I guess the GCC warning is a false positive?
See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116494
On Sat, Jan 04, 2025 at 07:26:27AM +0800, kernel test robot wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> master
> head: 0bc21e701a6ffacfdde7f04f87d664d82
On Mon, Jul 15, 2024 at 09:11:35AM -0700, Kees Cook wrote:
> On Mon, Jul 15, 2024 at 02:20:59PM +0200, Mickaël Salaün wrote:
> > On Mon, Jul 15, 2024 at 01:16:38PM +0200, Greg Kroah-Hartman wrote:
> > > On Mon, Jul 15, 2024 at 12:37:53PM +0200, Mickaël Salaün wr
On Mon, Jul 15, 2024 at 01:16:38PM +0200, Greg Kroah-Hartman wrote:
> On Mon, Jul 15, 2024 at 12:37:53PM +0200, Mickaël Salaün wrote:
> > Hello,
> >
> > AFAIK, commit 88da52ccd66e ("landlock: Fix d_parent walk") doesn't fix a
> > security issue but an un
On Wed, May 15, 2024 at 01:32:24PM -0700, Sean Christopherson wrote:
> On Tue, May 14, 2024, Mickaël Salaün wrote:
> > On Fri, May 10, 2024 at 10:07:00AM +, Nicolas Saenz Julienne wrote:
> > > Development happens
> > > https://github.com/vianpl/{linux,qemu,kvm-u
On Fri, May 10, 2024 at 10:07:00AM +, Nicolas Saenz Julienne wrote:
> On Tue May 7, 2024 at 4:16 PM UTC, Sean Christopherson wrote:
> > > If yes, that would indeed require a *lot* of work for something we're not
> > > sure will be accepted later on.
> >
> > Yes and no. The AWS folks are pursui
On Tue, May 07, 2024 at 09:16:06AM -0700, Sean Christopherson wrote:
> On Tue, May 07, 2024, Mickaël Salaün wrote:
> > > Actually, potential bad/crazy idea. Why does the _host_ need to define
> > > policy?
> > > Linux already knows what assets it wants to
On Mon, May 06, 2024 at 06:34:53PM GMT, Sean Christopherson wrote:
> On Mon, May 06, 2024, Mickaël Salaün wrote:
> > On Fri, May 03, 2024 at 07:03:21AM GMT, Sean Christopherson wrote:
> > > > ---
> > > >
> > > > Changes since v1:
> > > > *
On Fri, May 03, 2024 at 07:03:21AM GMT, Sean Christopherson wrote:
> On Fri, May 03, 2024, Mickaël Salaün wrote:
> > Add an interface for user space to be notified about guests' Heki policy
> > and related violations.
> >
> > Extend the KVM_ENABLE_CAP IOCTL
ule: heki_test
1..1
ok 1 test_cr_disable_smep
ok 1 heki_x86
Link: https://lore.kernel.org/r/20240229170409.365386-2-...@digikod.net [1]
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240503131910.307630-6-...@digikod.net
---
Changes since v2:
* Make tests standalo
Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Madhavan T. Venkataraman
Signed-off-by: Madhavan T. Venkataraman
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240503131910.307630-5-...@digikod.net
---
Changes since v2
van T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240503131910.307630-4-...@digikod.net
---
Changes since v1:
* New patch. Making user space aware of Heki propertie
related
features.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r
Kees Cook
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Mickaël Salaün
Signed-off-by: Mickaël Salaün
Signed-off-by: Madhavan T. Venkataraman
Link: https://lore.kernel.org/r/20240503131910.307630-2-...@digikod.net
---
Chan
ikod.net
v1: https://lore.kernel.org/r/20230505152046.6575-1-...@digikod.net
Regards,
Madhavan T. Venkataraman (1):
virt: Introduce Hypervisor Enforced Kernel Integrity (Heki)
Mickaël Salaün (4):
KVM: x86: Add new hypercall to lock control registers
KVM: x86: Add notifications for Heki poli
On Fri, Apr 19, 2024 at 04:38:01PM -0700, Guenter Roeck wrote:
> On Fri, Apr 19, 2024 at 03:33:49PM -0700, Guenter Roeck wrote:
> > Hi,
> >
> > On Tue, Mar 19, 2024 at 11:48:57AM +0100, Mickaël Salaün wrote:
> > > Add a test case to check NULL pointer dere
On Fri, Apr 05, 2024 at 10:08:00AM -0600, Shuah Khan wrote:
> On 3/26/24 03:51, Mickaël Salaün wrote:
> > Hi,
> >
> > This patch series teaches KUnit to handle kthread faults as errors, and
> > it brings a few related fixes and improvements.
