linux-kernel - Re: [RFC PATCH 00/13] XOM for KVM guest userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50df3c452b25ff4823fba223dd56216bc2f33644.camel@intel.com>
Date:   Mon, 7 Oct 2019 18:14:40 +0000
From:   "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To:     "luto@...nel.org" <luto@...nel.org>
CC:     "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "Dock, Deneen T" <deneen.t.dock@...el.com>,
        "Christopherson, Sean J" <sean.j.christopherson@...el.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "x86@...nel.org" <x86@...nel.org>,
        "kristen@...ux.intel.com" <kristen@...ux.intel.com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "Hansen, Dave" <dave.hansen@...el.com>
Subject: Re: [RFC PATCH 00/13] XOM for KVM guest userspace

On Fri, 2019-10-04 at 18:33 -0700, Andy Lutomirski wrote:
> On Fri, Oct 4, 2019 at 1:10 PM Edgecombe, Rick P
> <rick.p.edgecombe@...el.com> wrote:
> > 
> > On Fri, 2019-10-04 at 07:56 -0700, Andy Lutomirski wrote:
> > > On Thu, Oct 3, 2019 at 2:38 PM Rick Edgecombe
> > > <rick.p.edgecombe@...el.com> wrote:
> > > > 
> > > > This patchset enables the ability for KVM guests to create execute-only
> > > > (XO)
> > > > memory by utilizing EPT based XO permissions. XO memory is currently
> > > > supported
> > > > on Intel hardware natively for CPU's with PKU, but this enables it on
> > > > older
> > > > platforms, and can support XO for kernel memory as well.
> > > 
> > > The patchset seems to sometimes call this feature "XO" and sometimes
> > > call it "NR".  To me, XO implies no-read and no-write, whereas NR
> > > implies just no-read.  Can you please clarify *exactly* what the new
> > > bit does and be consistent?
> > > 
> > > I suggest that you make it NR, which allows for PROT_EXEC and
> > > PROT_EXEC|PROT_WRITE and plain PROT_WRITE.  WX is of dubious value,
> > > but I can imagine plain W being genuinely useful for logging and for
> > > JITs that could maintain a W and a separate X mapping of some code.
> > > In other words, with an NR bit, all 8 logical access modes are
> > > possible.  Also, keeping the paging bits more orthogonal seems nice --
> > > we already have a bit that controls write access.
> > 
> > Sorry, yes the behavior of this bit needs to be documented a lot better. I
> > will
> > definitely do this for the next version.
> > 
> > To clarify, since the EPT permissions in the XO/NR range are executable, and
> > not
> > readable or writeable the new bit really means XO, but only when NX is 0
> > since
> > the guest page tables are being checked as well. When NR=1, W=1, and NX=0,
> > the
> > memory is still XO.
> > 
> > NR was picked over XO because as you say. The idea is that it can be defined
> > that in the case of KVM XO, NR and writable is not a valid combination, like
> > writeable but not readable is defined as not valid for the EPT.
> > 
> 
> Ugh, I see, this is an "EPT Misconfiguration".  Oh, well.  I guess
> just keep things as they are and document things better, please.
> Don't try to emulate.

Ah, I see what you were thinking. Ok will do.

> I don't suppose Intel could be convinced to get rid of that in a
> future CPU and allow write-only memory?

Hmm, I'm not sure. I can try to pass it along.

> BTW, is your patch checking for support in IA32_VMX_EPT_VPID_CAP?  I
> didn't notice it, but I didn't look that hard.

Yep, there was already a helper: cpu_has_vmx_ept_execute_only().