On Thu, Apr 23, 2020 at 09:07:48AM -0700, Sean Christopherson wrote:
> On Thu, Mar 26, 2020 at 04:18:38PM +0800, Yang Weijiang wrote:
> > CET(Control-flow Enforcement Technology) is a CPU feature
> > used to prevent Return/Jump-Oriented Programming(ROP/JOP)
> > attacks. It provides the following sub-features to defend
> > against ROP/JOP style control-flow subversion attacks:
>
> Changelogs should wrap at 75 characters. Wrapping slightly earlier is ok,
> but wrapping at ~60 chars is too narrow.
>
Got it, thank you!
> > Shadow Stack (SHSTK):
> > A second stack for program which is used exclusively for
> > control transfer operations.
> >
> > /* Select x86 specific features in <linux/kvm.h> */
> > #define __KVM_HAVE_PIT
> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 40c6768942ae..830afe5038d1 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -186,6 +186,9 @@ static struct kvm_shared_msrs __percpu *shared_msrs;
> > | XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \
> > | XFEATURE_MASK_PKRU)
> >
> > +#define KVM_SUPPORTED_XSS (XFEATURE_MASK_CET_USER | \
> > + XFEATURE_MASK_CET_KERNEL)
>
> This belongs in a later patch, KVM obviously doesn't support XSS.
>
OK, will change it.
> > +
> > u64 __read_mostly host_efer;
> > EXPORT_SYMBOL_GPL(host_efer);
> >
> > @@ -402,6 +405,7 @@ static int exception_class(int vector)
> > case NP_VECTOR:
> > case SS_VECTOR:
> > case GP_VECTOR:
> > + case CP_VECTOR:
> > return EXCPT_CONTRIBUTORY;
> > default:
> > break;
> > diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> > index c1954e216b41..8f0baa6fa72f 100644
> > --- a/arch/x86/kvm/x86.h
> > +++ b/arch/x86/kvm/x86.h
> > @@ -115,7 +115,7 @@ static inline bool x86_exception_has_error_code(unsigned int vector)
> > {
> > static u32 exception_has_error_code = BIT(DF_VECTOR) | BIT(TS_VECTOR) |
> > BIT(NP_VECTOR) | BIT(SS_VECTOR) | BIT(GP_VECTOR) |
> > - BIT(PF_VECTOR) | BIT(AC_VECTOR);
> > + BIT(PF_VECTOR) | BIT(AC_VECTOR) | BIT(CP_VECTOR);
> >
> > return (1U << vector) & exception_has_error_code;
>
> Maybe it's gratuitous, but I feel like the #CP logic should be in a patch
> of its own, e.g. the changelog doesn't mention anything about #CP.
>
My fault, will find a proper place to hold it.
> > }
> > --
> > 2.17.2
> >
