[PATCH] x86: Copy IBT and SHSTK usable only if CET is enabled

["H.J. Lu" <hjl.tools@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1291 bytes --]

On Wed, Jun 23, 2021 at 2:15 PM Adhemerval Zanella
<adhemerval.zanella@linaro.org> wrote:
>
>
>
> On 23/06/2021 17:41, H.J. Lu wrote:
> >> @@ -216,12 +233,15 @@ do_test (int argc, char **argv)
> >>    fails += CHECK_PROC (sgx, SGX);
> >>    fails += CHECK_PROC (sgx_lc, SGX_LC);
> >>    fails += CHECK_PROC (sha_ni, SHA);
> >> -  fails += CHECK_PROC (shstk, SHSTK);
> >> +  fails += CHECK_PROC_OPTIN (shstk, SHSTK);
> >
> > Why do you need this?  If kernel doesn't support SHSTK, it will be
> > turned off:
> >
> >  /* Check CET status.  */
> >   unsigned int cet_status = get_cet_status ();
> >
> >   if ((cet_status & GNU_PROPERTY_X86_FEATURE_1_IBT) == 0)
> >     CPU_FEATURE_UNSET (cpu_features, IBT)
> >   if ((cet_status & GNU_PROPERTY_X86_FEATURE_1_SHSTK) == 0)
> >     CPU_FEATURE_UNSET (cpu_features, SHSTK)
>
> The problem is this is only enabled for CET_ENABLED, the configuration I am using
> does not define __CET__.  So the CPU I am using does support SHSTK, but the bit
> ended up not being cleared by glibc.

IBT and SHSTK usable bits are copied from CPUID feature bits and later
cleared if kernel doesn't support CET.  Copy IBT and SHSTK usable only
if CET is enabled so that they aren't set on CET capable processors
with non-CET enabled glibc.

Can you try this?

-- 
H.J.

[-- Attachment #2: 0001-x86-Copy-IBT-and-SHSTK-usable-only-if-CET-is-enabled.patch --]
[-- Type: text/x-patch, Size: 1958 bytes --]

From 976f4e2b9cb6e0766123a1cc3c2dc4c4339e0e75 Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Wed, 23 Jun 2021 14:27:58 -0700
Subject: [PATCH] x86: Copy IBT and SHSTK usable only if CET is enabled

IBT and SHSTK usable bits are copied from CPUID feature bits and later
cleared if kernel doesn't support CET.  Copy IBT and SHSTK usable only
if CET is enabled so that they aren't set on CET capable processors
with non-CET enabled glibc.
---
 sysdeps/x86/cpu-features.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
index 81275dbdfa..a1d8d11cc4 100644
--- a/sysdeps/x86/cpu-features.c
+++ b/sysdeps/x86/cpu-features.c
@@ -76,7 +76,6 @@ update_usable (struct cpu_features *cpu_features)
   CPU_FEATURE_SET_USABLE (cpu_features, PREFETCHWT1);
   CPU_FEATURE_SET_USABLE (cpu_features, OSPKE);
   CPU_FEATURE_SET_USABLE (cpu_features, WAITPKG);
-  CPU_FEATURE_SET_USABLE (cpu_features, SHSTK);
   CPU_FEATURE_SET_USABLE (cpu_features, GFNI);
   CPU_FEATURE_SET_USABLE (cpu_features, RDPID);
   CPU_FEATURE_SET_USABLE (cpu_features, RDRAND);
@@ -86,7 +85,6 @@ update_usable (struct cpu_features *cpu_features)
   CPU_FEATURE_SET_USABLE (cpu_features, FSRM);
   CPU_FEATURE_SET_USABLE (cpu_features, SERIALIZE);
   CPU_FEATURE_SET_USABLE (cpu_features, TSXLDTRK);
-  CPU_FEATURE_SET_USABLE (cpu_features, IBT);
   CPU_FEATURE_SET_USABLE (cpu_features, LAHF64_SAHF64);
   CPU_FEATURE_SET_USABLE (cpu_features, LZCNT);
   CPU_FEATURE_SET_USABLE (cpu_features, SSE4A);
@@ -99,6 +97,11 @@ update_usable (struct cpu_features *cpu_features)
   CPU_FEATURE_SET_USABLE (cpu_features, FSRCS);
   CPU_FEATURE_SET_USABLE (cpu_features, PTWRITE);
 
+#if CET_ENABLED
+  CPU_FEATURE_SET_USABLE (cpu_features, IBT);
+  CPU_FEATURE_SET_USABLE (cpu_features, SHSTK);
+#endif
+
   /* Can we call xgetbv?  */
   if (CPU_FEATURES_CPU_P (cpu_features, OSXSAVE))
     {
-- 
2.31.1