linux-kernel - Re: [visorchipset] invalid opcode: 0000 [#1] PREEMPT SMP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <C97001BC43954D438ACB059713BA5CDF92040F0F0A@USEA-EXCH7.na.uis.unisys.com>
Date:	Thu, 10 Apr 2014 08:19:39 -0500
From:	"Romer, Benjamin M" <Benjamin.Romer@...sys.com>
To:	"H. Peter Anvin" <hpa@...ux.intel.com>
CC:	Fengguang Wu <fengguang.wu@...el.com>,
	Jet Chen <jet.chen@...el.com>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Borislav Petkov <bp@...en8.de>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [visorchipset] invalid opcode: 0000 [#1] PREEMPT SMP

On Wed, 2014-04-09 at 16:10 -0700, H. Peter Anvin wrote:
> On 04/09/2014 04:01 PM, Fengguang Wu wrote:
> > CC the KVM people: it looks like a KVM problem that can be triggered by
> > 
> >         qemu-system-x86_64 -cpu Haswell,+smep,+smap
> 
> I'm really confused.  First of all, is this a KVM problem or is it a
> Qemu JIT problem?
> 
> Either seems really wonky.  It is questionable at best whether or not
> Qemu in JIT mode should set the hypervisor bit IMO.  However, even so,
> you *better* not call VMCALL *just* because the hypervisor bit is set.
> 
> The reason for it is that you have absolutely no idea what VMCALL is
> going to do on any one hypervisor... different hypervisors even use
> completely different conventions for VMCALL, and some might not accept
> VMCALL at all and might just terminate your guest with extreme prejudice.
> 
> So what is actually going on here?
> 
> 	-hpa
> 

I'm confused by the intended behavior of KVM.. Is the intention of the
-cpu switch to fully emulate a particular CPU? If that's the case, the
Intel documentation says bit 31 should always be 0, so the value
returned by the cpuid instruction isn't correct. If the intention is to
present a VM with a specific CPU architecture, the CPU ought to behave
as described in Intel's virtualization documentation and just vmexit
instead of faulting with invalid op, IMHO. 

I've already said the check in the code was insufficient, and I'm trying
to fix that part now. :)