linux-kernel - Re: [PATCH 2/2] KVM: SVM: Emulate next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C5015B3.8010003@redhat.com>
Date:	Wed, 28 Jul 2010 14:34:11 +0300
From:	Avi Kivity <avi@...hat.com>
To:	"Roedel, Joerg" <Joerg.Roedel@....com>
CC:	Marcelo Tosatti <mtosatti@...hat.com>,
	"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/2] KVM: SVM: Emulate next_rip svm feature

  On 07/28/2010 02:25 PM, Roedel, Joerg wrote:
> On Wed, Jul 28, 2010 at 06:28:06AM -0400, Avi Kivity wrote:
>> We have a slightly different problem, if the nested guest manages to get
>> an instruction to be emulated by the host (if the guest assigned it the
>> cirrus framebuffer, for example, so from L1's point of view it is RAM,
>> but from L0's point of view it is emulated), then we miss the
>> intercept.  L2 could take over L1 this way.
> I wonder how this could happen. Shouldn't the shadow paging code take
> care of this?
>

L1 thinks the memory is RAM, so it maps it directly and forgets about 
it.  L0 knows it isn't, so it leaves it unmapped and emulates any 
instruction which accesses it.  The emulator needs to check whether the 
instruction is intercepted or not.

Note, I think if the instruction operand is in mmio, we're safe, since 
the intercept has higher priority than memory access.  But if the 
instruction itself is on mmio, or if we entered the emulator through smp 
trickery, then the emulator will execute the instruction in nested guest 
context.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/