Messages in this thread | | | Subject | Re: [PATCH 4/4] x86,module: Detect CRn and DRn manipulation | From | Paolo Bonzini <> | Date | Wed, 8 Apr 2020 10:03:12 +0200 |
| |
On 08/04/20 07:58, Jan Kiszka wrote: >>> >>> + if (insn_is_mov_CRn(&insn) || insn_is_mov_DRn(&insn)) { >>> + pr_err("Module writes to CRn or DRn, please use the >>> proper accessors: %s\n", mod->name); >>> + return -ENOEXEC; >>> + } >> >> Hmm, wont this break jailhouse? > > Yes, possibly. We load the hypervisor binary via request_firmware into > executable memory and then jump into it. So most of the "suspicious" > code is there - except two cr4_init_shadow() calls to propagate the > non-transparent update of VMXE into that shadow. We could hide that CR4 > flag, but that could mislead root Linux to try to use VMX while in jail.
Why not contribute the Jailhouse loader into Linux?
Paolo
| |