From: Dave Hansen <dave.hansen@intel.com>
To: John Andersen <john.s.andersen@intel.com>,
corbet@lwn.net, pbonzini@redhat.com, tglx@linutronix.de,
mingo@redhat.com, bp@alien8.de, x86@kernel.org, hpa@zytor.com,
shuah@kernel.org, sean.j.christopherson@intel.com,
liran.alon@oracle.com, drjones@redhat.com,
rick.p.edgecombe@intel.com, kristen@linux.intel.com
Cc: vkuznets@redhat.com, wanpengli@tencent.com, jmattson@google.com,
joro@8bytes.org, mchehab+huawei@kernel.org,
gregkh@linuxfoundation.org, paulmck@kernel.org,
pawan.kumar.gupta@linux.intel.com, jgross@suse.com,
mike.kravetz@oracle.com, oneukum@suse.com, luto@kernel.org,
peterz@infradead.org, fenghua.yu@intel.com,
reinette.chatre@intel.com, vineela.tummalapalli@intel.com,
dave.hansen@linux.intel.com, arjan@linux.intel.com,
caoj.fnst@cn.fujitsu.com, bhe@redhat.com, nivedita@alum.mit.edu,
keescook@chromium.org, dan.j.williams@intel.com,
eric.auger@redhat.com, aaronlewis@google.com, peterx@redhat.com,
makarandsonare@google.com, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
linux-kselftest@vger.kernel.org,
kernel-hardening@lists.openwall.com
Subject: Re: [PATCH 2/4] KVM: x86: Introduce paravirt feature CR0/CR4 pinning
Date: Thu, 18 Jun 2020 07:18:09 -0700 [thread overview]
Message-ID: <0fa9682e-59d4-75f7-366f-103d6b8e71b8@intel.com> (raw)
In-Reply-To: <20200617190757.27081-3-john.s.andersen@intel.com>
On 6/17/20 12:07 PM, John Andersen wrote:
> +#define KVM_CR0_PIN_ALLOWED (X86_CR0_WP)
> +#define KVM_CR4_PIN_ALLOWED (X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP)
Why *is* there an allowed set? Why don't we just allow everything?
Shouldn't we also pin any unknown bits? The CR4.FSGSBASE bit is an
example of something that showed up CPUs without Linux knowing about it.
If set, it causes problems. This set couldn't have helped FSGSBASE
because it is not in the allowed set.
Let's say Intel loses its marbles and adds a CR4 bit that lets userspace
write to kernel memory. Linux won't set it, but an attacker would go
after it, first thing.
next prev parent reply other threads:[~2020-06-18 14:18 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-17 19:07 [PATCH 0/4] Paravirtualized Control Register pinning John Andersen
2020-06-17 19:07 ` [PATCH 1/4] X86: Update mmu_cr4_features during feature identification John Andersen
2020-06-18 14:09 ` Dave Hansen
2020-06-17 19:07 ` [PATCH 2/4] KVM: x86: Introduce paravirt feature CR0/CR4 pinning John Andersen
2020-06-18 14:18 ` Dave Hansen [this message]
2020-06-18 14:43 ` Andersen, John
2020-06-18 14:51 ` Dave Hansen
2020-07-07 21:12 ` Sean Christopherson
2020-07-07 21:48 ` Dave Hansen
2020-07-07 21:51 ` Paolo Bonzini
2020-07-09 15:44 ` Andersen, John
2020-07-09 15:56 ` Dave Hansen
[not found] ` <CALCETrWxt0CHUoonWX1fgbM46ydJPQZhj8Q=G+45EG4wW3wZqQ@mail.gmail.com>
2020-07-09 16:22 ` Dave Hansen
2020-07-09 23:37 ` Kees Cook
[not found] ` <CALCETrUHcpqjDfAM9SbrZUM7xcS2wkVm=r1Nb1JmxV7A-KAeUQ@mail.gmail.com>
2020-07-14 5:36 ` Andersen, John, Arvind Sankar
2020-07-14 5:39 ` Andersen, John
2020-07-15 4:41 ` Sean Christopherson
2020-07-15 19:58 ` Andersen, John
2020-06-17 19:07 ` [PATCH 3/4] selftests: kvm: add test for CR pinning with SMM John Andersen
2020-06-17 19:07 ` [PATCH 4/4] X86: Use KVM CR pin MSRs John Andersen
2020-06-18 14:41 ` Dave Hansen
2020-06-18 15:26 ` Andersen, John
2020-06-18 15:38 ` Dave Hansen
2020-06-18 15:49 ` Andersen, John
2020-06-20 5:13 ` Andy Lutomirski
2020-06-23 20:03 ` Andersen, John
2020-07-03 21:48 ` Andersen, John
2020-07-04 15:11 ` Arvind Sankar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0fa9682e-59d4-75f7-366f-103d6b8e71b8@intel.com \
--to=dave.hansen@intel.com \
--cc=aaronlewis@google.com \
--cc=arjan@linux.intel.com \
--cc=bhe@redhat.com \
--cc=bp@alien8.de \
--cc=caoj.fnst@cn.fujitsu.com \
--cc=corbet@lwn.net \
--cc=dan.j.williams@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=drjones@redhat.com \
--cc=eric.auger@redhat.com \
--cc=fenghua.yu@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=jgross@suse.com \
--cc=jmattson@google.com \
--cc=john.s.andersen@intel.com \
--cc=joro@8bytes.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=kristen@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=liran.alon@oracle.com \
--cc=luto@kernel.org \
--cc=makarandsonare@google.com \
--cc=mchehab+huawei@kernel.org \
--cc=mike.kravetz@oracle.com \
--cc=mingo@redhat.com \
--cc=nivedita@alum.mit.edu \
--cc=oneukum@suse.com \
--cc=paulmck@kernel.org \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=pbonzini@redhat.com \
--cc=peterx@redhat.com \
--cc=peterz@infradead.org \
--cc=reinette.chatre@intel.com \
--cc=rick.p.edgecombe@intel.com \
--cc=sean.j.christopherson@intel.com \
--cc=shuah@kernel.org \
--cc=tglx@linutronix.de \
--cc=vineela.tummalapalli@intel.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).