[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7c7f7ad7-d8ee-cf12-9ec6-1a1d20b2e653@infradead.org>
Date: Thu, 19 Jul 2018 18:11:11 -0700
From: Randy Dunlap <rdunlap@...radead.org>
To: Ahmed Abd El Mawgood <ahmedsoliman0x666@...il.com>, kvm@...r.kernel.org,
Kernel Hardening <kernel-hardening@...ts.openwall.com>,
virtualization@...ts.linux-foundation.org, linux-doc@...r.kernel.org,
x86@...nel.org
Cc: Paolo Bonzini <pbonzini@...hat.com>, rkrcmar@...hat.com,
nathan Corbet <corbet@....net>, Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, hpa@...or.com,
Kees Cook <keescook@...omium.org>, Ard Biesheuvel
<ard.biesheuvel@...aro.org>, David Hildenbrand <david@...hat.com>,
Boris Lukashev <blukashev@...pervictus.com>,
David Vrabel <david.vrabel@...anix.com>, nigel.edwards@....com,
Rik van Riel <riel@...riel.com>
Subject: Re: [PATCH 1/3] [RFC V3] KVM: X86: Memory ROE documentation
On 07/19/2018 02:38 PM, Ahmed Abd El Mawgood wrote:
> Documentation/virtual/kvm/hypercalls.txt | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/Documentation/virtual/kvm/hypercalls.txt b/Documentation/virtual/kvm/hypercalls.txt
> index a890529c63ed..a9db68adb7c9 100644
> --- a/Documentation/virtual/kvm/hypercalls.txt
> +++ b/Documentation/virtual/kvm/hypercalls.txt
> @@ -121,3 +121,17 @@ compute the CLOCK_REALTIME for its clock, at the same instant.
>
> Returns KVM_EOPNOTSUPP if the host does not use TSC clocksource,
> or if clock type is different than KVM_CLOCK_PAIRING_WALLCLOCK.
> +
> +7. KVM_HC_HMROE
> +----------------
> +Architecture: x86
> +Status: active
> +Purpose: Hypercall used to apply Read-Only Enforcement to guest pages
> +Usage:
> + a0: start address of page that should be protected.
Is this done one page per call? No grouping, no multiple pages?
> +
> +This hypercall lets a guest kernel to have part of its read/write memory
lets a guest kernel have part of
> +converted into read-only. This action is irreversible. KVM_HC_HMROE can
> +not be triggered from guest Ring 3 (user mode). The reason is that user
> +mode malicious software can make use of it enforce read only protection on
make use of it to enforce
> +an arbitrary memory page thus crashing the kernel.
>
--
~Randy
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