> >
> > Shuah,
by: David Gow
Tested-by: Rae Moar
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240326095118.126696-5-...@digikod.net
---
Changes since v3:
* Export kthread_exit() for KUnit tests built as module, as suggested by
David.
Changes since v2:
* s/-EFAULT/-EINTR/ in commit message
eviewed-by: David Gow
Reviewed-by: Rae Moar
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240326095118.126696-3-...@digikod.net
---
Changes since v2:
* Add Fixes tag as suggested by David.
* Add David's and Rae's Reviewed-by.
Changes since v1:
* Add Kees's Review
/testing/kunit/kunit.py run --arch arm64 \
--cross_compile=aarch64-linux-gnu- kunit_fault
Cc: Brendan Higgins
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: David Gow
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240326095118.126696-8-...@digikod.net
---
Changes since v2:
* Add
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240326095118.126696-7-...@digikod.net
---
Changes since v3:
* Improve the try-fault error message as suggested by David.
Changes since v2:
* Extend the commit message according to discussion with David.
Changes
Fix KUNIT_SUCCESS() calls to pass a test argument.
This is a no-op for now because this macro does nothing, but it will be
required for the next commit.
Cc: Brendan Higgins
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: David Gow
Signed-off-by: Mickaël Salaün
Link: https
org/r/20240229170409.365386-1-...@digikod.net
Regards,
Mickaël Salaün (7):
kunit: Handle thread creation error
kunit: Fix kthread reference
kunit: Fix timeout message
kunit: Handle test faults
kunit: Fix KUNIT_SUCCESS() calls in iov_iter tests
kunit: Print last test location on fault
kunit
The exit code is always checked, so let's properly handle the -ETIMEDOUT
error code.
Cc: Brendan Higgins
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: David Gow
Reviewed-by: Rae Moar
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240326095118.126696-4-...@digiko
ernal error occurred...".
Cc: Brendan Higgins
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: Rae Moar
Reviewed-by: David Gow
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240326095118.126696-2-...@digikod.net
---
Changes since v2:
* Add Rae's and Davi
On Sat, Mar 23, 2024 at 03:37:21PM +0800, David Gow wrote:
> On Tue, 19 Mar 2024 at 18:49, Mickaël Salaün wrote:
> >
> > Previously, when a kernel test thread crashed (e.g. NULL pointer
> > dereference, general protection fault), the KUnit test hanged for 30
> > second
Fix KUNIT_SUCCESS() calls to pass a test argument.
This is a no-op for now because this macro does nothing, but it will be
required for the next commit.
Cc: Brendan Higgins
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: David Gow
Signed-off-by: Mickaël Salaün
Link: https
On Mon, Mar 18, 2024 at 10:50:42AM +0100, Alejandro Colomar wrote:
> Hi Mickaël, Günther,
>
> Sorry for the delay!
>
> On Thu, Mar 07, 2024 at 11:21:57AM +0100, Mickaël Salaün wrote:
> > CCing Alejandro
> >
> > On Tue, Feb 27, 2024 at 05:32:20PM +0100, Günther
it clear.
Fix the -EINTR error message, which couldn't be reached until now.
This is tested with a following patch.
