From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAC86C7EE24 for ; Tue, 30 May 2023 23:16:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233795AbjE3XQN (ORCPT ); Tue, 30 May 2023 19:16:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45262 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233791AbjE3XQM (ORCPT ); Tue, 30 May 2023 19:16:12 -0400 Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 631B5AA for ; Tue, 30 May 2023 16:16:11 -0700 (PDT) Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-64d2c865e4eso3853805b3a.0 for ; Tue, 30 May 2023 16:16:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1685488571; x=1688080571; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=q6wOdCsvPcfL1AGuKhq7si1i+l1tB9VGHRhgBuI4hFQ=; b=A6P9MRUqWxltKJ9Zgwok7DSDRoOxoww2FWlF6WQO1tYgoM5+Hi0Ez2oEaQQjsD1m8R d4fRiNfemEoHsLbKtPfU643qi1eTaIaRbZTrXG8PIKxDT7zOE/fxQqSHWBsVd7zxgsD9 9LmT/yPeVeEdIlXyQ0jganlgblNgnS7PESvrk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685488571; x=1688080571; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=q6wOdCsvPcfL1AGuKhq7si1i+l1tB9VGHRhgBuI4hFQ=; b=WGkEOf6HMeNLgeuFoEcYyYVdqh3/1opv1fP79wCHdMRquCiSsjmwLNmtDWTsk3BHAC 6V4FbokNt90WezdzjHFUpj6LSnHcdyJHxUV1ls+jioYOuakzS+TMIbMLGYiuFH8+suWJ 7UaggQeT+U3KQ6BVXmFmxh6kL1/71qSfbw5n0WUxxUhHF4Fg6jRKFYVB6s4LOp/m0o0M 9+bjp5gwWm7SDO+HFBVavl+Ez0rFwr95NrHxN043Bq58JYox8P27hQf6V2fXt1PN/HsE Y3YIkjY/ZmuEsppi/s1v3hrRFdAOKt5vEwwfXHlR2YcP+6wMFb488dqXgGy+vqLI7jGd 3BZg== X-Gm-Message-State: AC+VfDzYcjbXNEariTlDrVud3KwQ2Y1w0KXgpquEb5Q+wPPQ5BfwysXp 0xslj2Kw+cR6Vi7TE+7hBGCnKA== X-Google-Smtp-Source: ACHHUZ5vUXK2I/pfuTav0TBfWy3DDrvFJsd+7uESTSUanu+Vl50RByVZpLds9PiU8F5GGbjiErQYOQ== X-Received: by 2002:a05:6a00:10c4:b0:646:663a:9d60 with SMTP id d4-20020a056a0010c400b00646663a9d60mr4308038pfu.10.1685488570875; Tue, 30 May 2023 16:16:10 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id v22-20020aa78516000000b0063d3d776910sm2123773pfn.138.2023.05.30.16.16.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 May 2023 16:16:10 -0700 (PDT) Date: Tue, 30 May 2023 16:16:09 -0700 From: Kees Cook To: =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= Cc: Wei Liu , Borislav Petkov , Dave Hansen , "H . Peter Anvin" , Ingo Molnar , Paolo Bonzini , Sean Christopherson , Thomas Gleixner , Vitaly Kuznetsov , Wanpeng Li , Alexander Graf , Forrest Yuan Yu , James Morris , John Andersen , "Madhavan T . Venkataraman" , Marian Rotariu , Mihai =?utf-8?B?RG9uyJt1?= , =?utf-8?B?TmljdciZb3IgQ8OuyJt1?= , Rick Edgecombe , Thara Gopinath , Will Deacon , Zahra Tarkhani , =?utf-8?Q?=C8=98tefan_=C8=98icleru?= , dev@lists.cloudhypervisor.org, kvm@vger.kernel.org, linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, qemu-devel@nongnu.org, virtualization@lists.linux-foundation.org, x86@kernel.org, xen-devel@lists.xenproject.org Subject: Re: [PATCH v1 5/9] KVM: x86: Add new hypercall to lock control registers Message-ID: <202305301614.BF8D80D3D5@keescook> References: <20230505152046.6575-1-mic@digikod.net> <20230505152046.6575-6-mic@digikod.net> <901ff104-215c-8e81-fbae-5ecd8fa94449@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <901ff104-215c-8e81-fbae-5ecd8fa94449@digikod.net> Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org On Mon, May 29, 2023 at 06:48:03PM +0200, Mickaël Salaün wrote: > > On 08/05/2023 23:11, Wei Liu wrote: > > On Fri, May 05, 2023 at 05:20:42PM +0200, Mickaël Salaün wrote: > > > This enables guests to lock their CR0 and CR4 registers with a subset of > > > X86_CR0_WP, X86_CR4_SMEP, X86_CR4_SMAP, X86_CR4_UMIP, X86_CR4_FSGSBASE > > > and X86_CR4_CET flags. > > > > > > The new KVM_HC_LOCK_CR_UPDATE hypercall takes two arguments. The first > > > is to identify the control register, and the second is a bit mask to > > > pin (i.e. mark as read-only). > > > > > > These register flags should already be pinned by Linux guests, but once > > > compromised, this self-protection mechanism could be disabled, which is > > > not the case with this dedicated hypercall. > > > > > > Cc: Borislav Petkov > > > Cc: Dave Hansen > > > Cc: H. Peter Anvin > > > Cc: Ingo Molnar > > > Cc: Kees Cook > > > Cc: Madhavan T. Venkataraman > > > Cc: Paolo Bonzini > > > Cc: Sean Christopherson > > > Cc: Thomas Gleixner > > > Cc: Vitaly Kuznetsov > > > Cc: Wanpeng Li > > > Signed-off-by: Mickaël Salaün > > > Link: https://lore.kernel.org/r/20230505152046.6575-6-mic@digikod.net > > [...] > > > hw_cr4 = (cr4_read_shadow() & X86_CR4_MCE) | (cr4 & ~X86_CR4_MCE); > > > if (is_unrestricted_guest(vcpu)) > > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > > > index ffab64d08de3..a529455359ac 100644 > > > --- a/arch/x86/kvm/x86.c > > > +++ b/arch/x86/kvm/x86.c > > > @@ -7927,11 +7927,77 @@ static unsigned long emulator_get_cr(struct x86_emulate_ctxt *ctxt, int cr) > > > return value; > > > } > > > +#ifdef CONFIG_HEKI > > > + > > > +extern unsigned long cr4_pinned_mask; > > > + > > > > Can this be moved to a header file? > > Yep, but I'm not sure which one. Any preference Kees? Uh, er, I was never expecting that mask to be non-static. ;) To that end, how about putting it in arch/x86/kvm/x86.h ? -- Kees Cook