Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 30 Mar 2023 14:47:46 -0500
From:   John Allen <john.allen@amd.com>
To:     "Yang, Weijiang" <weijiang.yang@intel.com>
Cc:     "thomas.lendacky@amd.com" <thomas.lendacky@amd.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "x86@kernel.org" <x86@kernel.org>, Borislav Petkov <bp@alien8.de>,
        "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>,
        "Christopherson, Sean" <seanjc@google.com>
Subject: Re: [RFC PATCH 0/7] SVM guest shadow stack support
Message-ID: <ZCXnYj3GsoB1Kipo@johallen-workstation.lan>
References: <20221012203910.204793-1-john.allen@amd.com>
 <Y9B97dZnFnjEHhVf@google.com>
 <d4e15021af4e72d6daba4021feaebf289b676830.camel@intel.com>
 <ZCMpJLAx8//1zLLV@johallen-workstation.lan>
 <b75c6f20-a99c-a6d4-c1c1-7ae9f016d2af@intel.com>
 <9cf73a9d-d9eb-c6a6-a083-88539a3e78a2@intel.com>
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <9cf73a9d-d9eb-c6a6-a083-88539a3e78a2@intel.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?iso-8859-1?Q?yvr4FfxilCQlHGy5bOEKYOP3mqDFU9OqjmsJd3la2q8bPI56Mklpgt1INf?=
 =?iso-8859-1?Q?oQJ8KBFrzmeBYjuPhNfoG4EuaGSyjzHMsBTWJqBpiO6Qf47yFImevxpxoj?=
 =?iso-8859-1?Q?jHu26zHUozeTLZV4klMSiuCiKHP0hqcHFrGuvcAW02EKYdJZjmwCxua8yF?=
 =?iso-8859-1?Q?YLYGoJztmwJ2jROv3zHpYVeUOdLD9j0bzMlkAZSIOiQY+L15jpZHHAgrrw?=
 =?iso-8859-1?Q?ycDz9Ey7neYJZba6j0hRpikycsXB1/M6t7Svq4H/xACXHxKDQuLkg/lsKc?=
 =?iso-8859-1?Q?GvPc+fWqKWZCnYhg+l0YAV06Q1QPhprVP0WzVITihpSLcEhrPtrEvNJCpO?=
 =?iso-8859-1?Q?cehiUSrckTIp51MwF4I8Rh/jaydAAHauZl6ZvuDd7U55y7ewH7VIvTcNmt?=
 =?iso-8859-1?Q?49BGMRobOgG+4HhsWhxMOdeJEVrpSgU+S8f3HN+QjVDiDLsZr9XsVypy0p?=
 =?iso-8859-1?Q?i5D06xCwDPL180hUq90vu/wKCitDFAkdfCbspXwNdaFEg+Kda8prFgmYnp?=
 =?iso-8859-1?Q?W4fLG6HwPGOtRy9gYbqlrwkMNK3rzpNqpL5BEizsKdXjJKWnxrsiZFABV2?=
 =?iso-8859-1?Q?ZM8U7gt3FFUgMIvPMaOC26bZOfEJMhGOvYq5zRfLS/rIzAAwLcacl7wkk2?=
 =?iso-8859-1?Q?IlKHXv7J+zat6LwIK+2nGEerZGC4+0bw6A7+dYehmNKnhBrCGCbKpUnWgb?=
 =?iso-8859-1?Q?0B/URA2TbHa9DrXecQff21Md4fcZSzhY4E5znqJo8drbSrSwVqWnXcTobU?=
 =?iso-8859-1?Q?7aourQh0OoyNg+w/42Er9v+/jnbYLmI0fEG03KWWrqi5f5SJgW5ikkda/Q?=
 =?iso-8859-1?Q?Sg8jRsFstNOXh56Vr7VVd1bGczxfPg9c7CuL4z2qH7XmgK5ab971K9wJz1?=
 =?iso-8859-1?Q?B7hD1R1W8cO41U0dTGXOozemoSJWetQgiT/RkpBtNl91aGkI0T/qQNzmqV?=
 =?iso-8859-1?Q?M02xN1J3gTCrWaRBX0XoDV6kpURAstMkAiKArU23Lr9u2qBkvXonhAwlkN?=
 =?iso-8859-1?Q?9eSb2tpbJXD/jpq7IkqUAvpCm4o2Ee6tAAVg2gpeTwBP92LZTUqMpWcR1O?=
 =?iso-8859-1?Q?iFxEDK5mTweOKDhDBQMn4ahz+GoCp4qvBvTfE2RAg0Cku/wqGu3GANZ1hH?=
 =?iso-8859-1?Q?SbxNOCmKEa2o3GrYRTcvVNb/OsWEK75urgdp8D5WSZtQPgWVFYrP8Np83X?=
 =?iso-8859-1?Q?cvvkikG15odN0tTP93ArlOqmFKLgQbRQmRkHvFRqWKAzv7AU4BPC5lZ0fd?=
 =?iso-8859-1?Q?g05SDMHG73be3kznWlvHfBC6uE32hf1xIAxvSPqvQb15nkq6x+V30tKrlf?=
 =?iso-8859-1?Q?va5Gah6Z+1j7iKLvYC+FeP1DLHl5GLG2tLAYWLpm04FUJyx/e3Kmuflsma?=
 =?iso-8859-1?Q?rZjAjkRV4E5JBrwRGi8ZYh7xzyE7cLTSgoKKXGCf2fYlDs+yaAbOS49F9E?=
 =?iso-8859-1?Q?V25/PQIN18SiCRy3MMLp8HRWX7mprKb7QLAaai2uY1Z/dKqnIZjmE8L+TN?=
 =?iso-8859-1?Q?Y3Hfl+WJH9LwgqodC4AmTeqht53EwIB3Nhmru4qXcBtKzLwdMClVdrntMK?=
 =?iso-8859-1?Q?bNzCRr+FjUTVVa98zsZN3yXHMdl3JME6NvZ036+wiISutp39rhPOr+O2iq?=
 =?iso-8859-1?Q?viZOSCQUba9uzMFE2yIzWd1ow1YgMX6cRX?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6d15ef40-7daa-4abd-de17-08db3157af36
X-MS-Exchange-CrossTenant-AuthSource: BL1PR12MB5995.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Mar 2023 19:48:07.7465
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: avZpZFEx6oznhqB0Me9Nfc+0sPF7HcHdKKVTu5zhUiZHKoc22HVwTwEGnHqlu+EJayfi2Z3HgimRhcQzJVDGTw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ1PR12MB6265
X-Spam-Status: No, score=0.2 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED,
        FORGED_SPF_HELO,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,
        SPF_NONE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Mar 30, 2023 at 01:37:38PM +0800, Yang, Weijiang wrote:
> 
> On 3/29/2023 8:16 AM, Yang, Weijiang wrote:
> > 