Cc: Brendan Higgins
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: David Gow
Tested-by: Rae Moar
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/2024031
The exit code is always checked, so let's properly handle the -ETIMEDOUT
error code.
Cc: Brendan Higgins
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: David Gow
Reviewed-by: Rae Moar
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240319104857.70783-4-...@digiko
/testing/kunit/kunit.py run --arch arm64 \
--cross_compile=aarch64-linux-gnu- kunit_fault
Cc: Brendan Higgins
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: David Gow
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240319104857.70783-8-...@digikod.net
---
Changes since v2:
* Add
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240319104857.70783-7-...@digikod.net
---
Changes since v2:
* Extend the commit message according to discussion with David.
Changes since v1:
* Add Kees's Reviewed-by.
---
include/kunit/test.h
org/r/20240229170409.365386-1-...@digikod.net
Regards,
Mickaël Salaün (7):
kunit: Handle thread creation error
kunit: Fix kthread reference
kunit: Fix timeout message
kunit: Handle test faults
kunit: Fix KUNIT_SUCCESS() calls in iov_iter tests
kunit: Print last test location on fault
kunit
eviewed-by: David Gow
Reviewed-by: Rae Moar
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240319104857.70783-3-...@digikod.net
---
Changes since v2:
* Add Fixes tag as suggested by David.
* Add David's and Rae's Reviewed-by.
Changes since v1:
* Add Kees's Review
ernal error occurred...".
Cc: Brendan Higgins
Cc: Shuah Khan
Reviewed-by: Kees Cook
Reviewed-by: Rae Moar
Reviewed-by: David Gow
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240319104857.70783-2-...@digikod.net
---
Changes since v2:
* Add Rae's and David's R
On Tue, Mar 12, 2024 at 12:54:48PM +0800, David Gow wrote:
> On Sat, 2 Mar 2024 at 03:40, Mickaël Salaün wrote:
> >
> > This helps identify the location of test faults.
> >
> > Cc: Brendan Higgins
> > Cc: David Gow
> > Cc: Rae Moar
> > Cc: Shuah Kha
On Tue, Mar 12, 2024 at 01:05:37PM +0800, David Gow wrote:
> On Sat, 2 Mar 2024 at 03:40, Mickaël Salaün wrote:
> >
> > Previously, when a kernel test thread crashed (e.g. NULL pointer
> > dereference, general protection fault), the KUnit test hanged for 30
> > second
On Mon, Mar 11, 2024 at 05:21:11PM -0400, Rae Moar wrote:
> On Fri, Mar 1, 2024 at 2:40 PM Mickaël Salaün wrote:
> >
> > Previously, when a kernel test thread crashed (e.g. NULL pointer
> > dereference, general protection fault), the KUnit test hanged for 30
> > second
CCing Alejandro
On Tue, Feb 27, 2024 at 05:32:20PM +0100, Günther Noack wrote:
> On Tue, Feb 27, 2024 at 12:05:49PM +0100, Mickaël Salaün wrote:
> > Extend the kernel support section with one subsection for build time
> > configuration and another for boot time configuration.
>
This helps identify the location of test faults.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240301194037.532117-7-...@digikod.net
---
Changes since v1:
* Added Kees's Review
/testing/kunit/kunit.py run --arch arm64 \
--cross_compile=aarch64-linux-gnu- kunit_fault
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240301194037.532117-8-...@digikod.net
---
Changes since v1:
* Removed the rodata
Fix KUNIT_SUCCESS() calls to pass a test argument.
This is a no-op for now because this macro does nothing, but it will be
required for the next commit.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https
make it clear.
Fix the -EINTR error message, which couldn't be reached until now.
This is tested with a following patch.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/2024030119
case check NULL pointer dereference, which wasn't possible
before.
