From: "Kuppuswamy, Sathyanarayanan" <sathyanarayanan.kuppuswamy@linux.intel.com>
To: Andi Kleen <ak@linux.intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dan Williams <dan.j.williams@intel.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
Borislav Petkov <bp@alien8.de>, X86 ML <x86@kernel.org>,
Bjorn Helgaas <bhelgaas@google.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
Andreas Noever <andreas.noever@gmail.com>,
Michael Jamet <michael.jamet@intel.com>,
Yehezkel Bernat <YehezkelShB@gmail.com>,
"Rafael J . Wysocki" <rafael@kernel.org>,
Mika Westerberg <mika.westerberg@linux.intel.com>,
Jonathan Corbet <corbet@lwn.net>,
Jason Wang <jasowang@redhat.com>,
Kuppuswamy Sathyanarayanan <knsathya@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Linux PCI <linux-pci@vger.kernel.org>,
USB list <linux-usb@vger.kernel.org>,
virtualization@lists.linux-foundation.org, "Reshetova,
Elena" <elena.reshetova@intel.com>
Subject: Re: [PATCH v2 4/6] virtio: Initialize authorized attribute for confidential guest
Date: Thu, 30 Sep 2021 12:40:48 -0700 [thread overview]
Message-ID: <b6229f0e-fee1-6623-f6c9-3648e18b2500@linux.intel.com> (raw)
In-Reply-To: <291d5e03-ccaa-3a73-cdcd-66cbe80fede1@linux.intel.com>
+Elena
On 9/30/21 12:30 PM, Andi Kleen wrote:
>
> On 9/30/2021 12:04 PM, Kuppuswamy, Sathyanarayanan wrote:
>>
>>
>> On 9/30/21 8:23 AM, Greg Kroah-Hartman wrote:
>>> On Thu, Sep 30, 2021 at 08:18:18AM -0700, Kuppuswamy, Sathyanarayanan wrote:
>>>>
>>>>
>>>> On 9/30/21 6:36 AM, Dan Williams wrote:
>>>>>> And in particular, not all virtio drivers are hardened -
>>>>>> I think at this point blk and scsi drivers have been hardened - so
>>>>>> treating them all the same looks wrong.
>>>>> My understanding was that they have been audited, Sathya?
>>>>
>>>> Yes, AFAIK, it has been audited. Andi also submitted some patches
>>>> related to it. Andi, can you confirm.
>>>
>>> What is the official definition of "audited"?
>>
>>
>> In our case (Confidential Computing platform), the host is an un-trusted
>> entity. So any interaction with host from the drivers will have to be
>> protected against the possible attack from the host. For example, if we
>> are accessing a memory based on index value received from host, we have
>> to make sure it does not lead to out of bound access or when sharing the
>> memory with the host, we need to make sure only the required region is
>> shared with the host and the memory is un-shared after use properly.
>>
>> Elena can share more details, but it was achieved with static analysis
>> and fuzzing. Here is a presentation she is sharing about the work at the
>> Linux Security Summit:
>> https://static.sched.com/hosted_files/lssna2021/b6/LSS-HardeningLinuxGuestForCCC.pdf
>>
>> Andi, can talk more about the specific driver changes that came out of this
>> effort.
>
> The original virtio was quite easy to exploit because it put its free list into the shared ring buffer.
>
> We had a patchkit to harden virtio originally, but after some discussion we instead switched to
> Jason Wang's patchkit to move the virtio metadata into protected memory, which fixed near all of the
> issues. These patches have been already merged. There is one additional patch to limit the virtio
> modes.
>
> There's an ongoing effort to audit (mostly finished I believe) and fuzz the three virtio drivers
> (fuzzing is still ongoing).
>
> There was also a range of changes outside virtio for code outside the device model. Most of it was
> just disabling it though.
