OrgACRN
/
acrn-hypervisor
mirror of https://github.com/projectacrn/acrn-hypervisor.git
1
0
Fork 0
Code Issues Releases Wiki Activity
acrn-hypervisor/hypervisor/include/arch/x86/asm/security.h

39 lines
782 B
C
Raw Normal View History

move security related funcs into security.c there are still some security related funcs in cpu_caps.c & cpu.c, move them out into security.c. Changes to be committed: modified: Makefile modified: arch/x86/cpu.c modified: arch/x86/cpu_caps.c modified: arch/x86/guest/vcpu.c new file: arch/x86/security.c modified: arch/x86/trusty.c modified: arch/x86/vmx_asm.S modified: include/arch/x86/cpu.h modified: include/arch/x86/cpu_caps.h modified: include/arch/x86/per_cpu.h new file: include/arch/x86/security.h Tracked-On: #1842 Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
2018-12-18 09:28:27 +08:00
/*
Remove "All rights reserved" string headers Many of the license and Intel copyright headers include the "All rights reserved" string. It is not relevant in the context of the BSD-3-Clause license that the code is released under. This patch removes those strings throughout the code (hypervisor, devicemodel and misc). Tracked-On: #7254 Signed-off-by: Geoffroy Van Cutsem <geoffroy.vancutsem@intel.com>
2022-04-05 18:59:24 +08:00
* Copyright (C) 2018 Intel Corporation.
move security related funcs into security.c there are still some security related funcs in cpu_caps.c & cpu.c, move them out into security.c. Changes to be committed: modified: Makefile modified: arch/x86/cpu.c modified: arch/x86/cpu_caps.c modified: arch/x86/guest/vcpu.c new file: arch/x86/security.c modified: arch/x86/trusty.c modified: arch/x86/vmx_asm.S modified: include/arch/x86/cpu.h modified: include/arch/x86/cpu_caps.h modified: include/arch/x86/per_cpu.h new file: include/arch/x86/security.h Tracked-On: #1842 Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
2018-12-18 09:28:27 +08:00
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef SECURITY_H
#define SECURITY_H
/* type of speculation control
* 0 - no speculation control support
hv: refine security capability detection function. ACRN hypervisor always print CPU microcode update warning message on KBL NUC platform, even after BIOS was updated to the latest. 'check_cpu_security_cap()' returns false if no ARCH_CAPABILITIES MSR support on current platform, but this MSR may not be available on some platforms. This patch is to remove this pre-condition. Tracked-On: #3317 Signed-off-by: Yonghua Huang <yonghua.huang@intel.com> Reviewed-by: Jason CJ Chen <jason.cj.chen@intel.com>
2019-07-02 13:21:07 +08:00
* 1 - raw IBRS + IBPB support
move security related funcs into security.c there are still some security related funcs in cpu_caps.c & cpu.c, move them out into security.c. Changes to be committed: modified: Makefile modified: arch/x86/cpu.c modified: arch/x86/cpu_caps.c modified: arch/x86/guest/vcpu.c new file: arch/x86/security.c modified: arch/x86/trusty.c modified: arch/x86/vmx_asm.S modified: include/arch/x86/cpu.h modified: include/arch/x86/cpu_caps.h modified: include/arch/x86/per_cpu.h new file: include/arch/x86/security.h Tracked-On: #1842 Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
2018-12-18 09:28:27 +08:00
* 2 - with STIBP optimization support
*/
#define IBRS_NONE 0
#define IBRS_RAW 1
#define IBRS_OPT 2
#ifndef ASSEMBLER
Make ibrs_type as internal variable add get_ibrs_type API to get ibrs type. this patch fix Misra C violation: filename:/hypervisor/arch/x86/security.c function:None offset:19: reason:Variable should be declared static. : ibrs_type Tracked-On: #861 Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
2018-12-18 14:18:38 +08:00
int32_t get_ibrs_type(void);
move security related funcs into security.c there are still some security related funcs in cpu_caps.c & cpu.c, move them out into security.c. Changes to be committed: modified: Makefile modified: arch/x86/cpu.c modified: arch/x86/cpu_caps.c modified: arch/x86/guest/vcpu.c new file: arch/x86/security.c modified: arch/x86/trusty.c modified: arch/x86/vmx_asm.S modified: include/arch/x86/cpu.h modified: include/arch/x86/cpu_caps.h modified: include/arch/x86/per_cpu.h new file: include/arch/x86/security.h Tracked-On: #1842 Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
2018-12-18 09:28:27 +08:00
void cpu_l1d_flush(void);
bool check_cpu_security_cap(void);
hv: Mitigation for CPU MDS vulnerabilities. Microarchitectural Data Sampling (MDS) is a hardware vulnerability which allows unprivileged speculative access to data which is available in various CPU internal buffers. 1. Mitigation on ACRN: 1) Microcode update is required. 2) Clear CPU internal buffers (store buffer, load buffer and load port) if current CPU is affected by MDS, when VM entry to avoid any information leakage to guest thru above buffers. 3) Mitigation is not needed if ARCH_CAP_MDS_NO bit (bit5) is set in IA32_ARCH_CAPABILITIES MSR (10AH), in this case, current processor is no affected by MDS vulnerability, in other cases mitigation for MDS is required. 2. Methods to clear CPU buffers (microcode update is required): 1) L1D cache flush 2) VERW instruction Either of above operations will trigger clearing all CPU internal buffers if this CPU is affected by MDS. Above mechnism is enumerated by: CPUID.