lkml.org 
[lkml]   [2022]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 14/29] x86/ibt: Add IBT feature, MSR and #CP handling


    On February 18, 2022 8:49:16 AM PST, Peter Zijlstra <peterz@infradead.org> wrote:
    >The bits required to make the hardware go.. Of note is that, provided
    >the syscall entry points are covered with ENDBR, #CP doesn't need to
    >be an IST because we'll never hit the syscall gap.
    >
    >Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    >---
    > arch/x86/include/asm/cpufeatures.h | 1
    > arch/x86/include/asm/idtentry.h | 5 ++
    > arch/x86/include/asm/msr-index.h | 20 ++++++++
    > arch/x86/include/asm/traps.h | 2
    > arch/x86/include/uapi/asm/processor-flags.h | 2
    > arch/x86/kernel/cpu/common.c | 23 +++++++++
    > arch/x86/kernel/idt.c | 4 +
    > arch/x86/kernel/traps.c | 65 ++++++++++++++++++++++++++++
    > 8 files changed, 121 insertions(+), 1 deletion(-)
    >
    >--- a/arch/x86/include/asm/cpufeatures.h
    >+++ b/arch/x86/include/asm/cpufeatures.h
    >@@ -387,6 +387,7 @@
    > #define X86_FEATURE_TSXLDTRK (18*32+16) /* TSX Suspend Load Address Tracking */
    > #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
    > #define X86_FEATURE_ARCH_LBR (18*32+19) /* Intel ARCH LBR */
    >+#define X86_FEATURE_IBT (18*32+20) /* Indirect Branch Tracking */
    > #define X86_FEATURE_AMX_BF16 (18*32+22) /* AMX bf16 Support */
    > #define X86_FEATURE_AVX512_FP16 (18*32+23) /* AVX512 FP16 */
    > #define X86_FEATURE_AMX_TILE (18*32+24) /* AMX tile Support */
    >--- a/arch/x86/include/asm/idtentry.h
    >+++ b/arch/x86/include/asm/idtentry.h
    >@@ -622,6 +622,11 @@ DECLARE_IDTENTRY_DF(X86_TRAP_DF, exc_dou
    > DECLARE_IDTENTRY_RAW_ERRORCODE(X86_TRAP_DF, xenpv_exc_double_fault);
    > #endif
    >
    >+/* #CP */
    >+#ifdef CONFIG_X86_IBT
    >+DECLARE_IDTENTRY_ERRORCODE(X86_TRAP_CP, exc_control_protection);
    >+#endif
    >+
    > /* #VC */
    > #ifdef CONFIG_AMD_MEM_ENCRYPT
    > DECLARE_IDTENTRY_VC(X86_TRAP_VC, exc_vmm_communication);
    >--- a/arch/x86/include/asm/msr-index.h
    >+++ b/arch/x86/include/asm/msr-index.h
    >@@ -360,11 +360,29 @@
    > #define MSR_ATOM_CORE_TURBO_RATIOS 0x0000066c
    > #define MSR_ATOM_CORE_TURBO_VIDS 0x0000066d
    >
    >-
    > #define MSR_CORE_PERF_LIMIT_REASONS 0x00000690
    > #define MSR_GFX_PERF_LIMIT_REASONS 0x000006B0
    > #define MSR_RING_PERF_LIMIT_REASONS 0x000006B1
    >
    >+/* Control-flow Enforcement Technology MSRs */
    >+#define MSR_IA32_U_CET 0x000006a0 /* user mode cet */