This is useful to test current kernel self-protection mechanisms or
future ones such as Heki: https://github.com/heki-linux
Previous version:
v1: https://lore.kernel.org/r/20240229170409.365386-1-...@digikod.net
Regards,
Mickaël
The exit code is always checked, so let's properly handle the -ETIMEDOUT
error code.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240301194037.532117-4-...@digikod.net
---
Changes
There is a race condition when a kthread finishes after the deadline and
before the call to kthread_stop(), which may lead to use after free.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r
ernal error occurred...".
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Reviewed-by: Kees Cook
Signed-off-by: Mickaël Salaün
Link: https://lore.kernel.org/r/20240301194037.532117-2-...@digikod.net
---
Changes since v1:
* Added Kees's Reviewed-by.
---
lib/kunit/
On Fri, Mar 01, 2024 at 03:15:08PM +0800, David Gow wrote:
> On Fri, 1 Mar 2024 at 01:04, Mickaël Salaün wrote:
> >
> > Hi,
> >
>
> Thanks very much. I think there's a lot going on in this series, and
> it'd probably be easier to address if it were broke
On Thu, Feb 29, 2024 at 10:28:18AM -0800, Kees Cook wrote:
> On Thu, Feb 29, 2024 at 06:04:09PM +0100, Mickaël Salaün wrote:
> > The first test checks NULL pointer dereference and make sure it would
> > result as a failed test.
> >
> > The second and third tests c
On Thu, Feb 29, 2024 at 10:24:19AM -0800, Kees Cook wrote:
> On Thu, Feb 29, 2024 at 06:04:06PM +0100, Mickaël Salaün wrote:
> > Previously, when a kernel test thread crashed (e.g. NULL pointer
> > dereference, general protection fault), the KUnit test hanged for 30
> > seco
On Fri, Mar 01, 2024 at 03:14:49PM +0800, David Gow wrote:
> On Fri, 1 Mar 2024 at 01:04, Mickaël Salaün wrote:
> >
> > Run all the KUnit tests just before the first userspace code is
> > launched. This makes it it possible to write new tests that check the
> > ke
-x86 native architecture. It is then skipped on UML because such
test would result to a kernel panic.
Tested with:
./tools/testing/kunit/kunit.py run --arch x86_64 kunit_x86_fault
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
lib/kunit/kunit
Fix KUNIT_SUCCESS() calls to pass a test argument.
This is a no-op for now because this macro does nothing, but it will be
required for the next commit.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
lib/kunit_iov_iter.c | 18
make it clear.
Fix the -EINTR error message, which couldn't be reached until now.
This is tested with a following patch.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
include/kunit/try-catch.h | 3 ---
lib/kunit/try-catch.c | 14
ernal error occurred...".
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
lib/kunit/try-catch.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
index f7825991d576..a5cb2ef70a25 100644
--- a
This helps identify the location of test faults.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
include/kunit/test.h | 24 +---
lib/kunit/try-catch.c | 10 +++---
2 files changed, 28 insertions(+), 6 deletions
Cook
Cc: Luis Chamberlain
Cc: Marco Pagani
Cc: Rae Moar
Cc: Shuah Khan
Cc: Stephen Boyd
Signed-off-by: Mickaël Salaün
---
init/main.c | 4 +-
lib/bitfield_kunit.c| 8 +--
lib/checksum_kunit.c| 2 +-
lib/kunit/executor.c
The exit code is always checked, so let's properly handle the -ETIMEDOUT
error code.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
lib/kunit/try-catch.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/kuni
There is a race condition when a kthread finishes after the deadline and
before the call to kthread_stop(), which may lead to use after free.
Cc: Brendan Higgins
Cc: David Gow
Cc: Rae Moar
Cc: Shuah Khan
Signed-off-by: Mickaël Salaün
---
lib/kunit/try-catch.c | 9 ++---
1 file changed
,
and it brings a few related fixes and improvements.
New tests check NULL pointer dereference and read-only memory, which
wasn't possible before.
