From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0B6CC7619A for ; Sun, 19 Mar 2023 00:16:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6DB4A900004; Sat, 18 Mar 2023 20:16:03 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 63E21280001; Sat, 18 Mar 2023 20:16:03 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 46A2B900006; Sat, 18 Mar 2023 20:16:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 2BA89900004 for ; Sat, 18 Mar 2023 20:16:03 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id D3A57120C75 for ; Sun, 19 Mar 2023 00:16:02 +0000 (UTC) X-FDA: 80583730164.16.1458D88 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by imf30.hostedemail.com (Postfix) with ESMTP id D291E80015 for ; Sun, 19 Mar 2023 00:16:00 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=Pyt8CGtH; spf=pass (imf30.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.115 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1679184961; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:dkim-signature; bh=Fu0JiLzYUtOtJag4aNX/shhq8JJ4z7u8FfcAdekpma4=; b=mx8dlSCX6FISSSr4gLzZINvaERaeeXEWxvEO9/KI3Qa+W8J5T56IZzGs6nf+Ls8wA/R8Lv P0so0J2nbW31O105P40SnHR8ymlqX4tHQ6z1vt03PLv172LuGyjjXsh6YZOTAhblR2NpC/ JURhxgl2ZGXJ2sNr1AtYrsj2hQb1tOY= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=Pyt8CGtH; spf=pass (imf30.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.115 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1679184961; a=rsa-sha256; cv=none; b=TuCeJpuXXYAM1WvG0LJ4cHoen10NFKMTqjj4tYO8zl9GgWOhbVNo1hyQMC+Gje6PCwX4Xk a127YQFpM1hcGHCwPpLObKcQNrj6mLMFMICtRXhNiHI6rL7PKCmNuMKvKPqv0JAG9eRjFt 04yK92jFoAVjGjuZiGy9Am2PvEWjZ6I= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1679184960; x=1710720960; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=DZhiQrXgICtOhDgJWbiC3iTfdlJMOxEjzVm3FJAu0Gg=; b=Pyt8CGtHtjREDDCOFQvRhAPAmUwcA1EAGsMBa1Xdj1pGJDykgj5aJbzL HWcc223OAX4d0HwhozfY6Lvjw6DgW8bliFBc+l+NEEGJXafJtOYeFBDrg 3kK7SdTFi05mU09M1Uye233g4yben1r+tPRP4N9Apntuft1ZXiAkQJBca FKG2bD+Sl42lnoHLQuhrqh1wgmih0QGGQNIYYk0bgYg0lt0gxXb/UNRpC ZelN0uVC/MjYr3jpaUPGRG0yBNpbl/UuuZGrjAFkymo00qssBPYzi9mOH XqpGIzgEWzJ8dfOuYD+4QFgM4aFUBi8cjxpK6d59a6RWdU9LzW6O5Sssb g==; X-IronPort-AV: E=McAfee;i="6600,9927,10653"; a="338490790" X-IronPort-AV: E=Sophos;i="5.98,272,1673942400"; d="scan'208";a="338490790" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Mar 2023 17:15:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10653"; a="749672776" X-IronPort-AV: E=Sophos;i="5.98,272,1673942400"; d="scan'208";a="749672776" Received: from bmahatwo-mobl1.gar.