Re: [GIT pull] x86/asm for 5.1

[Kees Cook]

On Mon, Mar 11, 2019 at 10:41 AM Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> Yes, that would fix things too, although I suspect you'll find that it
> gets hairy for hotplug CPU's (including suspend/resume), because new
> CPU's keep booting "forever".

In my testing, hotplug wasn't a problem because we'd already finished
cpu feature detection (which is why the SMEP/SMAP/UMIP bits couldn't
just be hard-coded). I had chosen to wait until after feature
detection was finished, etc.

> So what might be workable is to make 'cr4_init_shadow()' itself just
> do something like
>
>         this_cpu_write(cpu_tlbstate.cr4, __read_cr4() | cr4_pin);
>
> but I did *not* check whether there might be some other random
> accesses to %cr4 in various legacy paths..

The protection needs to be around the actual "mov %rdi, %cr4" that
native_write_cr4() exposes, so the "or" can't really be placed
earlier. Anyway, I'll examine some options. Thomas also suggested
looking at static keys, etc. I'll play around with it.

--
Kees Cook