This is useful to test current kernel self-protection mechanisms or
future ones such as Heki: https://github.com/heki-linux
Regards,
Mickaël Sala
Extend the kernel support section with one subsection for build time
configuration and another for boot time configuration.
Extend the boot time subsection with a concrete example.
Update the journalctl command to include the boot option.
Cc: Günther Noack
Cc: Kees Cook
Signed-off-by: Mickaël
with outdated "lsm" kernel's command-line parameter.
Cc: sta...@vger.kernel.org
Fixes: 265885daf3e5 ("landlock: Add syscall implementations")
Reviewed-by: Kees Cook
Reviewed-by: Günther Noack
Signed-off-by: Mickaël Salaün
---
Changes since v1:
* Add Kees's
On Mon, Feb 19, 2024 at 01:07:48PM -0800, Kees Cook wrote:
> On Mon, Feb 19, 2024 at 08:18:04PM +0100, Mickaël Salaün wrote:
> > Because sandboxing can be used as an opportunistic security measure,
> > user space may not log unsupported features. Let the system
> > adm
On Wed, Feb 21, 2024 at 10:35:50PM +0100, Günther Noack wrote:
> Hello!
>
> I think this is a good idea.
> Some minor implementation remarks below.
>
> On Mon, Feb 19, 2024 at 08:18:04PM +0100, Mickaël Salaün wrote:
> > Because sandboxing can be used as an opport
with outdated "lsm" kernel's command-line parameter.
Cc: Günther Noack
Cc: sta...@vger.kernel.org
Fixes: 265885daf3e5 ("landlock: Add syscall implementations")
Signed-off-by: Mickaël Salaün
---
security/landlock/syscalls.c | 18 +++---
1 file changed, 15 inser
e
required access rights.
Cc: Arnd Bergmann
Cc: Christian Brauner
Cc: Günther Noack
Cc: Jann Horn
Cc: Shervin Oloumi
Cc: sta...@vger.kernel.org
Fixes: b91c3e4ea756 ("landlock: Add support for file reparenting with
LANDLOCK_ACCESS_FS_REFER")
Signed-off-by: Mickaël Salaün
---
securi
er to understand what is going on.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Mickaël Salaün
---
Ch
read-only.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Mickaël Salaün
Signed-off-by: Mickaël Salaün
modify the
instructions in that page.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Mickaël Salaün
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by
From: Madhavan T. Venkataraman
When permissions are changed on an existing mapping, update the
permissions counters.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Mickaël Salaün
Cc: Paolo Bonzini
Cc: Sean
Cook
Cc: Mickaël Salaün
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Madhavan T. Venkataraman
---
Changes since v1:
* New patch
---
include/linux/heki.h | 11 ++-
mm/vmalloc.c | 7 +++
virt/heki
from tampering by the guest kernel itself.
We should note that walking through all mappings might be slow if KASAN
is enabled.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Mickaël Salaün
Cc: Paolo Bonzini
Cc: Sean
: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Mickaël Salaün
Signed-off-by: Mickaël Salaün
Signed-off-by: Madhavan T. Venkataraman
---
Change since v1:
* New patch and new file: virt
rsion
thanks to extra mem_table_ops's merge() and split() operations.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Mickaël Salaün
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuz
: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Mickaël Salaün
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Madhavan T. Venkataraman
Signed-off-by: Madhavan T. Venkataraman
Signed-off-by
Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Mickaël Salaün
Signed-off-by: Mickaël Salaün
Signed-off-by: Madhavan T. Venkataraman
---
Changes since v1:
The original hypercall cont
This enables to check if an attribute is tied to any memory page in a
range. This will be useful in a folling commit to check for
KVM_MEMORY_ATTRIBUTE_HEKI_IMMUTABLE.
Cc: Chao Peng
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Sean Christopherson
Cc: Yu Zhang
Signed-off-by: Mickaël Salaün
topherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Mickaël Salaün
---
Changes since v1:
* Import the MMU tracepoint changes from the v1's "Enable guests to lock
themselves thanks to MBEC" patch.
