From patchwork Fri Jul 20 23:31:28 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Soliman X-Patchwork-Id: 10538557 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B98DA603B5 for ; Fri, 20 Jul 2018 23:32:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ADE7628448 for ; Fri, 20 Jul 2018 23:32:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A1B4D28A27; Fri, 20 Jul 2018 23:32:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id D7B3928448 for ; Fri, 20 Jul 2018 23:32:58 +0000 (UTC) Received: (qmail 18392 invoked by uid 550); 20 Jul 2018 23:32:52 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 18303 invoked from network); 20 Jul 2018 23:32:50 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=uZEtkX0PPZKorG/JXchp6jfbakQsYoY5ofcxslL+ZhE=; b=LmsZvUZWQj41rO3IEkuuMK72gV2IIyXbNp+v+sf5wEfKKZ8G9eZfREAMan4wpiIBiH 4G1U1EiK8IKkBWl/NKPoSYjsM3OVSbkVqv2V72V/h4lOzlje+lsP0teVSnk4jnI71sYE b0Z+jkcXXtyPTFCX26ckj1ggjmH87o8+MErk4G2l3/wBS3KL9ypdBaZM+Fxb6iZ1PZLx pmuLStRf/1Nf6SMmbPesdXbAUAI03vRVbJFPHAvSPb0Z91b4RdgUYuhfY0W0EWERA+UP hLbXKu7rF4fIKE8FKpCAGEwtZlLleUJoW4UgkC1hAkWndzf26T+6YQAjSGO3mKrRzy7D t4cQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=uZEtkX0PPZKorG/JXchp6jfbakQsYoY5ofcxslL+ZhE=; b=V+VprdCHhWbTKJ1BiSAg6Eb3JqWMbK9Im4Gg/19Svb3nZmbqr/3S/DcgRHK2YfvcP1 /iVM2ZNqODKUR1yX3Dgd+soCj66gJwRCjWASuSmuUdp2VCLAX+r04mxVAQKvdhFTskV8 d70yTz1u+ZzAi1z077GOeHKjDX0zYoBKqvSnjoPbGHkVC2vtbTyYzESwjlarKExz5KmE hNJviy1jP2i0Wxc68CAGrE93kYzqYcs/v3l81m+hMStpbHo+MYRueXxYgPYIsWA/07mo 44xPJCM/GLp90pDbVSXhyZXP9DXRjsTdw78qLZi4WNGm7tqBkvw0/DAqABX8BVNvIfQU lYxQ== X-Gm-Message-State: AOUpUlE78xkQpQJ/AubdvfDOps+CjmaNvIb8zbL5Cs1O6EvnXMk5A8VQ y44DyEN/kP3rra4LleEKCNc= X-Google-Smtp-Source: AAOMgpfuB4en0+sTAwTnwUnAy/VSaHuqANm3ig6Gaw2dAiLUr5lwvCwEExWBI3EXiHhECkwq6EoxWw== X-Received: by 2002:a50:b5a5:: with SMTP id a34-v6mr4288680ede.88.1532129559636; Fri, 20 Jul 2018 16:32:39 -0700 (PDT) From: Ahmed Abd El Mawgood To: kvm@vger.kernel.org, Kernel Hardening , virtualization@lists.linux-foundation.org, linux-doc@vger.kernel.org, x86@kernel.org, xen-devel@lists.xensource.com Cc: Paolo Bonzini , rkrcmar@redhat.com, nathan Corbet , Thomas Gleixner , Ingo Molnar , hpa@zytor.com, Kees Cook , Ard Biesheuvel , David Hildenbrand , Boris Lukashev , David Vrabel , nigel.edwards@hpe.com, Rik van Riel , Ahmed Abd El Mawgood Subject: [PATCH RFC V4 1/3] KVM: X86: Memory ROE documentation Date: Sat, 21 Jul 2018 01:31:28 +0200 Message-Id: <20180720233130.14129-2-ahmedsoliman0x666@gmail.com> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20180720233130.14129-1-ahmedsoliman0x666@gmail.com> References: <20180720233130.14129-1-ahmedsoliman0x666@gmail.com> X-Virus-Scanned: ClamAV using ClamSMTP Following up with my previous threads on KVM assisted Anti rootkit protections. The current version doesn't address the attacks involving pages remapping. It is still design in progress, nevertheless, it will be in my later patch sets. Signed-off-by: Ahmed Abd El Mawgood --- Documentation/virtual/kvm/hypercalls.txt | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/Documentation/virtual/kvm/hypercalls.txt b/Documentation/virtual/kvm/hypercalls.txt index a890529c63ed..affd997eabfe 100644 --- a/Documentation/virtual/kvm/hypercalls.txt +++ b/Documentation/virtual/kvm/hypercalls.txt @@ -121,3 +121,17 @@ compute the CLOCK_REALTIME for its clock, at the same instant. Returns KVM_EOPNOTSUPP if the host does not use TSC clocksource, or if clock type is different than KVM_CLOCK_PAIRING_WALLCLOCK. + +7. KVM_HC_HMROE +---------------- +Architecture: x86 +Status: active +Purpose: Hypercall used to apply Read-Only Enforcement to guest pages +Usage: + a0: Start address aligned to page boundary. + a1: Number of pages to be protected. +This hypercall lets a guest kernel have part of its read/write memory +converted into read-only. This action is irreversible. KVM_HC_HMROE can +not be triggered from guest Ring 3 (user mode). The reason is that user +mode malicious software can make use of it to enforce read only protection +on an arbitrary memory page thus crashing the kernel.