On 6/16/2023 7:30 AM, Sean Christopherson wrote:
On Thu, May 11, 2023, Yang Weijiang wrote:
The last patch is introduced to support supervisor SHSTK but the feature is
not enabled on Intel platform for now, the main purpose of this patch is to
facilitate AMD folks to enable the feature.
I am beyond confused by the SDM's wording of CET_SSS.
First, it says that CET_SSS says the CPU isn't buggy (or maybe "less buggy" is
more appropriate phrasing).
Bit 18: CET_SSS. If 1, indicates that an operating system can enable supervisor
shadow stacks as long as it ensures that certain supervisor shadow-stack pushes
will not cause page faults (see Section 17.2.3 of the Intel® 64 and IA-32
Architectures Software Developer’s Manual, Volume 1).
But then it says says VMMs shouldn't set the bit.
When emulating the CPUID instruction, a virtual-machine monitor should return
this bit as 0 if those pushes can cause VM exits.
Based on the Xen code (which is sadly a far better source of information than the
SDM), I *think* that what the SDM is trying to say is that VMMs should not set
CET_SS if VM-Exits can occur ***and*** the bit is not set in the host CPU. Because
if the SDM really means "VMMs should never set the bit", then what on earth is the
point of the bit.
I need to double check for the vague description.
From my understanding, on bare metal side, if the bit is 1, OS can
enable SSS if pushes won't cause
page fault. But for VM case, it's not recommended(regardless of the bit
state) to set the bit as vm-exits
caused by guest SSS pushes cannot be fully excluded.
In other word, the bit is mainly for bare metal guidance now.
In summary, this new series enables CET user SHSTK/IBT and kernel IBT, but
doesn't fully support CET supervisor SHSTK, the enabling work is left for
the future.
Why? If my interpretation of the SDM is correct, then all the pieces are there.
My assumption is, VM supervisor SHSTK depends bare metal kernel support
as PL0_SSP MSR is
backed by XSAVES via IA32_XSS:bit12(CET_S), but this part of support is
not there in Rick's native series.
And also based on above SDM description, I don't want to add the support
blindly now.
[...]
