linux-kernel - Re: [PATCH 4/4] x86,module: Detect CRn and DRn manipulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Apr 2020 10:56:32 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Christoph Hellwig <hch@...radead.org>,
        Steven Rostedt <rostedt@...dmis.org>, tglx@...utronix.de,
        linux-kernel@...r.kernel.org, sean.j.christopherson@...el.com,
        mingo@...hat.com, bp@...en8.de, hpa@...or.com, x86@...nel.org,
        kenny@...ix.com, jeyu@...nel.org, rasmus.villemoes@...vas.dk,
        fenghua.yu@...el.com, xiaoyao.li@...el.com, nadav.amit@...il.com,
        thellstrom@...are.com, tony.luck@...el.com,
        gregkh@...uxfoundation.org, jannh@...gle.com,
        keescook@...omium.org, David.Laight@...lab.com,
        dcovelli@...are.com, mhiramat@...nel.org
Subject: Re: [PATCH 4/4] x86,module: Detect CRn and DRn manipulation

On Wed, Apr 08, 2020 at 06:15:48PM +0200, Paolo Bonzini wrote:
> On 08/04/20 17:46, Christoph Hellwig wrote:

> > Scanning all modules seems safer.  While we're at it - can be move the
> > kvm bits using VMX to be always in the core kernel and just forbid
> > modules from using those instructions entirely?
> 
> I suppose we could use PVOPS-style patching for the more
> performance-critical cases, but VMREAD/VMWRITE does not seem like a
> particularly bad thing to allow modules and VMLAUNCH/VMRESUME have very
> peculiar calling conventions around them.
> 
> However, I wouldn't mind it if VMCLEAR/VMPTRLD and the associated kdump
> cleanup code were moved to core kernel code.

Speaking with my virt ignorance hat on, how impossible is it to provide
generic/useful VMLAUNCH/VMRESUME wrappers?

Because a lot of what happens around VMEXIT/VMENTER is very much like
the userspace entry crud, as per that series from Thomas that fixes all
that. And surely we don't need various broken copies of that in all the
out-of-tree hypervisors.

Also, I suppose if you have this, we no longer need to excempt CR2.