On 4/20/2023 9:37 PM, Zeng Guang wrote:
Linear Address Space Separation (LASS)[1] is a new mechanism that
enforces the same mode-based protections as paging, i.e. SMAP/SMEP but
without traversing the paging structures. Because the protections
enforced by LASS are applied before paging, "probes" by malicious
software will provide no paging-based timing information.
LASS works in long mode and partitions the 64-bit canonical linear
address space into two halves:
1. Lower half (LA[63]=0) --> user space
2. Upper half (LA[63]=1) --> kernel space
When LASS is enabled, a general protection #GP fault or a stack fault
#SS will be generated if software accesses the address from the half
in which it resides to another half,
The accessor's mode is based on CPL, not the address range,
so it feels a bit inaccurate of descripton "in which it resides".
e.g., either from user space to
upper half, or from kernel space to lower half. This protection applies
to data access, code execution.
This series add KVM LASS virtualization support.
When platform has LASS capability, KVM requires to expose this feature
to guest VM enumerated by CPUID.(EAX=07H.ECX=1):EAX.LASS[bit 6], and
allow guest to enable it via CR4.LASS[bit 27] on demand. For instruction
executed in the guest directly, hardware will perform the LASS violation
check, while KVM also needs to apply LASS to instructions emulated by
software and injects #GP or #SS fault to the guest.
Following LASS voilations check will be taken on KVM emulation path.
/s/voilations/violations
User-mode access to supervisor space address:
LA[bit 63] && (CPL == 3)
Supervisor-mode access to user space address:
Instruction fetch: !LA[bit 63] && (CPL < 3)
Data access: !LA[bit 63] && (CR4.SMAP==1) && ((RFLAGS.AC == 0 &&
CPL < 3) || Implicit supervisor access)
We tested the basic function of LASS virtualization including LASS
enumeration and enabling in non-root and nested environment. As current
KVM unittest framework is not compatible to LASS rule that kernel should
run in the upper half, we use kernel module and application test to verify
LASS functionalities in guest instead. The data access related x86 emulator
code is verified with forced emulation prefix (FEP) mechanism. Other test
cases are working in progress.
How to add tests for LASS in KUT or kselftest is still under investigation.
[1] Intel Architecutre Instruction Set Extensions and Future Features
/s/Architecutre/Architecture
Programming Reference: Chapter Linear Address Space Separation (LASS)
https://cdrdv2.intel.com/v1/dl/getContent/671368
Zeng Guang (6):
KVM: x86: Virtualize CR4.LASS
KVM: VMX: Add new ops in kvm_x86_ops for LASS violation check
KVM: x86: Add emulator helper for LASS violation check
KVM: x86: LASS protection on KVM emulation when LASS enabled
KVM: x86: Advertise LASS CPUID to user space
KVM: x86: Set KVM LASS based on hardware capability
arch/x86/include/asm/cpuid.h | 36 +++++++++++++++++++
arch/x86/include/asm/kvm-x86-ops.h | 1 +
arch/x86/include/asm/kvm_host.h | 7 +++-
arch/x86/kvm/cpuid.c | 8 +++--
arch/x86/kvm/emulate.c | 36 ++++++++++++++++---
arch/x86/kvm/kvm_emulate.h | 1 +
arch/x86/kvm/vmx/nested.c | 3 ++
arch/x86/kvm/vmx/sgx.c | 2 ++
arch/x86/kvm/vmx/vmx.c | 58 ++++++++++++++++++++++++++++++
arch/x86/kvm/vmx/vmx.h | 2 ++
arch/x86/kvm/x86.c | 9 +++++
arch/x86/kvm/x86.h | 2 ++
12 files changed, 157 insertions(+), 8 deletions(-)
