linux-kernel - Re: [PATCH] KVM: x86: inject exceptions produced by x86_decode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Nov 2017 23:47:14 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Eduardo Habkost <ehabkost@...hat.com>
Cc:     Wanpeng Li <kernellwp@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        kvm <kvm@...r.kernel.org>, yfu@...hat.com
Subject: Re: [PATCH] KVM: x86: inject exceptions produced by x86_decode_insn

On 29/11/2017 19:42, Eduardo Habkost wrote:
> The reproducer (not a full test case) is quite simple, see patch below.

Great, thanks.  I assume that the patch doesn't fix it?!?

Paolo

> Now, I've noticed something interesting when running the
> reproducer:
> 
> If the test_fetch_failure() call happens before we touch
> pci-testdev through *mem (like in the patch below), we get an
> emulation failure like the one Yanan saw:
> 
>   $ /usr/bin/qemu-system-x86_64 -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -kernel ./x86/emulator.flat # -initrd /tmp/tmp.RCPjppRp8i
>   enabling apic
>   paging enabled
>   cr0 = 80010011
>   cr3 = 45e000
>   cr4 = 20
>   KVM internal error. Suberror: 1
>   emulation failure
>   RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=0000000000000000
>   RSI=0000000000000000 RDI=0000000000000000 RBP=0000000000000000 RSP=0000000000000000
>   R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000
>   R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000
>   RIP=ffffffffffffc08a RFL=00010002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
>   ES =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
>   CS =0008 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
>   SS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
>   DS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
>   FS =0010 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
>   GS =0010 0000000000454d60 ffffffff 00c09300 DPL=0 DS   [-WA]
>   LDT=0000 0000000000000000 0000ffff 00008200 DPL=0 LDT
>   TR =0080 000000000041148a 0000ffff 00008b00 DPL=0 TSS64-busy
>   GDT=     000000000041100a 0000047f
>   IDT=     0000000000000000 00000fff
>   CR0=80010011 CR2=ffffffffffffc08a CR3=000000000045e000 CR4=00000020
>   DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
>   DR6=00000000ffff0ff0 DR7=0000000000000400
>   EFER=0000000000000500
>   Code=?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? <??> ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??