linux-kernel - [PATCH kvm-unit-tests 2/2] x86: realmode: test smsw behavior with register operand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri,  6 Jun 2014 02:56:53 +0300
From:	Nadav Amit <namit@...technion.ac.il>
To:	pbonzini@...hat.com
Cc:	gleb@...nel.org, tglx@...utronix.de, mingo@...hat.com,
	hpa@...or.com, x86@...nel.org, kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org, Nadav Amit <namit@...technion.ac.il>
Subject: [PATCH kvm-unit-tests 2/2] x86: realmode: test smsw behavior with register operand

The smsw instruction has an undocumented behavior, in which the high-order
16-bits of CR0 are also saved in a 32-bit destination register.  This is
similar to the way smsw behaves in long-mode. However, it is hard to test the
long-mode case, since we need to cause an "invalid guest state" in long-mode.

The test works as follows: it sets CR0.CD (bit 30), so any of the high 16-bits
would be set.  It then executes smsw to register destination and compares the
register value with that of CR0.  CR0 value is restored when the test is done.

This test is expected to fail only when unrestricted mode is disabled or
unsupported.

Signed-off-by: Nadav Amit <namit@...technion.ac.il>
---
 x86/realmode.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/x86/realmode.c b/x86/realmode.c
index 839ac34..6e74883 100644
--- a/x86/realmode.c
+++ b/x86/realmode.c
@@ -1646,6 +1646,20 @@ void test_dr_mod(void)
 	report("mov dr with mod bits", R_AX | R_BX, outregs.eax == 0xaced);
 }
 
+void test_smsw(void)
+{
+	MK_INSN(smsw, "movl %cr0, %ebx\n\t"
+		      "movl %ebx, %ecx\n\t"
+		      "or $0x40000000, %ebx\n\t"
+		      "movl %ebx, %cr0\n\t"
+		      "smswl %eax\n\t"
+		      "movl %ecx, %cr0\n\t");
+	inregs.eax = 0x12345678;
+	exec_in_big_real_mode(&insn_smsw);
+	report("smsw", R_AX | R_BX | R_CX, outregs.eax == outregs.ebx);
+}
+
+
 void realmode_start(void)
 {
 	test_null();
@@ -1692,6 +1706,7 @@ void realmode_start(void)
 	test_salc();
 	test_fninit();
 	test_dr_mod();
+	test_smsw();
 	test_nopl();
 	test_perf_loop();
 	test_perf_mov();
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/