Re: [PATCH v2 18/39] x86/ibt: Add IBT feature, MSR and #CP handling

[Edgecombe, Rick P]

On Tue, 2022-03-01 at 15:13 -0800, Josh Poimboeuf wrote:
> On Tue, Mar 01, 2022 at 10:02:45PM +0100, Peter Zijlstra wrote:
> > On Tue, Mar 01, 2022 at 04:14:42PM +0100, Peter Zijlstra wrote:
> > 
> > > Something like so?
> > > 
> > > diff --git a/arch/x86/kernel/relocate_kernel_64.S
> > > b/arch/x86/kernel/relocate_kernel_64.S
> > > index 399f075ccdc4..5b65f6ec5ee6 100644
> > > --- a/arch/x86/kernel/relocate_kernel_64.S
> > > +++ b/arch/x86/kernel/relocate_kernel_64.S
> > > @@ -114,6 +114,14 @@
> > > SYM_CODE_START_LOCAL_NOALIGN(identity_mapped)
> > >      /* store the start address on the stack */
> > >      pushq   %rdx
> > >   
> > > +   /*
> > > +    * Clear X86_CR4_CET (if it was set) such that we can clear
> > > CR0_WP
> > > +    * below.
> > > +    */
> > > +   movq    %cr4, %rax
> > > +   andq    $~(X86_CR4_CET), %rax
> > > +   movq    %rax, %cr4
> > > +
> > >      /*
> > >       * Set cr0 to a known state:
> > >       *  - Paging enabled
> > 
> > I *think* it worked, I 'apt install kexec-tools' and copied the
> > magic
> > commands Josh gave over IRC and the machine went and came back real
> > quick.
> > 
> > Lacking useful console I can't say much more.
> > 
> > I pushed out a version with these things on.
> 
> I just used your latest git tree, kexec into a non-IBT kernel worked
> for
> me as well.

I copied this over to the userspace series and it worked where it
failed before. And looking at the code, it seems like it should work as
well. 

As for pinning strength, I'm not understanding this kexec asm enough to
say for sure how much better it is than just removing the bit from the
pinning mask. I think some future hardening around preventing turning
off IBT might still be worthwhile.

Kees, I think you brought up the pinning, what do you think of this?