linux-kernel - [tboot-devel] [PATCH 1/1] Disable CET when calling tboot shutdown procedure.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251017073619.547993-1-michal.camacho.romero@linux.intel.com>
Date: Thu, 13 Nov 2025 09:37:14 -0500
From: Tony Camuso <tcamuso@...hat.com>
To: ning.sun@...el.com,
	tboot-devel@...ts.sourceforge.net
Cc: linux-kernel@...r.kernel.org,
	rppt@...nel.org,
	tglx@...utronix.de,
	mingo@...nel.org,
	bp@...en8.de,
	michal.camacho.romero@...ux.intel.com
Subject: [tboot-devel] [PATCH 1/1] Disable CET when calling tboot shutdown procedure.

From: Michal Camacho Romero <michal.camacho.romero@...ux.intel.com>

From: Mark Gross <mgross@...ux.intel.com>

The tboot->shutdown_entry is effectively bios code and CET needs to be
disabled before calling it.

It resolves TBOOT shutdown failure bug, reported on the SLES (SUSE Linux
Enterprise Server) 16.0 OS. OS power off, called by the "init 0" command,
was failing, due to activated Intel Control-Flow Enforcement Technology
(CET).
Disabling CET has allowed to execute OS and TBOOT shutdown properly.

Closes: https://bugzilla.suse.com/show_bug.cgi?id=1247950
Signed-off-by: Mark Gross <mgross@...ux.intel.com>
Signed-off-by: Michal Camacho Romero <michal.camacho.romero@...ux.intel.com>
Tested-by: Tony Camuso <tcamuso@...hat.com>
---
 arch/x86/kernel/tboot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index 4c1bcb6053fc..932c2c44e743 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -28,6 +28,7 @@
 #include <asm/setup.h>
 #include <asm/e820/api.h>
 #include <asm/io.h>
+#include <asm/cpu.h>
 
 #include "../realmode/rm/wakeup.h"
 
@@ -248,6 +249,10 @@ void tboot_shutdown(u32 shutdown_type)
 
 	switch_to_tboot_pt();
 
+	/*
+	 * toggle off CET while we call shutdown_entry in bios
+	 */
+	cet_disable();
 	shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
 	shutdown();
 
-- 
2.47.1