linux-kernel - Re: [PATCH] x86: kvm: reset the bootstrap processor when it gets an INIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 12 Mar 2013 13:28:42 +0200
From:	Gleb Natapov <gleb@...hat.com>
To:	Jan Kiszka <jan.kiszka@...mens.com>
Cc:	Paolo Bonzini <pbonzini@...hat.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"mtosatti@...hat.com" <mtosatti@...hat.com>
Subject: Re: [PATCH] x86: kvm: reset the bootstrap processor when it gets an
 INIT

On Tue, Mar 12, 2013 at 10:25:35AM +0100, Jan Kiszka wrote:
> On 2013-03-11 20:30, Gleb Natapov wrote:
> > On Mon, Mar 11, 2013 at 08:01:30PM +0100, Jan Kiszka wrote:
> >> On 2013-03-11 19:51, Gleb Natapov wrote:
> >>>>> On Intel:
> >>>>> CPU 1                          CPU 2 in a guest mode
> >>>>> send INIT
> >>>>> send SIPI
> >>>>>                                 INIT vmexit
> >>>>>                                 vmxoff
> >>>>>                                 reset and start from SIPI vector
> >>>>
> >>>> Is SIPI sticky as well, even if the CPU is not in the wait-for-SIPI
> >>>> state (but runnable and in vmxon) while receiving it?
> >>>>
> >>> That what they seams to be saying:
> >>>  However, an INIT and SIPI interrupts sent to a CPU during time when
> >>>  it is in a VMX mode are remembered and delivered, perhaps hours later,
> >>>  when the CPU exits the VMX mode
> >>>
> >>> Otherwise their exploit will not work.
> >>
> >> Very weird, specifically as SIPI is not just a binary event but carries
> >> payload. Will another SIPI event overwrite the previously "saved"
> >> vector? We are deep into an underspecified area...
> > My guess is that VMX INIT blocking is done by the same mechanism as
> > INIT blocking during SMM. Obviously after exit from SMM pending
> > INIT/SIPI have to be processed.
> 
> I think this should be further examined via a test case that can run on
> real HW. Is kvm-unit-test ready for this? Then we "just" need to
> implement what you were already asking for: minimalistic nVMX tests...
> 
I do not think kvm-unit-test will run on bare metal. I once implemented
framework for interrupt injection testing that ran on bare metal too. It
was very handy to compare KVM behaviour with real HW, but it was since
folded into kvm-unit-test.

--
			Gleb.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/