linux-kernel - Re: [PATCH] x86: correctly initialize the CS base on reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 Mar 2013 17:41:45 +0100
From:	Jan Kiszka <jan.kiszka@...mens.com>
To:	Gleb Natapov <gleb@...hat.com>
CC:	Paolo Bonzini <pbonzini@...hat.com>, linux-kernel@...r.kernel.org,
	kvm@...r.kernel.org
Subject: Re: [PATCH] x86: correctly initialize the CS base on reset

On 2013-03-19 16:43, Gleb Natapov wrote:
> On Tue, Mar 19, 2013 at 04:30:26PM +0100, Paolo Bonzini wrote:
>> The CS base was initialized to 0 on VMX (wrong, but usually overridden
>> by userspace before starting) or 0xf0000 on SVM.  The correct value is
>> 0xffff0000, and VMX is able to emulate it now, so use it.
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> Reviewed-by: Gleb Natapov <gleb@...hat.com>

Just for the history (as I was wondering where this came from): CS base
used to be set to 0xf0000 on VMX as well, but that was changed by
b246dd5d to only affect guests when unrestricted mode is missing. That
change actually left the base uninitialized.

Jan

> 
>> ---
>>  arch/x86/kvm/svm.c | 8 +-------
>>  arch/x86/kvm/vmx.c | 1 +
>>  2 files changed, 2 insertions(+), 7 deletions(-)
>>
>> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
>> index 7219a40..7a46c1f 100644
>> --- a/arch/x86/kvm/svm.c
>> +++ b/arch/x86/kvm/svm.c
>> @@ -1131,17 +1131,11 @@ static void init_vmcb(struct vcpu_svm *svm)
>>  	init_seg(&save->gs);
>>  
>>  	save->cs.selector = 0xf000;
>> +	save->cs.base = 0xffff0000;
>>  	/* Executable/Readable Code Segment */
>>  	save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
>>  		SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
>>  	save->cs.limit = 0xffff;
>> -	/*
>> -	 * cs.base should really be 0xffff0000, but vmx can't handle that, so
>> -	 * be consistent with it.
>> -	 *
>> -	 * Replace when we have real mode working for vmx.
>> -	 */
>> -	save->cs.base = 0xf0000;
>>  
>>  	save->gdtr.limit = 0xffff;
>>  	save->idtr.limit = 0xffff;
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> index 4a0bafe..c75c25d 100644
>> --- a/arch/x86/kvm/vmx.c
>> +++ b/arch/x86/kvm/vmx.c
>> @@ -4133,6 +4133,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu)
>>  
>>  	seg_setup(VCPU_SREG_CS);
>>  	vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
>> +	vmcs_write32(GUEST_CS_BASE, 0xffff0000);
>>  
>>  	seg_setup(VCPU_SREG_DS);
>>  	seg_setup(VCPU_SREG_ES);
>> -- 
>> 1.8.1.4
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe kvm" in
>> the body of a message to majordomo@...r.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> --
> 			Gleb.
> 
-- 
Siemens AG, Corporate Technology, CT RTC ITP SDP-DE
Corporate Competence Center Embedded Linux

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/