| Message ID | 20190522070101.7636-2-weijiang.yang@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Introduce support for Guest CET feature | expand |
On Wed, May 22, 2019 at 03:00:54PM +0800, Yang Weijiang wrote: > CET(Control-flow Enforcement Technology) is an upcoming Intel® processor > family feature that blocks return/jump-oriented programming (ROP) attacks. > It provides the following capabilities to defend > against ROP/JOP style control-flow subversion attacks: > > - Shadow Stack (SHSTK): > A second stack for the program that is used exclusively for > control transfer operations. > > - Indirect Branch Tracking (IBT): > Free branch protection to defend against jump/call oriented > programming. What is "free" referring to here? The software enabling certainly isn't free, and I doubt the hardware/ucode cost is completely free. > Several new CET MSRs are defined in kernel to support CET: > MSR_IA32_{U,S}_CET - MSRs to control the CET settings for user > mode and suervisor mode respectively. > > MSR_IA32_PL{0,1,2,3}_SSP - MSRs to store shadow stack pointers for > CPL-0,1,2,3 levels. > > MSR_IA32_INT_SSP_TAB - MSR to store base address of shadow stack > pointer table. For consistency (within the changelog), these should be list style, e.g.: - MSR_IA32_{U,S}_CET: Control CET settings for user mode and suervisor mode respectively. - MSR_IA32_PL{0,1,2,3}_SSP: Store shadow stack pointers for CPL levels. - MSR_IA32_INT_SSP_TAB: Stores base address of shadow stack pointer table. > Two XSAVES state components are introduced for CET: > IA32_XSS:[bit 11] - bit for save/restor user mode CET states > IA32_XSS:[bit 12] - bit for save/restor supervisor mode CET states. Likewise, use a consistent list format. > 6 VMCS fields are introduced for CET, {HOST,GUEST}_S_CET is to store > CET settings in supervisor mode. {HOST,GUEST}_SSP is to store shadow > stack pointers in supervisor mode. {HOST,GUEST}_INTR_SSP_TABLE is to > store base address of shadow stack pointer table. It'd probably be easier to use a list format for the fields, e.g.: 6 VMCS fields are introduced for CET: - {HOST,GUEST}_S_CET: stores CET settings for supervisor mode. - {HOST,GUEST}_SSP: stores shadow stack pointers for supervisor mode. - {HOST,GUEST}_INTR_SSP_TABLE: stores the based address of the shadow stack pointer table. > If VM_EXIT_LOAD_HOST_CET_STATE = 1, the host's CET MSRs are restored > from below VMCS fields at VM-Exit: > - HOST_S_CET > - HOST_SSP > - HOST_INTR_SSP_TABLE Personal preference, I like indenting lists like this with a space or two so that the list is clearly delineated. > If VM_ENTRY_LOAD_GUEST_CET_STATE = 1, the guest's CET MSRs are loaded > from below VMCS fields at VM-Entry: > - GUEST_S_CET > - GUEST_SSP > - GUEST_INTR_SSP_TABLE > > Apart from VMCS auto-load fields, KVM calls kvm_load_guest_fpu() and > kvm_put_guest_fpu() to save/restore the guest CET MSR states at > VM exit/entry. XSAVES/XRSTORS are executed underneath these functions > if they are supported. The CET xsave area is consolidated with other > XSAVE components in thread_struct.fpu field. > > When context switch happens during task switch/interrupt/exception etc., > Kernel also relies on above functions to switch CET states properly. These paragraphs about the FPU and KVM behavior don't belong in this patch. > Signed-off-by: Yang Weijiang <weijiang.yang@intel.com> > Co-developed-by: Zhang Yi Z <yi.z.zhang@linux.intel.com> Co-developed-by needs to be accompanied by a SOB. And your SOB should be last since you sent the patch. This comment applies to all patches. See "12) When to use Acked-by:, Cc:, and Co-developed-by:" in Documentation/process/submitting-patches.rst for details (I recommend looking at a v5.2-rc* version, a docs update was merged for v5.2).