    >+#define MSR_IA32_S_CET 0x000006a2 /* kernel mode cet */
    >+#define CET_SHSTK_EN BIT_ULL(0)
    >+#define CET_WRSS_EN BIT_ULL(1)
    >+#define CET_ENDBR_EN BIT_ULL(2)
    >+#define CET_LEG_IW_EN BIT_ULL(3)
    >+#define CET_NO_TRACK_EN BIT_ULL(4)
    >+#define CET_SUPPRESS_DISABLE BIT_ULL(5)
    >+#define CET_RESERVED (BIT_ULL(6) | BIT_ULL(7) | BIT_ULL(8) | BIT_ULL(9))
    >+#define CET_SUPPRESS BIT_ULL(10)
    >+#define CET_WAIT_ENDBR BIT_ULL(11)
    >+
    >+#define MSR_IA32_PL0_SSP 0x000006a4 /* ring-0 shadow stack pointer */
    >+#define MSR_IA32_PL1_SSP 0x000006a5 /* ring-1 shadow stack pointer */
    >+#define MSR_IA32_PL2_SSP 0x000006a6 /* ring-2 shadow stack pointer */
    >+#define MSR_IA32_PL3_SSP 0x000006a7 /* ring-3 shadow stack pointer */
    >+#define MSR_IA32_INT_SSP_TAB 0x000006a8 /* exception shadow stack table */
    >+
    > /* Hardware P state interface */
    > #define MSR_PPERF 0x0000064e
    > #define MSR_PERF_LIMIT_REASONS 0x0000064f
    >--- a/arch/x86/include/asm/traps.h
    >+++ b/arch/x86/include/asm/traps.h
    >@@ -18,6 +18,8 @@ void __init trap_init(void);
    > asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *eregs);
    > #endif
    >
    >+extern bool ibt_selftest(void);
    >+
    > #ifdef CONFIG_X86_F00F_BUG
    > /* For handling the FOOF bug */
    > void handle_invalid_op(struct pt_regs *regs);
    >--- a/arch/x86/include/uapi/asm/processor-flags.h
    >+++ b/arch/x86/include/uapi/asm/processor-flags.h
    >@@ -130,6 +130,8 @@
    > #define X86_CR4_SMAP _BITUL(X86_CR4_SMAP_BIT)
    > #define X86_CR4_PKE_BIT 22 /* enable Protection Keys support */
    > #define X86_CR4_PKE _BITUL(X86_CR4_PKE_BIT)
    >+#define X86_CR4_CET_BIT 23 /* enable Control-flow Enforcement Technology */
    >+#define X86_CR4_CET _BITUL(X86_CR4_CET_BIT)
    >
    > /*
    > * x86-64 Task Priority Register, CR8
    >--- a/arch/x86/kernel/cpu/common.c
    >+++ b/arch/x86/kernel/cpu/common.c
    >@@ -59,6 +59,7 @@
    > #include <asm/cpu_device_id.h>
    > #include <asm/uv/uv.h>
    > #include <asm/sigframe.h>
    >+#include <asm/traps.h>
    >
    > #include "cpu.h"
    >
    >@@ -592,6 +593,27 @@ static __init int setup_disable_pku(char
    > __setup("nopku", setup_disable_pku);
    > #endif /* CONFIG_X86_64 */
    >
    >+static __always_inline void setup_cet(struct cpuinfo_x86 *c)
    >+{
    >+ u64 msr;
    >+
    >+ if (!IS_ENABLED(CONFIG_X86_IBT) ||
    >+ !cpu_feature_enabled(X86_FEATURE_IBT))
    >+ return;
    >+
    >+ cr4_set_bits(X86_CR4_CET);

