linux-kernel - Re: [PATCH v16 21/51] KVM: x86/mmu: WARN on attempt to check permissions for Shadow Stack #PF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b12cac74-5a08-4338-bbab-510860e11a30@linux.intel.com>
Date: Mon, 22 Sep 2025 15:46:37 +0800
From: Binbin Wu <binbin.wu@...ux.intel.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
 linux-kernel@...r.kernel.org, Tom Lendacky <thomas.lendacky@....com>,
 Mathias Krause <minipli@...ecurity.net>, John Allen <john.allen@....com>,
 Rick Edgecombe <rick.p.edgecombe@...el.com>, Chao Gao <chao.gao@...el.com>,
 Xiaoyao Li <xiaoyao.li@...el.com>, Maxim Levitsky <mlevitsk@...hat.com>,
 Zhang Yi Z <yi.z.zhang@...ux.intel.com>, Xin Li <xin@...or.com>
Subject: Re: [PATCH v16 21/51] KVM: x86/mmu: WARN on attempt to check
 permissions for Shadow Stack #PF



On 9/22/2025 3:17 PM, Binbin Wu wrote:
>
>
> On 9/20/2025 6:32 AM, Sean Christopherson wrote:
>> Add PFERR_SS_MASK, a.k.a. Shadow Stack access, and WARN if KVM attempts to
>> check permissions for a Shadow Stack access as KVM hasn't been taught to
>> understand the magic Writable=0,Dirty=0 combination that is required for
Typo:

Writable=0,Dirty=0 -> Writable=0,Dirty=1

>> Shadow Stack accesses, and likely will never learn.  There are no plans to
>> support Shadow Stacks with the Shadow MMU, and the emulator rejects all
>> instructions that affect Shadow Stacks, i.e. it should be impossible for
>> KVM to observe a #PF due to a shadow stack access.
>>
>> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
>
> Reviewed-by: Binbin Wu <binbin.wu@...ux.intel.com>
>
>> ---
>>   arch/x86/include/asm/kvm_host.h | 1 +
>>   arch/x86/kvm/mmu.h              | 2 +-
>>   2 files changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
>> index 7a7e6356a8dd..554d83ff6135 100644
>> --- a/arch/x86/include/asm/kvm_host.h
>> +++ b/arch/x86/include/asm/kvm_host.h
>> @@ -267,6 +267,7 @@ enum x86_intercept_stage;
>>   #define PFERR_RSVD_MASK        BIT(3)
>>   #define PFERR_FETCH_MASK    BIT(4)
>>   #define PFERR_PK_MASK        BIT(5)
>> +#define PFERR_SS_MASK        BIT(6)
>>   #define PFERR_SGX_MASK        BIT(15)
>>   #define PFERR_GUEST_RMP_MASK    BIT_ULL(31)
>>   #define PFERR_GUEST_FINAL_MASK    BIT_ULL(32)
>> diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
>> index b4b6860ab971..f63074048ec6 100644
>> --- a/arch/x86/kvm/mmu.h
>> +++ b/arch/x86/kvm/mmu.h
>> @@ -212,7 +212,7 @@ static inline u8 permission_fault(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
>>         fault = (mmu->permissions[index] >> pte_access) & 1;
>>   -    WARN_ON(pfec & (PFERR_PK_MASK | PFERR_RSVD_MASK));
>> +    WARN_ON_ONCE(pfec & (PFERR_PK_MASK | PFERR_SS_MASK | PFERR_RSVD_MASK));
>>       if (unlikely(mmu->pkru_mask)) {
>>           u32 pkru_bits, offset;
>
>