(EAX=7H, ECX=0):EDX[MD_CLEAR=10]. 3. Mitigation details on ACRN: if (processor is affected by MDS) if (processor is not affected by L1TF OR L1D flush is not launched on VM Entry) execute VERW instruction when VM entry. endif endif 4. Referrence: Deep Dive: Intel Analysis of Microarchitectural Data Sampling https://software.intel.com/security-software-guidance/insights/ deep-dive-intel-analysis-microarchitectural-data-sampling Deep Dive: CPUID Enumeration and Architectural MSRs https://software.intel.com/security-software-guidance/insights/ deep-dive-cpuid-enumeration-and-architectural-msrs Tracked-On: #3317 Signed-off-by: Yonghua Huang <yonghua.huang@intel.com> Reviewed-by: Anthony Xu <anthony.xu@intel.com> Reviewed-by: Jason CJ Chen <jason.cj.chen@intel.com>
2019-07-02 14:06:09 +08:00
void cpu_internal_buffers_clear(void);
hv: ept: apply MCE on page size change mitigation conditionally Only apply the software workaround on the models that might be affected by MCE on page size change. For these models that are known immune to the issue, the mitigation is turned off. Atom processors are not afftected by the issue. Also check the CPUID & MSR to check whether the model is immune to the issue: CPU is not vulnerable when both CPUID.(EAX=07H,ECX=0H).EDX[29] and IA32_ARCH_CAPABILITIES[IF_PSCHANGE_MC_NO] are 1. Other cases not listed above, CPU may be vulnerable. This patch also changes MACROs for MSR IA32_ARCH_CAPABILITIES bits to UL instead of U since the MSR is 64bit. Tracked-On: #4101 Signed-off-by: Binbin Wu <binbin.wu@intel.com> Acked-by: Eddie Dong <eddie.dong@intel.com>
2019-11-08 09:30:06 +08:00
bool is_ept_force_4k_ipage(void);
hv: keylocker: Support Key Locker feature for guest VM KeyLocker is a new security feature available in new Intel CPUs that protects data-encryption keys for the Advanced Encryption Standard (AES) algorithm. These keys are more valuable than what they guard. If stolen once, the key can be repeatedly used even on another system and even after vulnerability closed. It also introduces a CPU-internal wrapping key (IWKey), which is a key- encryption key to wrap AES keys into handles. While the IWKey is inaccessible to software, randomizing the value during the boot-time helps its value unpredictable. Keylocker usage: - New “ENCODEKEY” instructions take original key input and returns HANDLE crypted by an internal wrap key (IWKey, init by “LOADIWKEY” instruction) - Software can then delete the original key from memory - Early in boot/software, less likely to have vulnerability that allows stealing original key - Later encrypt/decrypt can use the HANDLE through new AES KeyLocker instructions - Note: * Software can use original key without knowing it (use HANDLE) * HANDLE cannot be used on other systems or after warm/cold reset * IWKey cannot be read from CPU after it's loaded (this is the nature of this feature) and only 1 copy of IWKey inside CPU. The virtualization implementation of Key Locker on ACRN is: - Each vCPU has a 'struct iwkey' to store its IWKey in struct acrn_vcpu_arch. - At initilization, every vCPU is created with a random IWKey. - Hypervisor traps the execution of LOADIWKEY (by 'LOADIWKEY exiting' VM-exectuion control) of vCPU to capture and save the IWKey if guest set a new IWKey. Don't support randomization (emulate CPUID to disable) of the LOADIWKEY as hypervisor cannot capture and save the random IWKey. From keylocker spec: "Note that a VMM may wish to enumerate no support for HW random IWKeys to the guest (i.e. enumerate CPUID.19H:ECX[1] as 0) as such IWKeys cannot be easily context switched. A guest ENCODEKEY will return the type of IWKey used (IWKey.KeySource) and thus will notice if a VMM virtualized a HW random IWKey with a SW specified IWKey." - In context_switch_in() of each vCPU, hypervisor loads that vCPU's IWKey into pCPU by LOADIWKEY instruction. - There is an assumption that ACRN hypervisor will never use the KeyLocker feature itself. This patch implements the vCPU's IWKey management and the next patch implements host context save/restore IWKey logic. Tracked-On: #5695 Signed-off-by: Shuo A Liu <shuo.a.liu@intel.com> Acked-by: Eddie Dong <eddie.dong@intel.com>
2020-08-24 20:20:43 +08:00
uint64_t get_random_value(void);
move security related funcs into security.c there are still some security related funcs in cpu_caps.c & cpu.c, move them out into security.c. Changes to be committed: modified: Makefile modified: arch/x86/cpu.c modified: arch/x86/cpu_caps.c modified: arch/x86/guest/vcpu.c new file: arch/x86/security.c modified: arch/x86/trusty.c modified: arch/x86/vmx_asm.S modified: include/arch/x86/cpu.h modified: include/arch/x86/cpu_caps.h modified: include/arch/x86/per_cpu.h new file: include/arch/x86/security.h Tracked-On: #1842 Signed-off-by: Jason Chen CJ <jason.cj.chen@intel.com>
2018-12-18 09:28:27 +08:00
#ifdef STACK_PROTECTOR
struct stack_canary {
/* Gcc generates extra code, using [fs:40] to access canary */
uint8_t reserved[40];
uint64_t canary;
};
void set_fs_base(void);
#endif
#endif /* ASSEMBLER */
#endif /* SECURITY_H */