From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72FE1C35E01 for ; Tue, 25 Feb 2020 20:04:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4D429218AC for ; Tue, 25 Feb 2020 20:04:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="P8MDT0cC" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731574AbgBYUEW (ORCPT ); Tue, 25 Feb 2020 15:04:22 -0500 Received: from mail-pg1-f196.google.com ([209.85.215.196]:34922 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731345AbgBYUEW (ORCPT ); Tue, 25 Feb 2020 15:04:22 -0500 Received: by mail-pg1-f196.google.com with SMTP id 7so88585pgr.2 for ; Tue, 25 Feb 2020 12:04:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=BpgzSDf6JhhZfg51iKdhAMMJbNC3r3UORVH5eKhoGB8=; b=P8MDT0cC5XXhSyYyx5TXU139qSIZ/xhuoGwRng4lZAmicF++O+72wdGpXydxjjkgFa H4vkNdlhIhv5JR6vbLSURhaY9tLDlh6H0DsHibawIoSvdFOEeNyiXIv50fTJxqAVYNNd 6cAG3sXIgbEYIb7BLdbgbbget3GIHMemSl1aA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=BpgzSDf6JhhZfg51iKdhAMMJbNC3r3UORVH5eKhoGB8=; b=SyyGVGTrJURhT+0SDe/9unygi861YWVunXy894L+W/pxF5DkFMeVmb0eDebDo6jRRp rKim3HOvCpepgs5VEzJNNKUIBOkshoAgrSO+UVWZehz3XRPWTckn3S2qHKl3fyh4SaTe FOXyaAc7/1JML1XJc78HunC7HRPNbfHUsjgb2WvhSdCZ/byWIXnn7tuDZ35AVfFvj6Xq xcqCoS0DK4FibXZYPtbvy2qyOF7be3l8KiojYrKglocYM0A+Dc9V7t9cpOSvfECjSN+I HuUFQuCMCW5S0qwN3dz6CvLFT+OqHQOEZd3BcqSrwwgfE+uev1G5Re/pI6VUKyL5cl1L +ZaA== X-Gm-Message-State: APjAAAWHxKIQAtI8ap3tX/grcgekexuVdXtX7NRFa1fg7lyrBRTwls52 Y1bjRX9h1+u4tczLT/0ip5aqwg== X-Google-Smtp-Source: APXvYqzTnsAiIZPOowEHcZB0wbT1W7YT7argEgciEcgKnK9iDdlzqhQbhsBMCk6QBQAjW+qazXItWQ== X-Received: by 2002:a62:37c7:: with SMTP id e190mr377399pfa.165.1582661060202; Tue, 25 Feb 2020 12:04:20 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id y18sm18433773pfe.19.2020.02.25.12.04.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Feb 2020 12:04:19 -0800 (PST) Date: Tue, 25 Feb 2020 12:04:18 -0800 From: Kees Cook To: Yu-cheng Yu Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , x86-patch-review@intel.com Subject: Re: [RFC PATCH v9 03/27] x86/fpu/xstate: Introduce CET MSR XSAVES supervisor states Message-ID: <202002251204.BFA4DC797@keescook> References: <20200205181935.3712-1-yu-cheng.yu@intel.com> <20200205181935.3712-4-yu-cheng.yu@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200205181935.3712-4-yu-cheng.yu@intel.com> Sender: linux-api-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org On Wed, Feb 05, 2020 at 10:19:11AM -0800, Yu-cheng Yu wrote: > Control-flow Enforcement Technology (CET) adds five MSRs. Introduce them > and their XSAVES supervisor states: > > MSR_IA32_U_CET (user-mode CET settings), > MSR_IA32_PL3_SSP (user-mode Shadow Stack pointer), > MSR_IA32_PL0_SSP (kernel-mode Shadow Stack pointer), > MSR_IA32_PL1_SSP (Privilege Level 1 Shadow Stack pointer), > MSR_IA32_PL2_SSP (Privilege Level 2 Shadow Stack pointer). > > v6: > - Remove __packed from struct cet_user_state, struct cet_kernel_state. > > Signed-off-by: Yu-cheng Yu Reviewed-by: Kees Cook -Kees > --- > arch/x86/include/asm/fpu/types.h | 22 ++++++++++++++++++ > arch/x86/include/asm/fpu/xstate.h | 5 +++-- > arch/x86/include/asm/msr-index.h | 18 +++++++++++++++ > arch/x86/include/uapi/asm/processor-flags.h | 2 ++ > arch/x86/kernel/fpu/xstate.c | 25 +++++++++++++++++++-- > 5 files