---
arch/x86/include/asm/vmx.h | 11 +--
arc
butes() KVM_MEMORY_ATTRIBUTE_PRIVATE
optimizations.
Cc: Chao Peng
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Sean Christopherson
Cc: Yu Zhang
Signed-off-by: Mickaël Salaün
---
Changes since v1:
* New patch
---
arch/x86/kvm/mmu/mmu.c | 23 ---
include/linux/kvm_host.h | 2 ++
vir
Cîțu
Signed-off-by: Nicușor Cîțu
Signed-off-by: Mickaël Salaün
---
arch/x86/include/asm/kvm-x86-ops.h | 1 +
arch/x86/include/asm/kvm_host.h| 2 ++
arch/x86/kvm/svm/svm.c | 9 +
arch/x86/kvm/vmx/vmx.c | 10 ++
4 files changed, 22 insertions
Enable to only update a subset of attributes.
This is needed to be able to use the XArray for different use cases and
make sure they don't interfere (see a following commit).
Cc: Chao Peng
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Sean Christopherson
Cc: Yu Zhang
Signed-off-by: Mi
related
features.
Cc: Borislav Petkov
Cc: Dave Hansen
Cc: H. Peter Anvin
Cc: Ingo Molnar
Cc: Kees Cook
Cc: Madhavan T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Mickaël Salaün
---
Changes since v1:
* Guard
Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Madhavan T. Venkataraman
Signed-off-by: Madhavan T. Venkataraman
Signed-off-by: Mickaël Salaün
---
Changes since v1:
* Shrinked the patch to only manage the CR pinning.
---
arch/x86
Kees Cook
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Co-developed-by: Mickaël Salaün
Signed-off-by: Mickaël Salaün
Signed-off-by: Madhavan T. Venkataraman
---
Changes since v1:
* Shrinked this patch to only contain the minimal c
s for pages in
vmap()/vunmap()
heki: x86: Update permissions counters when guest page permissions
change
heki: x86: Update permissions counters during text patching
heki: x86: Protect guest kernel memory using the KVM hypervisor
Mickaël Salaün (10):
KVM: x86: Add new hypercall to lo
van T. Venkataraman
Cc: Paolo Bonzini
Cc: Sean Christopherson
Cc: Thomas Gleixner
Cc: Vitaly Kuznetsov
Cc: Wanpeng Li
Signed-off-by: Mickaël Salaün
---
Changes since v1:
* New patch. Making user space aware of Heki properties was requested by
Sean Christopherson.
---
arch/x86/kvm/vmx/vmx.c
On Wed, Nov 01, 2023 at 05:23:12PM +0100, Jann Horn wrote:
> On Wed, Nov 1, 2023 at 11:57 AM Mickaël Salaün wrote:
> > On Tue, Oct 31, 2023 at 09:40:59PM +0100, Stefan Bavendiek wrote:
> > > On Tue, Oct 24, 2023 at 11:07:14AM -0500, Serge E. Hallyn wrote:
> > > > I
On Tue, Oct 31, 2023 at 09:40:59PM +0100, Stefan Bavendiek wrote:
> On Tue, Oct 24, 2023 at 11:07:14AM -0500, Serge E. Hallyn wrote:
> > In 2005, before namespaces were upstreamed, I posted the 'bsdjail' LSM,
> > which briefly made it into the -mm kernel, but was eventually rejected as
> > being an
On Tue, Oct 24, 2023 at 11:07:14AM -0500, Serge E. Hallyn wrote:
> On Tue, Oct 24, 2023 at 10:29:17AM -0400, Paul Moore wrote:
> > On Tue, Oct 24, 2023 at 10:18 AM Serge E. Hallyn wrote:
> > > On Tue, Oct 24, 2023 at 10:14:29AM -0400, Paul Moore wrote:
> > > > On Tue, Oct 24, 2023 at 9:46 AM Serge
88 matches
Mail list logo