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.135.34.5]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Mar 2023 17:15:57 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com, szabolcs.nagy@arm.com Cc: rick.p.edgecombe@intel.com, Yu-cheng Yu Subject: [PATCH v8 03/40] x86/cpufeatures: Add CPU feature flags for shadow stacks Date: Sat, 18 Mar 2023 17:14:58 -0700 Message-Id: <20230319001535.23210-4-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230319001535.23210-1-rick.p.edgecombe@intel.com> References: <20230319001535.23210-1-rick.p.edgecombe@intel.com> X-Rspamd-Queue-Id: D291E80015 X-Stat-Signature: ipis58znfrf8je5zwicnzoxber8xoeiu X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1679184960-733504 X-HE-Meta: U2FsdGVkX1+CAXLiE94MZFZEadryF3ipNHhl8I9y1jFG6K1T4rN6D5r+VfIHLmZ1V+U1ZjK4qFq4mLAjkBxdi7+/KJKHXRQHDv3Ezv0aB9Ta/B2JApLUYeLsuzcoY0pEqiRTvLS8Npacue3jyYdfNUtgrntkmwLC6v2nyGozXpArHBM0CMxDx04ZCUZhmJWvLGnnXlc/gfFDgC90Zyo1o/pe6wtkbEeWj7TVxfowJ1CnLc1Pwn9GX7jiRk2QJSd1ObL3iPrDW0BauUPU2fYEgmskxpcl8CjBc7HKNkXHFcur/ji2u+4nzqXVvMQPnVvdHoQ8Rk7SiAkyEsDjZyU1f8PM4MpCEfL3yxrFhy/XL1zAcLHkn/ijYXvTAfrVRFggMwyklBZX5X+1lcmrBTBEuMTasMCkQVnU/RcoG3RYHTNOsGNbojO7Xn8IMvRYU0DzRgKhFexB1l+I3GlcIH5HA6rkrnZp30epV5d9nALdcxm8/PvwRFpBhA2uzCoL5Dtk6PPXg6iej+ZPySed224dDWsRy6Nj524KWX0sBNgXkX+tzDBmky4Mqm3MXxQFZ5t8iKSczFFea+7cq+Rnv0VgeFZgVSfEMHZ83LNzrLeGXnFTYMgR9/84OK4omuYbkdPBSTWHITH3Z01N+RnMVJhULqVoLVp5vb5bJ97aDEkGzmZgHEFdYgLRGpQiiYE4DTX0Jm9UmbIwIuTO/Fa8q5HBudAeQlIpans5qzjEdDCgYilvIv40cJAirngYvXrqZI+fDH/L+uqDwGaJ1Z5ltDhYjUioV0rJs5gZWZp+uAuYwrN65na+lRwmev7mDjc96D8Myh1uS47QTOxAWTIHayG8rf18K7qdEBVkEQU0vFff+vbA82a+/h8BQJ1DPkQBVpsQTiDsoRKyfBxmrrDDhxjaHZAg71dnqjkisFj9rfaU/dD2+CHisKi+bJbqTGn5OnJiJ5g3wJTak/yh0P14AYy FUT+Swow XpH5mM+9aiXq4las1tnyPIjn9rSG8+rloYLk350L5faHmykO1zYm5CMGjsxYjkDxrBssY7Vqp6ByvplmoOfPxa9ZaRiccCeCFsjqzpFe/LX4baMr1/3GgA6OiF5y0G/HYdvIgKUz0jK0nGF4C6w//BYO6ixDNALdJo2mWrwN4TfTGfJnp83MNQazCb2t0VjOtXdJ2XzIQ6x2j0AReLlhi7qKOuzEjAT7pvQZi+1PKECpGv2NzQ0BAupaH11B1I8Epz0aN4UkianXgWlBXbgZ9f1jFxOWsTiClrEmrWplEMjC2ujIu22SEwgbU7KaTE9OSlL/Ga819uAndOcNM0EuaWor0uAq5JITEwl6o X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The Control-Flow Enforcement Technology contains two related features, one of which is Shadow Stacks. Future patches will utilize this feature for shadow stack support in KVM, so add a CPU feature flags for Shadow Stacks (CPUID.(EAX=7,ECX=0):ECX[bit 7]). To protect shadow stack state from malicious modification, the registers are only accessible in supervisor mode. This implementation context-switches the registers with XSAVES. Make X86_FEATURE_SHSTK depend on XSAVES. The shadow stack feature, enumerated by the CPUID bit described above, encompasses both supervisor and userspace support for shadow stack. In near future patches, only userspace shadow stack will be enabled. In expectation of future supervisor shadow stack support, create a software CPU capability to enumerate kernel utilization of userspace shadow stack support. This user shadow stack bit should depend on the HW "shstk" capability and that logic will be implemented in future patches. Co-developed-by: Yu-cheng Yu Signed-off-by: Yu-cheng Yu Signed-off-by: Rick Edgecombe Reviewed-by: Kees Cook Acked-by: Mike Rapoport (IBM) Tested-by: Pengfei Xu Tested-by: