On 6/17/20 12:07 PM, John Andersen wrote: > +#define KVM_CR0_PIN_ALLOWED (X86_CR0_WP) > +#define KVM_CR4_PIN_ALLOWED (X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP) Why *is* there an allowed set? Why don't we just allow everything? Shouldn't we also pin any unknown bits? The CR4.FSGSBASE bit is an example of something that showed up CPUs without Linux knowing about it. If set, it causes problems. This set couldn't have helped FSGSBASE because it is not in the allowed set. Let's say Intel loses its marbles and adds a CR4 bit that lets userspace write to kernel memory. Linux won't set it, but an attacker would go after it, first thing.
