Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 1 Aug 2023 09:28:11 -0700
In-Reply-To: <ZMkie3B7obtTTpLu@johallen-workstation>
Mime-Version: 1.0
References: <20230524155339.415820-1-john.allen@amd.com> <20230524155339.415820-5-john.allen@amd.com>
 <ZJYKksVIORhPtD6T@google.com> <ZMkie3B7obtTTpLu@johallen-workstation>
Message-ID: <ZMkymz22bHTsFCTD@google.com>
Subject: Re: [RFC PATCH v2 4/6] KVM: SVM: Save shadow stack host state on VMRUN
From:   Sean Christopherson <seanjc@google.com>
To:     John Allen <john.allen@amd.com>
Cc:     kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
        pbonzini@redhat.com, weijiang.yang@intel.com,
        rick.p.edgecombe@intel.com, x86@kernel.org,
        thomas.lendacky@amd.com, bp@alien8.de
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

On Tue, Aug 01, 2023, John Allen wrote:
> On Fri, Jun 23, 2023 at 02:11:46PM -0700, Sean Christopherson wrote:
> > On Wed, May 24, 2023, John Allen wrote:
> > As for the values themselves, the kernel doesn't support Supervisor Shadow Stacks
> > (SSS), so PL0-2_SSP are guaranteed to be zero.  And if/when SSS support is added,
> > I doubt the kernel will ever use PL1_SSP or PL2_SSP, so those can probably be
> > ignored entirely, and PL0_SSP might be constant per task?  In other words, I don't
> > see any reason to try and track the host values for support that doesn't exist,
> > just do what VMX does for BNDCFGS and yell if the MSRs are non-zero.  Though for
> > SSS it probably makes sense for KVM to refuse to load (KVM continues on for BNDCFGS
> > because it's a pretty safe assumption that the kernel won't regain MPX supported).
> > 
> > E.g. in rough pseudocode
> > 
> > 	if (boot_cpu_has(X86_FEATURE_SHSTK)) {
> > 		rdmsrl(MSR_IA32_PLx_SSP, host_plx_ssp);
> > 
> > 		if (WARN_ON_ONCE(host_pl0_ssp || host_pl1_ssp || host_pl2_ssp))
> > 			return -EIO;
> > 	}
> 
> The function in question returns void and wouldn't be able to return a
> failure code to callers. We would have to rework this path in order to
> fail in this way. Is it sufficient to just WARN_ON_ONCE here or is there
> some other way we can cause KVM to fail to load here?

Sorry, I should have been more explicit than "it probably make sense for KVM to
refuse to load".  The above would go somewhere in __kvm_x86_vendor_init().