    Please add X86_CR4_CET to cr4_pinned_mask too.

    >+
    >+ rdmsrl(MSR_IA32_S_CET, msr);
    >+ if (cpu_feature_enabled(X86_FEATURE_IBT))
    >+ msr |= CET_ENDBR_EN;
    >+ wrmsrl(MSR_IA32_S_CET, msr);
    >+
    >+ if (!ibt_selftest()) {
    >+ pr_err("IBT selftest: Failed!\n");
    >+ setup_clear_cpu_cap(X86_FEATURE_IBT);
    >+ }
    >+}
    >+
    > /*
    > * Some CPU features depend on higher CPUID levels, which may not always
    > * be available due to CPUID level capping or broken virtualization
    >@@ -1709,6 +1731,7 @@ static void identify_cpu(struct cpuinfo_
    >
    > x86_init_rdrand(c);
    > setup_pku(c);
    >+ setup_cet(c);
    >
    > /*
    > * Clear/Set all flags overridden by options, need do it
    >--- a/arch/x86/kernel/idt.c
    >+++ b/arch/x86/kernel/idt.c
    >@@ -104,6 +104,10 @@ static const __initconst struct idt_data
    > ISTG(X86_TRAP_MC, asm_exc_machine_check, IST_INDEX_MCE),
    > #endif
    >
    >+#ifdef CONFIG_X86_IBT
    >+ INTG(X86_TRAP_CP, asm_exc_control_protection),
    >+#endif
    >+
    > #ifdef CONFIG_AMD_MEM_ENCRYPT
    > ISTG(X86_TRAP_VC, asm_exc_vmm_communication, IST_INDEX_VC),
    > #endif
    >--- a/arch/x86/kernel/traps.c
    >+++ b/arch/x86/kernel/traps.c
    >@@ -210,6 +210,71 @@ DEFINE_IDTENTRY(exc_overflow)
    > do_error_trap(regs, 0, "overflow", X86_TRAP_OF, SIGSEGV, 0, NULL);
    > }
    >
    >+#ifdef CONFIG_X86_IBT
    >+
    >+static bool ibt_fatal = true;

    __ro_after_init please. :)

    >+
    >+extern unsigned long ibt_selftest_ip; /* defined in asm beow */
    >+static volatile bool ibt_selftest_ok = false;
    >+
    >+DEFINE_IDTENTRY_ERRORCODE(exc_control_protection)
    >+{
    >+ if (!cpu_feature_enabled(X86_FEATURE_IBT)) {
    >+ pr_err("Whaaa?!?!\n");
    >+ return;

    Seems like this case should fail closed and not return?

    >+ }
    >+
    >+ if (WARN_ON_ONCE(user_mode(regs) || error_code != 3))
    >+ return;
    >+
    >+ if (unlikely(regs->ip == ibt_selftest_ip)) {
    >+ ibt_selftest_ok = true;
    >+ return;
    >+ }
    >+
    >+ pr_err("Missing ENDBR: %pS\n", (void *)instruction_pointer(regs));
    >+ BUG_ON(ibt_fatal);
    >+}
    >+
    >+bool ibt_selftest(void)
    >+{
    >+ ibt_selftest_ok = false;
    >+
    >+ asm (ANNOTATE_NOENDBR
    >+ "1: lea 2f(%%rip), %%rax\n\t"
    >+ ANNOTATE_RETPOLINE_SAFE
    >+ " jmp *%%rax\n\t"
    >+ "2: nop\n\t"
    >+
    >+ /* unsigned ibt_selftest_ip = 2b */
    >+ ".pushsection .data,\"aw\"\n\t"
    >+ ".align 8\n\t"
    >+ ".type ibt_selftest_ip, @object\n\t"
    >+ ".size ibt_selftest_ip, 8\n\t"
    >+ "ibt_selftest_ip:\n\t"
    >+ ".quad 2b\n\t"
    >+ ".popsection\n\t"
    >+
    >+ : : : "rax", "memory");
    >+
    >+ return ibt_selftest_ok;
    >+}
    >+
    >+static int __init ibt_setup(char *str)
    >+{
    >+ if (!strcmp(str, "off"))
    >+ setup_clear_cpu_cap(X86_FEATURE_IBT);
    >+
    >+ if (!strcmp(str, "warn"))
    >+ ibt_fatal = false;
    >+
    >+ return 1;
    >+}
    >+
    >+__setup("ibt=", ibt_setup);
    >+
    >+#endif /* CONFIG_X86_IBT */
    >+
    > #ifdef CONFIG_X86_F00F_BUG
    > void handle_invalid_op(struct pt_regs *regs)
    > #else
    >
    >

    --
    Kees Cook

    \
     
     \ /
      Last update: 2022-02-21 10:21    [W:3.730 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site