linux-kernel - Re: [PATCH 5/5] KVM: x86: Fix wrong masking on relative jump/call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 07 May 2014 17:59:39 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Nadav Amit <namit@...technion.ac.il>, mtosatti@...hat.com,
	hpa@...or.com
CC:	gleb@...nel.org, tglx@...utronix.de, mingo@...hat.com,
	x86@...nel.org, kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 5/5] KVM: x86: Fix wrong masking on relative jump/call

Il 07/05/2014 14:32, Nadav Amit ha scritto:
> Relative jumps and calls do the masking according to the operand size, and not
> according to the address size as the KVM emulator does today.  In 64-bit mode,
> the resulting RIP is always 64-bit. Otherwise it is masked according to the
> instruction operand-size. Note that when 16-bit address size is used, bits
> 63:32 are unmodified.

The SDM says "If the operand-size attribute is 16, the upper two bytes 
of the EIP register are cleared, resulting in a maximum instruction 
pointer size of 16 bits".  I'm not sure whether that should also imply 
that 63:32 are _not_ unmodified (because you do a 32-bit write not a 
16-bit one), but in any case it looks like masked_increment is not the 
right function.

Paolo

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/