changed, 68 insertions(+), 4 deletions(-) > > diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h > index f098f6cab94b..d7ef4d9c7ad5 100644 > --- a/arch/x86/include/asm/fpu/types.h > +++ b/arch/x86/include/asm/fpu/types.h > @@ -114,6 +114,9 @@ enum xfeature { > XFEATURE_Hi16_ZMM, > XFEATURE_PT_UNIMPLEMENTED_SO_FAR, > XFEATURE_PKRU, > + XFEATURE_RESERVED, > + XFEATURE_CET_USER, > + XFEATURE_CET_KERNEL, > > XFEATURE_MAX, > }; > @@ -128,6 +131,8 @@ enum xfeature { > #define XFEATURE_MASK_Hi16_ZMM (1 << XFEATURE_Hi16_ZMM) > #define XFEATURE_MASK_PT (1 << XFEATURE_PT_UNIMPLEMENTED_SO_FAR) > #define XFEATURE_MASK_PKRU (1 << XFEATURE_PKRU) > +#define XFEATURE_MASK_CET_USER (1 << XFEATURE_CET_USER) > +#define XFEATURE_MASK_CET_KERNEL (1 << XFEATURE_CET_KERNEL) > > #define XFEATURE_MASK_FPSSE (XFEATURE_MASK_FP | XFEATURE_MASK_SSE) > #define XFEATURE_MASK_AVX512 (XFEATURE_MASK_OPMASK \ > @@ -229,6 +234,23 @@ struct pkru_state { > u32 pad; > } __packed; > > +/* > + * State component 11 is Control-flow Enforcement user states > + */ > +struct cet_user_state { > + u64 user_cet; /* user control-flow settings */ > + u64 user_ssp; /* user shadow stack pointer */ > +}; > + > +/* > + * State component 12 is Control-flow Enforcement kernel states > + */ > +struct cet_kernel_state { > + u64 kernel_ssp; /* kernel shadow stack */ > + u64 pl1_ssp; /* privilege level 1 shadow stack */ > + u64 pl2_ssp; /* privilege level 2 shadow stack */ > +}; > + > struct xstate_header { > u64 xfeatures; > u64 xcomp_bv; > diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h > index 9ebfdd543576..952d2515dae4 100644 > --- a/arch/x86/include/asm/fpu/xstate.h > +++ b/arch/x86/include/asm/fpu/xstate.h > @@ -33,13 +33,14 @@ > XFEATURE_MASK_BNDCSR) > > /* All currently supported supervisor features */ > -#define SUPPORTED_XFEATURES_MASK_SUPERVISOR (0) > +#define SUPPORTED_XFEATURES_MASK_SUPERVISOR (XFEATURE_MASK_CET_USER) > > /* > * Unsupported supervisor features. When a supervisor feature in this mask is > * supported in the future, move it to the supported supervisor feature mask. > */ > -#define UNSUPPORTED_XFEATURES_MASK_SUPERVISOR (XFEATURE_MASK_PT) > +#define UNSUPPORTED_XFEATURES_MASK_SUPERVISOR (XFEATURE_MASK_PT | \ > + XFEATURE_MASK_CET_KERNEL) > > /* All supervisor states including supported and unsupported states. */ > #define ALL_XFEATURES_MASK_SUPERVISOR (SUPPORTED_XFEATURES_MASK_SUPERVISOR | \ > diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h > index 084e98da04a7..114e77f5bb6b 100644 > --- a/arch/x86/include/asm/msr-index.h > +++ b/arch/x86/include/asm/msr-index.h > @@ -872,4 +872,22 @@ > #define MSR_VM_IGNNE 0xc0010115 > #define MSR_VM_HSAVE_PA 0xc0010117 > > +/* Control-flow Enforcement Technology MSRs */ > +#define MSR_IA32_U_CET 0x6a0 /* user mode cet setting */ > +#define MSR_IA32_S_CET 0x6a2 /* kernel mode cet setting */ > +#define MSR_IA32_PL0_SSP 0x6a4 /* kernel shstk pointer */ > +#define MSR_IA32_PL1_SSP 0x6a5 /* ring-1 shstk pointer */ > +#define MSR_IA32_PL2_SSP 0x6a6 /* ring-2 shstk pointer */ > +#define MSR_IA32_PL3_SSP 0x6a7 /* user shstk pointer */ > +#define MSR_IA32_INT_SSP_TAB 0x6a8 /* exception shstk table */ > + > +/* MSR_IA32_U_CET and MSR_IA32_S_CET bits */ > +#define MSR_IA32_CET_SHSTK_EN 0x0000000000000001ULL > +#define MSR_IA32_CET_WRSS_EN 0x0000000000000002ULL > +#define MSR_IA32_CET_ENDBR_EN 0x0000000000000004ULL > +#define MSR_IA32_CET_LEG_IW_EN 0x0000000000000008ULL > +#define MSR_IA32_CET_NO_TRACK_EN 0x0000000000000010ULL > +#define MSR_IA32_CET_WAIT_ENDBR 0x00000000000000800UL > +#define MSR_IA32_CET_BITMAP_MASK 0xfffffffffffff000ULL > + > #endif /* _ASM_X86_MSR_INDEX_H */ > diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h > index bcba3c643e63..a8df907e8017 100644 > --- a/arch/x86/include/uapi/asm/processor-flags.h > +++ b/arch/x86/include/uapi/asm/processor-flags.h > @@ -130,6 +130,8 @@ > #define X86_CR4_SMAP _BITUL(X86_CR4_SMAP_BIT) > #define X86_CR4_PKE_BIT 22 /* enable Protection Keys support */ > #define X86_CR4_PKE _BITUL(X86_CR4_PKE_BIT) > +#define X86_CR4_CET_BIT 23 /* enable Control-flow Enforcement */ > +#define X86_CR4_CET _BITUL(X86_CR4_CET_BIT) > > /* > * x86-64 Task Priority Register, CR8 > diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c > index 04f7c6b8dbbc..ec08a2b6feca 100644 > --- a/arch/x86/kernel/fpu/xstate.c > +++ b/arch/x86/kernel/fpu/xstate.c > @@ -38,6 +38,9 @@ static const char *xfeature_names[] = > "Processor Trace (unused)" , > "Protection Keys User registers", > "unknown xstate feature" , > + "Control-flow User registers" , > + "Control-flow Kernel registers" , > + "unknown xstate feature" , > }; > > static short xsave_cpuid_features[] __initdata = { > @@ -51,6 +54,9 @@ static short xsave_cpuid_features[] __initdata = { > X86_FEATURE_AVX512F, > X86_FEATURE_INTEL_PT, > X86_FEATURE_PKU, > + -1, /* Unused */ > + X86_FEATURE_SHSTK, /* XFEATURE_CET_USER */ > + X86_FEATURE_SHSTK, /* XFEATURE_CET_KERNEL */ > }; > > /* > @@ -316,6 +322,8 @@ static void __init print_xstate_features(void) > print_xstate_feature(XFEATURE_MASK_ZMM_Hi256); > print_xstate_feature(XFEATURE_MASK_Hi16_ZMM); > print_xstate_feature(XFEATURE_MASK_PKRU); > + print_xstate_feature(XFEATURE_MASK_CET_USER); > + print_xstate_feature(XFEATURE_MASK_CET_KERNEL); > } > > /* > @@ -563,6 +571,8 @@ static void check_xstate_against_struct(int nr) > XCHECK_SZ(sz, nr, XFEATURE_ZMM_Hi256, struct avx_512_zmm_uppers_state); > XCHECK_SZ(sz, nr, XFEATURE_Hi16_ZMM, struct avx_512_hi16_state); > XCHECK_SZ(sz, nr, XFEATURE_PKRU, struct pkru_state); > + XCHECK_SZ(sz, nr, XFEATURE_CET_USER, struct cet_user_state); > + XCHECK_SZ(sz, nr, XFEATURE_CET_KERNEL, struct cet_kernel_state); > > /* > * Make *SURE* to add any feature numbers in below if > @@ -770,8 +780,19 @@ void __init fpu__init_system_xstate(void) > * Clear XSAVE features that are disabled in the normal CPUID. > */ > for (i = 0; i < ARRAY_SIZE(xsave_cpuid_features); i++) { > - if (!boot_cpu_has(xsave_cpuid_features[i])) > - xfeatures_mask_all &= ~BIT_ULL(i); > + if (xsave_cpuid_features[i] == X86_FEATURE_SHSTK) { > + /* > + * X86_FEATURE_SHSTK and X86_FEATURE_IBT share > + * same states, but can be enabled separately. > + */ > + if (!boot_cpu_has(X86_FEATURE_SHSTK) && > + !boot_cpu_has(X86_FEATURE_IBT)) > + xfeatures_mask_all &= ~BIT_ULL(i); > + } else { > + if ((xsave_cpuid_features[i] == -1) || > + !boot_cpu_has(xsave_cpuid_features[i])) > + xfeatures_mask_all &= ~BIT_ULL(i); > + } > } > > xfeatures_mask_all &= fpu__get_supported_xfeatures_mask(); > -- > 2.21.0 > -- Kees Cook