> > On 3/29/2023 1:51 AM, John Allen wrote:
> > > On Wed, Jan 25, 2023 at 01:11:44AM +0000, Edgecombe, Rick P wrote:
> > > > On Wed, 2023-01-25 at 00:55 +0000, Sean Christopherson wrote:
> > > > > On Wed, Oct 12, 2022, John Allen wrote:
> > > > > > AMD Zen3 and newer processors support shadow stack, a feature
> > > > > > designed to
> > > > > > protect against ROP (return-oriented programming) attacks in which
> > > > > > an attacker
> > > > > > manipulates return addresses on the call stack in order to execute
> > > > > > arbitrary
> > > > > > code. To prevent this, shadow stacks can be allocated that are only
> > > > > > used by
> > > > > > control transfer and return instructions. When a CALL instruction
> > > > > > is issued, it
> > > > > > writes the return address to both the program stack and the shadow
> > > > > > stack. When
> > > > > > the subsequent RET instruction is issued, it pops the return
> > > > > > address from both
> > > > > > stacks and compares them. If the addresses don't match, a control-
> > > > > > protection
> > > > > > exception is raised.
> > > > > > 
> > > > > > Shadow stack and a related feature, Indirect Branch Tracking (IBT),
> > > > > > are
> > > > > > collectively referred to as Control-flow Enforcement Technology
> > > > > > (CET). However,
> > > > > > current AMD processors only support shadow stack and not IBT.
> > > > > > 
> > > > > > This series adds support for shadow stack in SVM guests and builds
> > > > > > upon the
> > > > > > support added in the CET guest support patch series [1] and the CET
> > > > > > kernel
> > > > > > patch series [2]. Additional patches are required to support shadow
> > > > > > stack
> > > > > > enabled guests in qemu [3] and glibc [4].
> > > > > > 
> > > > > > [1]: CET guest support patches
> > > > > > 
> > > > https://lore.kernel.org/all/20220616084643.19564-1-weijiang.yang@intel.com/
> > > > 
> > > > > > [2]: Latest CET kernel patches
> > > > > > 
> > > > https://lore.kernel.org/all/20220929222936.14584-1-rick.p.edgecombe@intel.com/
> > > > 
> > > > > That dependency chain makes me sad.
> > > > > 
> > > > > Outside of a very shallow comment on the last patch, I don't plan on
> > > > > reviewing
> > > > > this until the kernel side of things gets out of our way. When that
> > > > > finally
> > > > > does happen, I'll definitely prioritize reviewing and merging this
> > > > > and the KVM
> > > > > Intel series.? I'd love to see this land.
> > > > I think all KVM needs is a few patches from the beginning of the host
> > > > series (the FPU stuff). At one point Weijiang and I had discussed with
> > > > Paolo and x86 folks that those few could go up with the KVM series if
> > > > desired.
> > > Now that the baremetal series has been accepted, how do we want to
> > > proceed? I think I'd like to send a refreshed version based on the
> > > version that was accpeted, but I'd want to wait to base it on a new
> > > version of Weijiang's kvm/vmx series (if one is planned).
> > > 
> > > Weijiang and Rick,
> > > 
> > > Are you planning on sending a new version of the kvm/vmx series?
> > 
> > Hi, Allen,
> > 
> > Yes, I'm working on the new version of kvm/vmx series, will cc you when
> > 
> > send it to community.
> 
> Patch 1/7 did what I wanted to implement to support AMD SHSTK, my next
> version
> 
> will continue refactoring them in vmx scope, then? your series may pick up
> the helper
> 
> and modify accordingly.
> 
> Please note, in my series, I removed check for MSR_IA32_PL{0,1,2}_SSP since
> they're
> 
> not supported right now, but your series supports for the MSRs, so you have
> to change
> 
> the helper a bit to adapt to your patches.

The reason we decided to include the PL{0,1,2}_SSP MSRs is that even
though linux doesn't support supervisor shadow stack, a non-linux guest
OS might support it and could make use of the MSRs. It could be
something the vmx patches might want to account for as well 

Thanks,
John