AMD Zen3 and newer processors support shadow stack, a feature designed to protect against ROP (return-oriented programming) attacks in which an attacker manipulates return addresses on the call stack in order to execute arbitrary code. To prevent this, shadow stacks can be allocated that are only used by control transfer and return instructions. When a CALL instruction is issued, it writes the return address to both the program stack and the shadow stack. When the subsequent RET instruction is issued, it pops the return address from both stacks and compares them. If the addresses don't match, a control-protection exception is raised. Shadow stack and a related feature, Indirect Branch Tracking (IBT), are collectively referred to as Control-flow Enforcement Technology (CET). However, current AMD processors only support shadow stack and not IBT. This series adds support for shadow stack in SVM guests and builds upon the support added in the CET guest support patch series [1] and the CET kernel patch series [2]. Additional patches are required to support shadow stack enabled guests in qemu [3] and glibc [4]. [1]: CET guest support patches https://lore.kernel.org/all/20220616084643.19564-1-weijiang.yang@xxxxxxxxx/ [2]: Latest CET kernel patches https://lore.kernel.org/all/20220929222936.14584-1-rick.p.edgecombe@xxxxxxxxx/ [3]: CET qemu patches https://patchwork.ozlabs.org/project/qemu-devel/patch/20201013051935.6052-2-weijiang.yang@xxxxxxxxx/ [4]: glibc tree containing necessary updates https://gitlab.com/x86-glibc/glibc/-/tree/users/hjl/cet/master/ John Allen (7): KVM: x86: Move shared CET routine to common x86 kvm code KVM: x86: SVM: Emulate reads and writes to shadow stack MSRs KVM: x86: SVM: Update dump_vmcb with shadow stack save area additions KVM: x86: SVM: Pass through shadow stack MSRs KVM: SVM: Save shadow stack host state on VMRUN KVM: SVM: Add MSR_IA32_XSS to the GHCB for hypervisor kernel KVM: SVM: Add CET features to supported_xss arch/x86/include/asm/svm.h | 1 + arch/x86/kvm/svm/sev.c | 25 ++++++++++- arch/x86/kvm/svm/svm.c | 85 ++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/vmx/vmx.c | 32 ++------------ arch/x86/kvm/x86.c | 26 ++++++++++++ arch/x86/kvm/x86.h | 2 + 7 files changed, 141 insertions(+), 32 deletions(-) -- 2.34.3
