From: Paolo Bonzini <pbonzini@redhat.com>
To: John Andersen <john.s.andersen@intel.com>,
tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
x86@kernel.org
Cc: hpa@zytor.com, sean.j.christopherson@intel.com,
vkuznets@redhat.com, wanpengli@tencent.com, jmattson@google.com,
joro@8bytes.org, linux-kernel@vger.kernel.org,
kvm@vger.kernel.org
Subject: Re: [RESEND RFC 0/2] Paravirtualized Control Register pinning
Date: Sat, 21 Dec 2019 14:59:56 +0100 [thread overview]
Message-ID: <0f42e52a-6a16-69f4-41da-06e53d8025d2@redhat.com> (raw)
In-Reply-To: <20191220192701.23415-1-john.s.andersen@intel.com>
On 20/12/19 20:26, John Andersen wrote:
> Paravirtualized CR pinning will likely be incompatible with kexec for
> the foreseeable future. Early boot code could possibly be changed to
> not clear protected bits. However, a kernel that requests CR bits be
> pinned can't know if the kernel it's kexecing has been updated to not
> clear protected bits. This would result in the kernel being kexec'd
> almost immediately receiving a general protection fault.
>
> Security conscious kernel configurations disable kexec already, per KSPP
> guidelines. Projects such as Kata Containers, AWS Lambda, ChromeOS
> Termina, and others using KVM to virtualize Linux will benefit from
> this protection.
>
> The usage of SMM in SeaBIOS was explored as a way to communicate to KVM
> that a reboot has occurred and it should zero the pinned bits. When
> using QEMU and SeaBIOS, SMM initialization occurs on reboot. However,
> prior to SMM initialization, BIOS writes zero values to CR0, causing a
> general protection fault to be sent to the guest before SMM can signal
> that the machine has booted.
SMM is optional; I think it makes sense to leave it to userspace to
reset pinning (including for the case of triple faults), while INIT
which is handled within KVM would keep it active.
> Pinning of sensitive CR bits has already been implemented to protect
> against exploits directly calling native_write_cr*(). The current
> protection cannot stop ROP attacks which jump directly to a MOV CR
> instruction. Guests running with paravirtualized CR pinning are now
> protected against the use of ROP to disable CR bits. The same bits that
> are being pinned natively may be pinned via the CR pinned MSRs. These
> bits are WP in CR0, and SMEP, SMAP, and UMIP in CR4.
>
> Future patches could protect bits in MSRs in a similar fashion. The NXE
> bit of the EFER MSR is a prime candidate.
Please include patches for either kvm-unit-tests or
tools/testing/selftests/kvm that test the functionality.
Paolo
next prev parent reply other threads:[~2019-12-21 14:00 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-20 19:26 [RESEND RFC 0/2] Paravirtualized Control Register pinning John Andersen
2019-12-20 19:27 ` [RESEND RFC 1/2] KVM: X86: Add CR pin MSRs John Andersen
2019-12-20 19:27 ` [RESEND RFC 2/2] X86: Use KVM " John Andersen
2019-12-23 7:39 ` Andy Lutomirski
2019-12-23 12:06 ` Borislav Petkov
2019-12-24 21:18 ` Andersen, John S
2019-12-21 13:59 ` Paolo Bonzini [this message]
2019-12-23 17:28 ` [RESEND RFC 0/2] Paravirtualized Control Register pinning Andersen, John S
2019-12-23 14:30 ` Liran Alon
2019-12-24 22:56 ` Liran Alon
2019-12-25 2:04 ` Andy Lutomirski
2019-12-25 13:05 ` Liran Alon
2019-12-23 14:48 ` Liran Alon
2019-12-23 17:09 ` Paolo Bonzini
2019-12-23 17:27 ` Andersen, John S
2019-12-23 17:28 ` Liran Alon
2019-12-23 17:46 ` Paolo Bonzini
2019-12-23 22:49 ` Liran Alon
2019-12-24 19:44 ` Andersen, John S
2019-12-24 20:35 ` Liran Alon
2019-12-24 21:17 ` Andersen, John S
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0f42e52a-6a16-69f4-41da-06e53d8025d2@redhat.com \
--to=pbonzini@redhat.com \
--cc=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=jmattson@google.com \
--cc=john.s.andersen@intel.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=sean.j.christopherson@intel.com \
--cc=tglx@linutronix.de \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).