linux-kernel - [RFC PATCH 0/7] SVM guest shadow stack support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221012203910.204793-1-john.allen@amd.com>
Date:   Wed, 12 Oct 2022 20:39:03 +0000
From:   John Allen <john.allen@....com>
To:     <kvm@...r.kernel.org>
CC:     <linux-kernel@...r.kernel.org>, <pbonzini@...hat.com>,
        <weijiang.yang@...el.com>, <rick.p.edgecombe@...el.com>,
        <seanjc@...gle.com>, <x86@...nel.org>, <thomas.lendacky@....com>,
        John Allen <john.allen@....com>
Subject: [RFC PATCH 0/7] SVM guest shadow stack support

AMD Zen3 and newer processors support shadow stack, a feature designed to
protect against ROP (return-oriented programming) attacks in which an attacker
manipulates return addresses on the call stack in order to execute arbitrary
code. To prevent this, shadow stacks can be allocated that are only used by
control transfer and return instructions. When a CALL instruction is issued, it
writes the return address to both the program stack and the shadow stack. When
the subsequent RET instruction is issued, it pops the return address from both
stacks and compares them. If the addresses don't match, a control-protection
exception is raised.

Shadow stack and a related feature, Indirect Branch Tracking (IBT), are
collectively referred to as Control-flow Enforcement Technology (CET). However,
current AMD processors only support shadow stack and not IBT.

This series adds support for shadow stack in SVM guests and builds upon the
support added in the CET guest support patch series [1] and the CET kernel
patch series [2]. Additional patches are required to support shadow stack
enabled guests in qemu [3] and glibc [4].

[1]: CET guest support patches
https://lore.kernel.org/all/20220616084643.19564-1-weijiang.yang@intel.com/

[2]: Latest CET kernel patches
https://lore.kernel.org/all/20220929222936.14584-1-rick.p.edgecombe@intel.com/

[3]: CET qemu patches
https://patchwork.ozlabs.org/project/qemu-devel/patch/20201013051935.6052-2-weijiang.yang@intel.com/

[4]: glibc tree containing necessary updates
https://gitlab.com/x86-glibc/glibc/-/tree/users/hjl/cet/master/

John Allen (7):
  KVM: x86: Move shared CET routine to common x86 kvm code
  KVM: x86: SVM: Emulate reads and writes to shadow stack MSRs
  KVM: x86: SVM: Update dump_vmcb with shadow stack save area additions
  KVM: x86: SVM: Pass through shadow stack MSRs
  KVM: SVM: Save shadow stack host state on VMRUN
  KVM: SVM: Add MSR_IA32_XSS to the GHCB for hypervisor kernel
  KVM: SVM: Add CET features to supported_xss

 arch/x86/include/asm/svm.h |  1 +
 arch/x86/kvm/svm/sev.c     | 25 ++++++++++-
 arch/x86/kvm/svm/svm.c     | 85 ++++++++++++++++++++++++++++++++++++++
 arch/x86/kvm/svm/svm.h     |  2 +-
 arch/x86/kvm/vmx/vmx.c     | 32 ++------------
 arch/x86/kvm/x86.c         | 26 ++++++++++++
 arch/x86/kvm/x86.h         |  2 +
 7 files changed, 141 insertions(+), 32 deletions(-)

-- 
2.34.3