On Tue, Jun 04, 2019 at 07:46:13AM -0700, Sean Christopherson wrote: > On Wed, May 22, 2019 at 03:00:54PM +0800, Yang Weijiang wrote: > > CET(Control-flow Enforcement Technology) is an upcoming Intel® processor > > family feature that blocks return/jump-oriented programming (ROP) attacks. > > It provides the following capabilities to defend > > against ROP/JOP style control-flow subversion attacks: > > > > - Shadow Stack (SHSTK): > > A second stack for the program that is used exclusively for > > control transfer operations. > > > > - Indirect Branch Tracking (IBT): > > Free branch protection to defend against jump/call oriented > > programming. > > What is "free" referring to here? The software enabling certainly isn't > free, and I doubt the hardware/ucode cost is completely free. > Thank you for pointing it out! "free" comes from the spec., I guess the author means the major effort of enabling IBT is in compiler and HW, free effort to SW enabling. But as you mentioned, actually there's deficated effort to enable it, will change it to other words. > > Several new CET MSRs are defined in kernel to support CET: > > MSR_IA32_{U,S}_CET - MSRs to control the CET settings for user > > mode and suervisor mode respectively. > > > > MSR_IA32_PL{0,1,2,3}_SSP - MSRs to store shadow stack pointers for > > CPL-0,1,2,3 levels. > > > > MSR_IA32_INT_SSP_TAB - MSR to store base address of shadow stack > > pointer table. > > For consistency (within the changelog), these should be list style, e.g.: > > > - MSR_IA32_{U,S}_CET: Control CET settings for user mode and suervisor > mode respectively. > > - MSR_IA32_PL{0,1,2,3}_SSP: Store shadow stack pointers for CPL levels. > > - MSR_IA32_INT_SSP_TAB: Stores base address of shadow stack pointer > table. > OK, will change it in next version. > > Two XSAVES state components are introduced for CET: > > IA32_XSS:[bit 11] - bit for save/restor user mode CET states > > IA32_XSS:[bit 12] - bit for save/restor supervisor mode CET states. > > Likewise, use a consistent list format. > > > 6 VMCS fields are introduced for CET, {HOST,GUEST}_S_CET is to store > > CET settings in supervisor mode. {HOST,GUEST}_SSP is to store shadow > > stack pointers in supervisor mode. {HOST,GUEST}_INTR_SSP_TABLE is to > > store base address of shadow stack pointer table. > > It'd probably be easier to use a list format for the fields, e.g.: > > 6 VMCS fields are introduced for CET: > > - {HOST,GUEST}_S_CET: stores CET settings for supervisor mode. > > - {HOST,GUEST}_SSP: stores shadow stack pointers for supervisor mode. > > - {HOST,GUEST}_INTR_SSP_TABLE: stores the based address of the shadow > stack pointer table. > OK, will modify it. > > If VM_EXIT_LOAD_HOST_CET_STATE = 1, the host's CET MSRs are restored > > from below VMCS fields at VM-Exit: > > - HOST_S_CET > > - HOST_SSP > > - HOST_INTR_SSP_TABLE > > Personal preference, I like indenting lists like this with a space or two > so that the list is clearly delineated. Good suggestion, thanks! > > > If VM_ENTRY_LOAD_GUEST_CET_STATE = 1, the guest's CET MSRs are loaded > > from below VMCS fields at VM-Entry: > > - GUEST_S_CET > > - GUEST_SSP > > - GUEST_INTR_SSP_TABLE > > > > Apart from VMCS auto-load fields, KVM calls kvm_load_guest_fpu() and > > kvm_put_guest_fpu() to save/restore the guest CET MSR states at > > VM exit/entry. XSAVES/XRSTORS are executed underneath these functions > > if they are supported. The CET xsave area is consolidated with other > > XSAVE components in thread_struct.fpu field. > > > > When context switch happens during task switch/interrupt/exception etc., > > Kernel also relies on above functions to switch CET states properly. > > These paragraphs about the FPU and KVM behavior don't belong in this > patch. OK. looks like it's redundant, will remve it. > > > Signed-off-by: Yang Weijiang <weijiang.yang@intel.com> > > Co-developed-by: Zhang Yi Z <yi.z.zhang@linux.intel.com> > > Co-developed-by needs to be accompanied by a SOB. And your SOB should > be last since you sent the patch. This comment applies to all patches. > > See "12) When to use Acked-by:, Cc:, and Co-developed-by:" in > Documentation/process/submitting-patches.rst for details (I recommend > looking at a v5.2-rc* version, a docs update was merged for v5.2). Got it, will change all the signatures.
diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h index 4e4133e86484..d84804c7ddaa 100644 --- a/arch/x86/include/asm/vmx.h +++ b/arch/x86/include/asm/vmx.h @@ -103,6 +103,7 @@ #define VM_EXIT_CLEAR_BNDCFGS 0x00800000 #define VM_EXIT_PT_CONCEAL_PIP 0x01000000 #define VM_EXIT_CLEAR_IA32_RTIT_CTL 0x02000000 +#define VM_EXIT_LOAD_HOST_CET_STATE 0x10000000 #define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR 0x00036dff @@ -116,6 +117,7 @@ #define VM_ENTRY_LOAD_BNDCFGS 0x00010000 #define VM_ENTRY_PT_CONCEAL_PIP 0x00020000 #define VM_ENTRY_LOAD_IA32_RTIT_CTL 0x00040000 +#define VM_ENTRY_LOAD_GUEST_CET_STATE 0x00100000 #define VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR 0x000011ff @@ -334,6 +336,9 @@ enum vmcs_field { GUEST_PENDING_DBG_EXCEPTIONS = 0x00006822, GUEST_SYSENTER_ESP = 0x00006824, GUEST_SYSENTER_EIP = 0x00006826, + GUEST_S_CET = 0x00006828, + GUEST_SSP = 0x0000682a, + GUEST_INTR_SSP_TABLE = 0x0000682c, HOST_CR0 = 0x00006c00, HOST_CR3 = 0x00006c02, HOST_CR4 = 0x00006c04, @@ -346,6 +351,9 @@ enum vmcs_field { HOST_IA32_SYSENTER_EIP = 0x00006c12, HOST_RSP = 0x00006c14, HOST_RIP = 0x00006c16, + HOST_S_CET = 0x00006c18, + HOST_SSP = 0x00006c1a, + HOST_INTR_SSP_TABLE = 0x00006c1c }; /*
CET(Control-flow Enforcement Technology) is an upcoming Intel® processor family feature that blocks return/jump-oriented programming (ROP) attacks. It provides the following capabilities to defend against ROP/JOP style control-flow subversion attacks: - Shadow Stack (SHSTK): A second stack for the program that is used exclusively for control transfer operations. - Indirect Branch Tracking (IBT): Free branch protection to defend against jump/call oriented programming. Several new CET MSRs are defined in kernel to support CET: MSR_IA32_{U,S}_CET - MSRs to control the CET settings for user mode and suervisor mode respectively. MSR_IA32_PL{0,1,2,3}_SSP - MSRs to store shadow stack pointers for CPL-0,1,2,3 levels. MSR_IA32_INT_SSP_TAB - MSR to store base address of shadow stack pointer table. Two XSAVES state components are introduced for CET: IA32_XSS:[bit 11] - bit for save/restor user mode CET states IA32_XSS:[bit 12] - bit for save/restor supervisor mode CET states. 6 VMCS fields are introduced for CET, {HOST,GUEST}_S_CET is to store CET settings in supervisor mode. {HOST,GUEST}_SSP is to store shadow stack pointers in supervisor mode. {HOST,GUEST}_INTR_SSP_TABLE is to store base address of shadow stack pointer table. If VM_EXIT_LOAD_HOST_CET_STATE = 1, the host's CET MSRs are restored from below VMCS fields at VM-Exit: - HOST_S_CET - HOST_SSP - HOST_INTR_SSP_TABLE If VM_ENTRY_LOAD_GUEST_CET_STATE = 1, the guest's CET MSRs are loaded from below VMCS fields at VM-Entry: - GUEST_S_CET - GUEST_SSP - GUEST_INTR_SSP_TABLE Apart from VMCS auto-load fields, KVM calls kvm_load_guest_fpu() and kvm_put_guest_fpu() to save/restore the guest CET MSR states at VM exit/entry. XSAVES/XRSTORS are executed underneath these functions if they are supported. The CET xsave area is consolidated with other XSAVE components in thread_struct.fpu field. When context switch happens during task switch/interrupt/exception etc., Kernel also relies on above functions to switch CET states properly. Signed-off-by: Yang Weijiang <weijiang.yang@intel.com> Co-developed-by: Zhang Yi Z <yi.z.zhang@linux.intel.com> --- arch/x86/include/asm/vmx.h | 8 ++++++++ 1 file changed, 8 insertions(+)