* [PATCH 3/3 v2] x86, cpu: Enable/disable SMEP
@ 2011-05-11 23:51 Fenghua Yu
2011-05-18 5:13 ` [tip:x86/smep] x86, cpu: Enable/disable Supervisor Mode Execution Protection tip-bot for Fenghua Yu
0 siblings, 1 reply; 4+ messages in thread
From: Fenghua Yu @ 2011-05-11 23:51 UTC (permalink / raw)
To: Ingo Molnar, Thomas Gleixner, H Peter Anvin, Asit K Mallick, Andi Kleen
Cc: linux-kernel, Fenghua Yu
From: Fenghua Yu <fenghua.yu@intel.com>
Enable/disable newly documented SMEP (Supervisor Mode Execution Protection) CPU
feature in kernel. CR4.SMEP (bit 20) is 0 at power-on. If the feature is
supported by CPU (X86_FEATURE_SMEP), enable SMEP by setting CR4.SMEP. New kernel
option nosmep disables the feature even if the feature is supported by CPU.
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
---
Documentation/kernel-parameters.txt | 4 ++++
arch/x86/kernel/cpu/common.c | 23 +++++++++++++++++++++++
2 files changed, 27 insertions(+)
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index cc85a92..56fb8c1 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1664,6 +1664,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
noexec=on: enable non-executable mappings (default)
noexec=off: disable non-executable mappings
+ nosmep [X86]
+ Disable SMEP (Supervisor Mode Execution Protection)
+ even if it is supported by processor.
+
noexec32 [X86-64]
This affects only 32-bit executables.
noexec32=on: enable non-executable mappings (default)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index e2ced00..5f3cdd4 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -254,6 +254,25 @@ static inline void squash_the_stupid_serial_number(struct cpuinfo_x86 *c)
}
#endif
+static int disable_smep __initdata;
+static __init int setup_disable_smep(char *arg)
+{
+ disable_smep = 1;
+ return 1;
+}
+__setup("nosmep", setup_disable_smep);
+
+static __init void setup_smep(struct cpuinfo_x86 *c)
+{
+ if (cpu_has(c, X86_FEATURE_SMEP)) {
+ if (unlikely(disable_smep)) {
+ setup_clear_cpu_cap(X86_FEATURE_SMEP);
+ clear_in_cr4(X86_CR4_SMEP);
+ } else
+ set_in_cr4(X86_CR4_SMEP);
+ }
+}
+
/*
* Some CPU features depend on higher CPUID levels, which may not always
* be available due to CPUID level capping or broken virtualization
@@ -661,6 +680,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
get_cpu_cap(c);
+ setup_smep(c);
+
if (this_cpu->c_early_init)
this_cpu->c_early_init(c);
@@ -738,6 +759,8 @@ static void __cpuinit generic_identify(struct cpuinfo_x86 *c)
get_cpu_cap(c);
+ setup_smep(c);
+
if (c->cpuid_level >= 0x00000001) {
c->initial_apicid = (cpuid_ebx(1) >> 24) & 0xFF;
#ifdef CONFIG_X86_32
--
1.7.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* [tip:x86/smep] x86, cpu: Enable/disable Supervisor Mode Execution Protection
2011-05-11 23:51 [PATCH 3/3 v2] x86, cpu: Enable/disable SMEP Fenghua Yu
@ 2011-05-18 5:13 ` tip-bot for Fenghua Yu
2011-05-20 21:13 ` Yinghai Lu
0 siblings, 1 reply; 4+ messages in thread
From: tip-bot for Fenghua Yu @ 2011-05-18 5:13 UTC (permalink / raw)
To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, fenghua.yu, tglx, hpa
Commit-ID: de5397ad5b9ad22e2401c4dacdf1bb3b19c05679
Gitweb: http://git.kernel.org/tip/de5397ad5b9ad22e2401c4dacdf1bb3b19c05679
Author: Fenghua Yu <fenghua.yu@intel.com>
AuthorDate: Wed, 11 May 2011 16:51:05 -0700
Committer: H. Peter Anvin <hpa@linux.intel.com>
CommitDate: Tue, 17 May 2011 21:22:00 -0700
x86, cpu: Enable/disable Supervisor Mode Execution Protection
Enable/disable newly documented SMEP (Supervisor Mode Execution Protection) CPU
feature in kernel. CR4.SMEP (bit 20) is 0 at power-on. If the feature is
supported by CPU (X86_FEATURE_SMEP), enable SMEP by setting CR4.SMEP. New kernel
option nosmep disables the feature even if the feature is supported by CPU.
