Re: [PATCH v15 03/26] x86/fpu/xstate: Introduce CET MSR XSAVES supervisor states

Borislav Petkov
2020-11-26T11:02:36Z

On Tue, Nov 10, 2020 at 08:21:48AM -0800, Yu-cheng Yu wrote:
> diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
> index 972a34d93505..6f05ab2a1fa4 100644
> --- a/arch/x86/include/asm/msr-index.h
> +++ b/arch/x86/include/asm/msr-index.h
> @@ -922,4 +922,24 @@
> #define MSR_VM_IGNNE 0xc0010115
> #define MSR_VM_HSAVE_PA 0xc0010117
>
> +/* Control-flow Enforcement Technology MSRs */
> +#define MSR_IA32_U_CET 0x6a0 /* user mode cet setting */
> +#define MSR_IA32_S_CET 0x6a2 /* kernel mode cet setting */
> +#define MSR_IA32_PL0_SSP 0x6a4 /* kernel shstk pointer */
> +#define MSR_IA32_PL1_SSP 0x6a5 /* ring-1 shstk pointer */
> +#define MSR_IA32_PL2_SSP 0x6a6 /* ring-2 shstk pointer */
> +#define MSR_IA32_PL3_SSP 0x6a7 /* user shstk pointer */
> +#define MSR_IA32_INT_SSP_TAB 0x6a8 /* exception shstk table */
> +
> +/* MSR_IA32_U_CET and MSR_IA32_S_CET bits */

Pls put the bit defines under the MSRs they belong to.

> +#define CET_SHSTK_EN BIT_ULL(0)
> +#define CET_WRSS_EN BIT_ULL(1)
> +#define CET_ENDBR_EN BIT_ULL(2)
> +#define CET_LEG_IW_EN BIT_ULL(3)
> +#define CET_NO_TRACK_EN BIT_ULL(4)
> +#define CET_SUPPRESS_DISABLE BIT_ULL(5)
> +#define CET_RESERVED (BIT_ULL(6) | BIT_ULL(7) | BIT_ULL(8) | BIT_ULL(9))
> +#define CET_SUPPRESS BIT_ULL(10)
> +#define CET_WAIT_ENDBR BIT_ULL(11)

...

> * Clear XSAVE features that are disabled in the normal CPUID.
> */
> for (i = 0; i < ARRAY_SIZE(xsave_cpuid_features); i++) {
> - if (!boot_cpu_has(xsave_cpuid_features[i]))
> - xfeatures_mask_all &= ~BIT_ULL(i);
> + if (xsave_cpuid_features[i] == X86_FEATURE_SHSTK) {
> + /*
> + * X86_FEATURE_SHSTK and X86_FEATURE_IBT share
> + * same states, but can be enabled separately.
> + */
> + if (!boot_cpu_has(X86_FEATURE_SHSTK) &&
> + !boot_cpu_has(X86_FEATURE_IBT))
> + xfeatures_mask_all &= ~BIT_ULL(i);
> + } else {
> + if ((xsave_cpuid_features[i] == -1) ||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

That is a new check. I guess it could be done first to simplify the
code:

for (i = 0; i < ARRAY_SIZE(xsave_cpuid_features); i++) {
if (xsave_cpuid_features[i] == -1) {
xfeatures_mask_all &= ~BIT_ULL(i);
continue;
}

/* the rest of the bla */

Yes?

--
Regards/Gruss,
Boris.