Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ceaf206 authored by Kees Cook's avatar Kees Cook Committed by Sasha Levin
Browse files

x86/cpu: Use pinning mask for CR4 bits needing to be 0 

commit a13b9d0b97211579ea63b96c606de79b963c0f47 upstream.

The X86_CR4_FSGSBASE bit of CR4 should not change after boot[1]. Older
kernels should enforce this bit to zero, and newer kernels need to
enforce it depending on boot-time configuration (e.g. "nofsgsbase").
To support a pinned bit being either 1 or 0, use an explicit mask in
combination with the expected pinned bit values.

[1] https://lore.kernel.org/lkml/20200527103147.GI325280@hirez.programming.kicks-ass.net



Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/202006082013.71E29A42@keescook


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 96a80133

arch/x86/kernel/cpu/common.c

+12 −12
Original line number Diff line number Diff line
@@ -366,6 +366,9 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c) 
	cr4_clear_bits(X86_CR4_UMIP);

}



/* These bits should not change their value after CPU init is finished. */

static const unsigned long cr4_pinned_mask =

	X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP | X86_CR4_FSGSBASE;

static DEFINE_STATIC_KEY_FALSE_RO(cr_pinning);

static unsigned long cr4_pinned_bits __ro_after_init;
@@ -390,20 +393,20 @@ EXPORT_SYMBOL(native_write_cr0); 


void native_write_cr4(unsigned long val)

{

	unsigned long bits_missing = 0;

	unsigned long bits_changed = 0;



set_register:

	asm volatile("mov %0,%%cr4": "+r" (val), "+m" (cr4_pinned_bits));



	if (static_branch_likely(&cr_pinning)) {

		if (unlikely((val & cr4_pinned_bits) != cr4_pinned_bits)) {

			bits_missing = ~val & cr4_pinned_bits;

			val |= bits_missing;

		if (unlikely((val & cr4_pinned_mask) != cr4_pinned_bits)) {

			bits_changed = (val & cr4_pinned_mask) ^ cr4_pinned_bits;

			val = (val & ~cr4_pinned_mask) | cr4_pinned_bits;

			goto set_register;

		}

		/* Warn after we've set the missing bits. */

		WARN_ONCE(bits_missing, "CR4 bits went missing: %lx!?\n",

			  bits_missing);

		/* Warn after we've corrected the changed bits. */

		WARN_ONCE(bits_changed, "pinned CR4 bits changed: 0x%lx!?\n",

			  bits_changed);

	}

}

EXPORT_SYMBOL(native_write_cr4);
@@ -415,7 +418,7 @@ void cr4_init(void) 
	if (boot_cpu_has(X86_FEATURE_PCID))

		cr4 |= X86_CR4_PCIDE;

	if (static_branch_likely(&cr_pinning))

		cr4 |= cr4_pinned_bits;

		cr4 = (cr4 & ~cr4_pinned_mask) | cr4_pinned_bits;



	__write_cr4(cr4);
@@ -430,10 +433,7 @@ void cr4_init(void) 
 */

static void __init setup_cr_pinning(void)

{

	unsigned long mask;



	mask = (X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP);

	cr4_pinned_bits = this_cpu_read(cpu_tlbstate.cr4) & mask;

	cr4_pinned_bits = this_cpu_read(cpu_tlbstate.cr4) & cr4_pinned_mask;

	static_key_enable(&cr_pinning.key);

}