[ hpa: moved the call to setup_smep() until after the vendor-specific
initialization; that ensures that CPUID features are unmasked. We
will still run it before we have userspace (never mind uncontrolled
userspace). ]
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
LKML-Reference: <1305157865-31727-1-git-send-email-fenghua.yu@intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
---
Documentation/kernel-parameters.txt | 4 ++++
arch/x86/kernel/cpu/common.c | 23 +++++++++++++++++++++++
2 files changed, 27 insertions(+), 0 deletions(-)
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index cc85a92..56fb8c1 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1664,6 +1664,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
noexec=on: enable non-executable mappings (default)
noexec=off: disable non-executable mappings
+ nosmep [X86]
+ Disable SMEP (Supervisor Mode Execution Protection)
+ even if it is supported by processor.
+
noexec32 [X86-64]
This affects only 32-bit executables.
noexec32=on: enable non-executable mappings (default)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 173f3a3..cbc70a2 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -254,6 +254,25 @@ static inline void squash_the_stupid_serial_number(struct cpuinfo_x86 *c)
}
#endif
+static int disable_smep __initdata;
+static __init int setup_disable_smep(char *arg)
+{
+ disable_smep = 1;
+ return 1;
+}
+__setup("nosmep", setup_disable_smep);
+
+static __init void setup_smep(struct cpuinfo_x86 *c)
+{
+ if (cpu_has(c, X86_FEATURE_SMEP)) {
+ if (unlikely(disable_smep)) {
+ setup_clear_cpu_cap(X86_FEATURE_SMEP);
+ clear_in_cr4(X86_CR4_SMEP);
+ } else
+ set_in_cr4(X86_CR4_SMEP);
+ }
+}
+
/*
* Some CPU features depend on higher CPUID levels, which may not always
* be available due to CPUID level capping or broken virtualization
@@ -667,6 +686,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
c->cpu_index = 0;
#endif
filter_cpuid_features(c, false);
+
+ setup_smep(c);
}
void __init early_cpu_init(void)
@@ -752,6 +773,8 @@ static void __cpuinit generic_identify(struct cpuinfo_x86 *c)
#endif
}
+ setup_smep(c);
+
get_model_name(c); /* Default name */
detect_nopl(c);
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [tip:x86/smep] x86, cpu: Enable/disable Supervisor Mode Execution Protection
2011-05-18 5:13 ` [tip:x86/smep] x86, cpu: Enable/disable Supervisor Mode Execution Protection tip-bot for Fenghua Yu
@ 2011-05-20 21:13 ` Yinghai Lu
2011-05-21 10:43 ` Ingo Molnar
0 siblings, 1 reply; 4+ messages in thread
From: Yinghai Lu @ 2011-05-20 21:13 UTC (permalink / raw)
To: mingo, hpa, linux-kernel, fenghua.yu, tglx, hpa; +Cc: linux-tip-commits
On 05/17/2011 10:13 PM, tip-bot for Fenghua Yu wrote:
> Commit-ID: de5397ad5b9ad22e2401c4dacdf1bb3b19c05679
> Gitweb: http://git.kernel.org/tip/de5397ad5b9ad22e2401c4dacdf1bb3b19c05679
> Author: Fenghua Yu <fenghua.yu@intel.com>
> AuthorDate: Wed, 11 May 2011 16:51:05 -0700
> Committer: H. Peter Anvin <hpa@linux.intel.com>
> CommitDate: Tue, 17 May 2011 21:22:00 -0700
>
> x86, cpu: Enable/disable Supervisor Mode Execution Protection
>
> Enable/disable newly documented SMEP (Supervisor Mode Execution Protection) CPU
> feature in kernel. CR4.SMEP (bit 20) is 0 at power-on. If the feature is
> supported by CPU (X86_FEATURE_SMEP), enable SMEP by setting CR4.SMEP. New kernel
> option nosmep disables the feature even if the feature is supported by CPU.
>
> [ hpa: moved the call to setup_smep() until after the vendor-specific
> initialization; that ensures that CPUID features are unmasked. We
> will still run it before we have userspace (never mind uncontrolled
> userspace). ]
>
> Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
> LKML-Reference: <1305157865-31727-1-git-send-email-fenghua.yu@intel.com>
> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
> ---
> Documentation/kernel-parameters.txt | 4 ++++
> arch/x86/kernel/cpu/common.c | 23 +++++++++++++++++++++++
> 2 files changed, 27 insertions(+), 0 deletions(-)
>
> diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
> index cc85a92..56fb8c1 100644
> --- a/Documentation/kernel-parameters.txt
> +++ b/Documentation/kernel-parameters.txt
> @@ -1664,6 +1664,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
> noexec=on: enable non-executable mappings (default)
> noexec=off: disable non-executable mappings
>
> + nosmep [X86]
> + Disable SMEP (Supervisor Mode Execution Protection)
> + even if it is supported by processor.
