[PATCH v9 0/7] x86: Enable Supervisor Mode Access Prevention (SMAP)

[Feng Wu <feng.wu@intel.com>]

Supervisor Mode Access Prevention (SMAP) is a new security
feature disclosed by Intel, please refer to the following
document:

http://software.intel.com/sites/default/files/319433-014.pdf

Every access to a linear address is either a supervisor-mode
access or a user-mode access. All accesses performed while the
current privilege level (CPL) is less than 3 are supervisor-mode
accesses. If CPL = 3, accesses are generally user-mode accesses.
However, some operations implicitly access system data structures,
and the resulting accesses to those data structures are supervisor-mode
accesses regardless of CPL. Examples of such implicit supervisor
accesses include the following: accesses to the global descriptor
table (GDT) or local descriptor table (LDT) to load a segment descriptor;
accesses to the interrupt descriptor table (IDT) when delivering an
interrupt or exception; and accesses to the task-state segment (TSS) as
part of a task switch or change of CPL.

If CR4.SMAP = 1, supervisor-mode data accesses are not allowed
to linear addresses that are accessible in user mode. If CPL < 3,
SMAP protections are disabled if EFLAGS.AC = 1. If CPL = 3, SMAP
applies to all supervisor-mode data accesses (these are implicit
supervisor accesses) regardless of the value of EFLAGS.AC.

Version 1:
  * Add two macros for STAC/CLAC instructions
  * Temporary disable SMAP to legally access user pages in kernel mode
  * Enable Supervisor Mode Access Prevention (SMAP) for Xen itself
  * Add SMAP support to HVM guest
  * Disable SMAP feature when guest is in non-paging mode

Version 2:
  * Change the definition of ASM_STAC/ASM_CLAC.
  * Clear AC bit at the beginning of exception, interrup, hypercall.
  * Make construct_dom0() wrapped in a stac()/clac() part as a whole.
  * Reorder some patches in the series.
  * Combine some conditionals with SMEP.
  * Typo, etc. 

Version 3:
  * Clean-ups to ASM_STAC/ASM_CLAC
  * Enable SMAP after constructin domain 0
  * Move common_interrupt to entry.S
  * Remove ASM_CLAC calls in some places where exception happens
  * Correct the logic in hvm_vcpu_has_smep()/hvm_vcpu_has_smap() 
  * Make the output message more readable when SMAP violation happens
  * Use hvm_get_segment_register() to get the guest SS in guest_walk_tables()
  * Coding style changes, etc.

Version 4:
  * Use common macro CPUINFO_features instead of CPUINFO86_ext_features in xen/arch/x86/boot/head.S
  * Make ASM_STAC/ASM_CLAC common both in assembly and C code
  * Merge xen/include/asm-x86/x86_64/asm_defns.h into xen/include/asm-x86/asm_defns.h
  * Add a parameter to SAVE_ALL to include ASM_CALC in it optional
  * Remove ASM_STAC/ASM_CLAC pair in compat_create_bounce_frame, since in this chunk of code,
    it only accesses the pv guest's kernel stack, which is in ring 1 for 32-bit pv guests.
  * Call "setup_clear_cpu_cap(X86_FEATURE_SMAP)" before APs get brought up
  * Coding style changes.

Version 5:
  * Remove C verion of CPUINFO_FEATURE_OFFSET.
  * Implement clac()/stac() in C.
  * Set the default value of the parameter to 1 for macro SAVE_ALL.
  * Add const to the second parameter of __page_fault_type().
  * Clear SMAP bit in CR4 before construct_dom0() and set the bit back after it.
  * Coding style changes.

Version 6:
  * Add memory clobbers for clac()/stac()
  * Add ASM_CLAC at the beginning of ignore_int
  * Some comment changes

Version 7:
  Patch "x86: Clear AC bit in RFLAGS to protect Xen itself by SMAP"
    * Remove ASM_CLAC for machine_check
    * Add ASM_STAC/stac() for double_fault and fatal_trap()
    * set AC for MSR_SYSCALL_MASK after S3 resume
    * Make SAVE_ALL parameter a tristate, allowing both CLAC and STAC to be done right there

  Patch "x86: Temporary disable SMAP to legally access user pages in kernel mode"
    * Remove the unnecessary trailing semicolon for macro __put_user_asm, __get_user_asm, and __cmpxchg_user.

  Patch "x86: Enable Supervisor Mode Access Prevention (SMAP) for Xen"
    * Change some comments

  Patch "x86/hvm: Add SMAP support to HVM guest"
    * Pass ecx explicitly to hvm_cpuid() for CPUID.0x7

Version 8:
  Patch "x86: Clear AC bit in RFLAGS to protect Xen itself by SMAP"
    * Define XEN_SYSCALL_MASK for MSR_SYSCALL_MASK
    * Changes some comments
    * Tristate conversion for SAVE_ALL

Version 9:
  Patch "x86: Clear AC bit in RFLAGS to protect Xen itself by SMAP"
    * Add STAC for nmi_crash
    * Adjust the definition of SAVE_ALL

Feng Wu (7):
  x86: Add support for STAC/CLAC instructions
  x86: Clear AC bit in RFLAGS to protect Xen itself by SMAP
  x86: Temporary disable SMAP to legally access user pages in kernel
    mode
  VMX: Disable SMAP feature when guest is in non-paging mode
  x86: Enable Supervisor Mode Access Prevention (SMAP) for Xen
  x86/hvm: Add SMAP support to HVM guest
  x86/tools: Expose SMAP to HVM guests

 docs/misc/xen-command-line.markdown |  7 ++++
 tools/libxc/xc_cpufeature.h         |  1 +
 tools/libxc/xc_cpuid_x86.c          |  1 +
 xen/arch/x86/acpi/suspend.c         |  5 +--
 xen/arch/x86/boot/x86_64.S          |  2 +-
 xen/arch/x86/hvm/hvm.c              |  3 ++
 xen/arch/x86/hvm/vmx/vmx.c          |  6 +--
 xen/arch/x86/mm/guest_walk.c        | 40 +++++++++++++++-----
 xen/arch/x86/setup.c                | 20 ++++++++++
 xen/arch/x86/traps.c                | 73 +++++++++++++++++++++++++++++--------
 xen/arch/x86/usercopy.c             |  6 +++
 xen/arch/x86/x86_64/compat/entry.S  |  1 +
 xen/arch/x86/x86_64/entry.S         | 16 +++++---
 xen/arch/x86/x86_64/traps.c         |  5 +--
 xen/include/asm-x86/asm_defns.h     | 43 +++++++++++++++++++++-
 xen/include/asm-x86/cpufeature.h    |  1 +
 xen/include/asm-x86/domain.h        |  6 ++-
 xen/include/asm-x86/hvm/hvm.h       | 22 +++++++++--
 xen/include/asm-x86/processor.h     |  4 ++
 xen/include/asm-x86/uaccess.h       |  8 +++-
 xen/include/asm-x86/x86_64/system.h |  4 +-
 21 files changed, 223 insertions(+), 51 deletions(-)

-- 
1.8.3.1