linux-kernel - Re: [PATCH v16 13/51] KVM: x86: Enable guest SSP read/write interface with new uAPIs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d4f42030-2e83-4a30-a74a-e8107fc5cb12@intel.com>
Date: Tue, 23 Sep 2025 17:06:45 +0800
From: Xiaoyao Li <xiaoyao.li@...el.com>
To: Sean Christopherson <seanjc@...gle.com>,
 Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Tom Lendacky <thomas.lendacky@....com>,
 Mathias Krause <minipli@...ecurity.net>, John Allen <john.allen@....com>,
 Rick Edgecombe <rick.p.edgecombe@...el.com>, Chao Gao <chao.gao@...el.com>,
 Binbin Wu <binbin.wu@...ux.intel.com>, Maxim Levitsky <mlevitsk@...hat.com>,
 Zhang Yi Z <yi.z.zhang@...ux.intel.com>, Xin Li <xin@...or.com>
Subject: Re: [PATCH v16 13/51] KVM: x86: Enable guest SSP read/write interface
 with new uAPIs

On 9/20/2025 6:32 AM, Sean Christopherson wrote:
> From: Yang Weijiang<weijiang.yang@...el.com>
> 
> Add a KVM-defined ONE_REG register, KVM_REG_GUEST_SSP, to let userspace
> save and restore the guest's Shadow Stack Pointer (SSP).  On both Intel
> and AMD, SSP is a hardware register that can only be accessed by software
> via dedicated ISA (e.g. RDSSP) or via VMCS/VMCB fields (used by hardware
> to context switch SSP at entry/exit).  As a result, SSP doesn't fit in
> any of KVM's existing interfaces for saving/restoring state.
> 
> Internally, treat SSP as a fake/synthetic MSR, as the semantics of writes
> to SSP follow that of several other Shadow Stack MSRs, e.g. the PLx_SSP
> MSRs.  Use a translation layer to hide the KVM-internal MSR index so that
> the arbitrary index doesn't become ABI, e.g. so that KVM can rework its
> implementation as needed, so long as the ONE_REG ABI is maintained.
> 
> Explicitly reject accesses to SSP if the vCPU doesn't have Shadow Stack
> support to avoid running afoul of ignore_msrs, which unfortunately applies
> to host-initiated accesses (which is a discussion for another day).  I.e.
> ensure consistent behavior for KVM-defined registers irrespective of
> ignore_msrs.
> 
> Link:https://lore.kernel.org/all/aca9d389-f11e-4811-90cf-d98e345a5cc2@intel.com
> Suggested-by: Sean Christopherson<seanjc@...gle.com>
> Signed-off-by: Yang Weijiang<weijiang.yang@...el.com>
> Tested-by: Mathias Krause<minipli@...ecurity.net>
> Tested-by: John Allen<john.allen@....com>
> Tested-by: Rick Edgecombe<rick.p.edgecombe@...el.com>
> Signed-off-by: Chao Gao<chao.gao@...el.com>
> Co-developed-by: Sean Christopherson<seanjc@...gle.com>
> Signed-off-by: Sean Christopherson<seanjc@...gle.com>

Reviewed-by: Xiaoyao Li <xiaoyao.li@...el.com>