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200526231423.qcsolcpll534sgro@two.firstfloor.org \
--to=andi@firstfloor.org \
--cc=ak@linux.intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).