> +
> noexec32 [X86-64]
> This affects only 32-bit executables.
> noexec32=on: enable non-executable mappings (default)
> diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
> index 173f3a3..cbc70a2 100644
> --- a/arch/x86/kernel/cpu/common.c
> +++ b/arch/x86/kernel/cpu/common.c
> @@ -254,6 +254,25 @@ static inline void squash_the_stupid_serial_number(struct cpuinfo_x86 *c)
> }
> #endif
>
> +static int disable_smep __initdata;
> +static __init int setup_disable_smep(char *arg)
> +{
> + disable_smep = 1;
> + return 1;
> +}
> +__setup("nosmep", setup_disable_smep);
> +
> +static __init void setup_smep(struct cpuinfo_x86 *c)
> +{
> + if (cpu_has(c, X86_FEATURE_SMEP)) {
> + if (unlikely(disable_smep)) {
> + setup_clear_cpu_cap(X86_FEATURE_SMEP);
> + clear_in_cr4(X86_CR4_SMEP);
> + } else
> + set_in_cr4(X86_CR4_SMEP);
> + }
> +}
should be __cpuinit for this function.
otherwise got:
WARNING: arch/x86/built-in.o(.cpuinit.text+0x1b10): Section mismatch in reference from the function identify_cpu() to the function .init.text:setup_smep()
The function __cpuinit identify_cpu() references
a function __init setup_smep().
If setup_smep is only used by identify_cpu then
annotate setup_smep with a matching annotation.
> +
> /*
> * Some CPU features depend on higher CPUID levels, which may not always
> * be available due to CPUID level capping or broken virtualization
> @@ -667,6 +686,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
> c->cpu_index = 0;
> #endif
> filter_cpuid_features(c, false);
> +
> + setup_smep(c);
> }
>
> void __init early_cpu_init(void)
> @@ -752,6 +773,8 @@ static void __cpuinit generic_identify(struct cpuinfo_x86 *c)
> #endif
> }
>
> + setup_smep(c);
> +
> get_model_name(c); /* Default name */
>
> detect_nopl(c);
> --
> To unsubscribe from this list: send the line "unsubscribe linux-tip-commits" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [tip:x86/smep] x86, cpu: Enable/disable Supervisor Mode Execution Protection
2011-05-20 21:13 ` Yinghai Lu
@ 2011-05-21 10:43 ` Ingo Molnar
0 siblings, 0 replies; 4+ messages in thread
From: Ingo Molnar @ 2011-05-21 10:43 UTC (permalink / raw)
To: Yinghai Lu
Cc: mingo, hpa, linux-kernel, fenghua.yu, tglx, hpa, linux-tip-commits
* Yinghai Lu <yinghai@kernel.org> wrote:
> > +static __init void setup_smep(struct cpuinfo_x86 *c)
> > +{
> > + if (cpu_has(c, X86_FEATURE_SMEP)) {
> > + if (unlikely(disable_smep)) {
> > + setup_clear_cpu_cap(X86_FEATURE_SMEP);
> > + clear_in_cr4(X86_CR4_SMEP);
> > + } else
> > + set_in_cr4(X86_CR4_SMEP);
> > + }
> > +}
>
> should be __cpuinit for this function.
>
> otherwise got:
>
> WARNING: arch/x86/built-in.o(.cpuinit.text+0x1b10): Section mismatch in reference from the function identify_cpu() to the function .init.text:setup_smep()
> The function __cpuinit identify_cpu() references
> a function __init setup_smep().
> If setup_smep is only used by identify_cpu then
> annotate setup_smep with a matching annotation.
Yeah, indeed, and it might in fact crash with certain .config's. Mind sending a
tested patch?
Thanks,
Ingo
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-05-21 10:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-05-11 23:51 [PATCH 3/3 v2] x86, cpu: Enable/disable SMEP Fenghua Yu
2011-05-18 5:13 ` [tip:x86/smep] x86, cpu: Enable/disable Supervisor Mode Execution Protection tip-bot for Fenghua Yu
2011-05-20 21:13 ` Yinghai Lu
2011-05-21 10:43 ` Ingo Molnar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).