linux-kernel - Re: [RFC PATCH 0/7] SVM guest shadow stack support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <14db7a0b-b993-8d51-da94-893a2975f7ac@amd.com>
Date:   Wed, 25 Jan 2023 11:07:26 -0600
From:   John Allen <john.allen@....com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        pbonzini@...hat.com, weijiang.yang@...el.com,
        rick.p.edgecombe@...el.com, x86@...nel.org, thomas.lendacky@....com
Subject: Re: [RFC PATCH 0/7] SVM guest shadow stack support

On 1/24/23 6:55 PM, Sean Christopherson wrote:
> On Wed, Oct 12, 2022, John Allen wrote:
>> AMD Zen3 and newer processors support shadow stack, a feature designed to
>> protect against ROP (return-oriented programming) attacks in which an attacker
>> manipulates return addresses on the call stack in order to execute arbitrary
>> code. To prevent this, shadow stacks can be allocated that are only used by
>> control transfer and return instructions. When a CALL instruction is issued, it
>> writes the return address to both the program stack and the shadow stack. When
>> the subsequent RET instruction is issued, it pops the return address from both
>> stacks and compares them. If the addresses don't match, a control-protection
>> exception is raised.
>>
>> Shadow stack and a related feature, Indirect Branch Tracking (IBT), are
>> collectively referred to as Control-flow Enforcement Technology (CET). However,
>> current AMD processors only support shadow stack and not IBT.
>>
>> This series adds support for shadow stack in SVM guests and builds upon the
>> support added in the CET guest support patch series [1] and the CET kernel
>> patch series [2]. Additional patches are required to support shadow stack
>> enabled guests in qemu [3] and glibc [4].
>>
>> [1]: CET guest support patches
>> https://lore.kernel.org/all/20220616084643.19564-1-weijiang.yang@intel.com/
>>
>> [2]: Latest CET kernel patches
>> https://lore.kernel.org/all/20220929222936.14584-1-rick.p.edgecombe@intel.com/
> 
> That dependency chain makes me sad.
> 
> Outside of a very shallow comment on the last patch, I don't plan on reviewing
> this until the kernel side of things gets out of our way.  When that finally
> does happen, I'll definitely prioritize reviewing and merging this and the KVM
> Intel series.  I'd love to see this land.
> 
> Sorry :-(

Thanks Sean, understood. This submission is mainly for community awareness,
but any feedback we can get now prior to the main kernel series getting
merged is much appreciated. This would give us a longer lead on addressing
any concerns that the community might have and potentially allow us to get
this in more quickly when the kernel series has been merged.

Thanks,
John