linux-kernel - [PATCH 0/3] Include MKTME KeyID bits to MMU shadow_zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Apr 2022 23:17:01 +1200
From:   Kai Huang <kai.huang@...el.com>
To:     kvm@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, pbonzini@...hat.com,
        seanjc@...gle.com, vkuznets@...hat.com, jmattson@...gle.com,
        joro@...tes.org, wanpengli@...cent.com
Subject: [PATCH 0/3] Include MKTME KeyID bits to MMU shadow_zero_check

Host kernel never sets any Intel MKTME KeyID bits (including TDX KeyID
bits) in any mapping.  KVM should not set any of them to MMU's SPTE which
maps to guest memory either.  KVM MMU has shadow_zero_check which
contains those bits must be 0 for SPTE.  This series adds MKTME bits to
shadow_zero_check.  The first patch is not directly needed but looks
better to have IMHO.  Patch 02/03 actually do the job.

Sanity tested by creating normal VMs on TDX capable machine (with TDX
turned on).  However this is not tested on AMD machine since I don't have
access to any, though the risk should be very small I suppose.

Kai Huang (3):
  KVM: x86/mmu: Rename reset_rsvds_bits_mask()
  KVM: x86/mmu: Add shadow_me_value and repurpose shadow_me_mask
  KVM: VMX: Include MKTME KeyID bits to shadow_zero_check

 arch/x86/kvm/mmu.h      | 20 ++++++++++++++++++++
 arch/x86/kvm/mmu/mmu.c  | 22 +++++++++++++++-------
 arch/x86/kvm/mmu/spte.c | 40 ++++++++++++++++------------------------
 arch/x86/kvm/mmu/spte.h |  1 +
 arch/x86/kvm/svm/svm.c  |  3 +++
 arch/x86/kvm/vmx/vmx.c  | 31 +++++++++++++++++++++++++++++++
 6 files changed, 86 insertions(+), 31 deletions(-)

-- 
2.35.1