John Allen Tested-by: Kees Cook --- v5: - Drop "shstk" from cpuinfo (Boris) - Remove capitalization on shadow stack (Boris) v3: - Add user specific shadow stack cpu cap (Andrew Cooper) - Drop reviewed-bys from Boris and Kees due to the above change. v2: - Remove IBT reference in commit log (Kees) - Describe xsaves dependency using text from (Dave) v1: - Remove IBT, can be added in a follow on IBT series. --- arch/x86/include/asm/cpufeatures.h | 2 ++ arch/x86/include/asm/disabled-features.h | 8 +++++++- arch/x86/kernel/cpu/cpuid-deps.c | 1 + 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index 73c9672c123b..3d98ce9f41fe 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -309,6 +309,7 @@ #define X86_FEATURE_MSR_TSX_CTRL (11*32+20) /* "" MSR IA32_TSX_CTRL (Intel) implemented */ #define X86_FEATURE_SMBA (11*32+21) /* "" Slow Memory Bandwidth Allocation */ #define X86_FEATURE_BMEC (11*32+22) /* "" Bandwidth Monitoring Event Configuration */ +#define X86_FEATURE_USER_SHSTK (11*32+23) /* Shadow stack support for user mode applications */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX_VNNI (12*32+ 4) /* AVX VNNI instructions */ @@ -378,6 +379,7 @@ #define X86_FEATURE_OSPKE (16*32+ 4) /* OS Protection Keys Enable */ #define X86_FEATURE_WAITPKG (16*32+ 5) /* UMONITOR/UMWAIT/TPAUSE Instructions */ #define X86_FEATURE_AVX512_VBMI2 (16*32+ 6) /* Additional AVX512 Vector Bit Manipulation Instructions */ +#define X86_FEATURE_SHSTK (16*32+ 7) /* "" Shadow stack */ #define X86_FEATURE_GFNI (16*32+ 8) /* Galois Field New Instructions */ #define X86_FEATURE_VAES (16*32+ 9) /* Vector AES */ #define X86_FEATURE_VPCLMULQDQ (16*32+10) /* Carry-Less Multiplication Double Quadword */ diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h index 5dfa4fb76f4b..505f78ddca82 100644 --- a/arch/x86/include/asm/disabled-features.h +++ b/arch/x86/include/asm/disabled-features.h @@ -99,6 +99,12 @@ # define DISABLE_TDX_GUEST (1 << (X86_FEATURE_TDX_GUEST & 31)) #endif +#ifdef CONFIG_X86_USER_SHADOW_STACK +#define DISABLE_USER_SHSTK 0 +#else +#define DISABLE_USER_SHSTK (1 << (X86_FEATURE_USER_SHSTK & 31)) +#endif + /* * Make sure to add features to the correct mask */ @@ -114,7 +120,7 @@ #define DISABLED_MASK9 (DISABLE_SGX) #define DISABLED_MASK10 0 #define DISABLED_MASK11 (DISABLE_RETPOLINE|DISABLE_RETHUNK|DISABLE_UNRET| \ - DISABLE_CALL_DEPTH_TRACKING) + DISABLE_CALL_DEPTH_TRACKING|DISABLE_USER_SHSTK) #define DISABLED_MASK12 0 #define DISABLED_MASK13 0 #define DISABLED_MASK14 0 diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c index f6748c8bd647..e462c1d3800a 100644 --- a/arch/x86/kernel/cpu/cpuid-deps.c +++ b/arch/x86/kernel/cpu/cpuid-deps.c @@ -81,6 +81,7 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_XFD, X86_FEATURE_XSAVES }, { X86_FEATURE_XFD, X86_FEATURE_XGETBV1 }, { X86_FEATURE_AMX_TILE, X86_FEATURE_XFD }, + { X86_FEATURE_SHSTK, X86_FEATURE_XSAVES }, {} }; -- 2.17.1