>
> -Andi
>
--
Sathyanarayanan Kuppuswamy
Linux Kernel Developer
next prev parent reply other threads:[~2021-09-30 19:41 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-30 1:05 [PATCH v2 0/6] Add device filter support Kuppuswamy Sathyanarayanan
2021-09-30 1:05 ` [PATCH v2 1/6] driver core: Move the "authorized" attribute from USB/Thunderbolt to core Kuppuswamy Sathyanarayanan
2021-09-30 1:42 ` Alan Stern
2021-09-30 1:55 ` Dan Williams
2021-09-30 2:38 ` Kuppuswamy, Sathyanarayanan
2021-09-30 4:59 ` Dan Williams
2021-09-30 9:05 ` Rafael J. Wysocki
2021-09-30 14:59 ` Alan Stern
2021-09-30 15:25 ` Dan Williams
2021-09-30 11:19 ` Yehezkel Bernat
2021-09-30 15:28 ` Dan Williams
2021-09-30 18:25 ` Yehezkel Bernat
2021-09-30 19:04 ` Dan Williams
2021-09-30 19:50 ` Kuppuswamy, Sathyanarayanan
2021-09-30 20:23 ` Dan Williams
2021-09-30 1:05 ` [PATCH v2 2/6] driver core: Add common support to skip probe for un-authorized devices Kuppuswamy Sathyanarayanan
2021-09-30 10:59 ` Michael S. Tsirkin
2021-09-30 13:52 ` Greg Kroah-Hartman
2021-09-30 14:38 ` Michael S. Tsirkin
2021-09-30 14:49 ` Greg Kroah-Hartman
2021-09-30 15:00 ` Michael S. Tsirkin
2021-09-30 15:22 ` Greg Kroah-Hartman
2021-09-30 17:17 ` Andi Kleen
2021-09-30 17:23 ` Greg Kroah-Hartman
2021-09-30 19:15 ` Andi Kleen
2021-10-01 6:29 ` Greg Kroah-Hartman
2021-10-01 15:51 ` Alan Stern
2021-10-01 15:56 ` Andi Kleen
2021-09-30 14:43 ` Alan Stern
2021-09-30 14:48 ` Michael S. Tsirkin
2021-09-30 15:32 ` Alan Stern
2021-09-30 15:52 ` Michael S. Tsirkin
2021-09-30 14:58 ` Michael S. Tsirkin
2021-09-30 15:35 ` Alan Stern
2021-09-30 15:59 ` Michael S. Tsirkin
2021-09-30 19:23 ` Andi Kleen
2021-09-30 20:44 ` Alan Stern
2021-09-30 20:52 ` Dan Williams
2021-10-01 1:41 ` Alan Stern
2021-10-01 2:20 ` Dan Williams
2021-09-30 21:12 ` Andi Kleen
2021-09-30 1:05 ` [PATCH v2 3/6] driver core: Allow arch to initialize the authorized attribute Kuppuswamy Sathyanarayanan
2021-09-30 1:05 ` [PATCH v2 4/6] virtio: Initialize authorized attribute for confidential guest Kuppuswamy Sathyanarayanan
2021-09-30 11:03 ` Michael S. Tsirkin
2021-09-30 13:36 ` Dan Williams
2021-09-30 13:49 ` Greg Kroah-Hartman
2021-09-30 15:18 ` Kuppuswamy, Sathyanarayanan
2021-09-30 15:20 ` Michael S. Tsirkin
2021-09-30 15:23 ` Kuppuswamy, Sathyanarayanan
2021-09-30 15:23 ` Greg Kroah-Hartman
2021-09-30 19:04 ` Kuppuswamy, Sathyanarayanan
2021-09-30 19:16 ` Kuppuswamy, Sathyanarayanan
2021-09-30 19:30 ` Andi Kleen
2021-09-30 19:40 ` Kuppuswamy, Sathyanarayanan [this message]
2021-10-01 7:03 ` Greg Kroah-Hartman
2021-10-01 15:49 ` Andi Kleen
2021-10-02 11:04 ` Michael S. Tsirkin
2021-10-02 11:14 ` Greg Kroah-Hartman
2021-10-02 14:20 ` Andi Kleen
2021-10-02 14:44 ` Greg Kroah-Hartman
2021-10-02 18:40 ` Michael S. Tsirkin
2021-10-03 6:40 ` Greg Kroah-Hartman
2021-10-04 21:04 ` Dan Williams
2021-10-01 16:13 ` Dan Williams
2021-10-01 16:45 ` Alan Stern
2021-10-01 18:09 ` Dan Williams
2021-10-01 19:00 ` Alan Stern
2021-10-01 19:45 ` Kuppuswamy, Sathyanarayanan
2021-10-01 19:57 ` Dan Williams
2021-10-04 5:16 ` Mika Westerberg
2021-10-05 22:33 ` Dan Williams
2021-10-06 5:45 ` Greg Kroah-Hartman
2021-09-30 19:25 ` Andi Kleen
2021-09-30 1:05 ` [PATCH v2 5/6] x86/tdx: Add device filter support for x86 TDX guest platform Kuppuswamy Sathyanarayanan
2021-09-30 1:05 ` [PATCH v2 6/6] PCI: Initialize authorized attribute for confidential guest Kuppuswamy Sathyanarayanan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b6229f0e-fee1-6623-f6c9-3648e18b2500@linux.intel.com \
--to=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=YehezkelShB@gmail.com \
--cc=ak@linux.intel.com \
--cc=andreas.noever@gmail.com \
--cc=bhelgaas@google.com \
--cc=bp@alien8.de \
--cc=corbet@lwn.net \
--cc=dan.j.williams@intel.com \
--cc=elena.reshetova@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=jasowang@redhat.com \
--cc=knsathya@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=michael.jamet@intel.com \
--cc=mika.westerberg@linux.intel.com \
--cc=mingo@redhat.com \
--cc=mst@redhat.com \
--cc=rafael@kernel.org \
--cc=tglx@linutronix.de \
--cc=virtualization@lists.linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).