linux-kernel - [PATCH kvm-unit-tests] x86: Check DR6.RTM is writable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Jul 2014 17:41:56 +0300
From:	Nadav Amit <namit@...technion.ac.il>
To:	pbonzini@...hat.com
Cc:	gleb@...nel.org, tglx@...utronix.de, mingo@...hat.com,
	x86@...nel.org, kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
	Nadav Amit <namit@...technion.ac.il>
Subject: [PATCH kvm-unit-tests] x86: Check DR6.RTM is writable

Recently discovered bug shows DR6.RTM is fixed to one. The bug is only apparent
when the host emulates the MOV-DR instruction or when the host debugs the
guest kernel. This patch tests whether DR6.RTM is indeed accessible according
to RTM support as reported by cpuid.

Signed-off-by: Nadav Amit <namit@...technion.ac.il>
---
 x86/emulator.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/x86/emulator.c b/x86/emulator.c
index 1fd0ca6..f68882f 100644
--- a/x86/emulator.c
+++ b/x86/emulator.c
@@ -3,6 +3,7 @@
 #include "libcflat.h"
 #include "desc.h"
 #include "types.h"
+#include "processor.h"
 
 #define memset __builtin_memset
 #define TESTDEV_IO_PORT 0xe0
@@ -870,6 +871,19 @@ static void test_nop(uint64_t *mem, uint8_t *insn_page,
 	report("nop", outregs.rax == inregs.rax);
 }
 
+static void test_mov_dr(uint64_t *mem, uint8_t *insn_page,
+		uint8_t *alt_insn_page, void *insn_ram)
+{
+	bool rtm_support = cpuid(7).b & (1 << 11);
+	unsigned long dr6_fixed_1 = rtm_support ? 0xfffe0ff0ul : 0xffff0ff0ul;
+	inregs = (struct regs){ .rax = 0 };
+	MK_INSN(mov_to_dr6, "movq %rax, %dr6\n\t");
+	trap_emulator(mem, alt_insn_page, &insn_mov_to_dr6);
+	MK_INSN(mov_from_dr6, "movq %dr6, %rax\n\t");
+	trap_emulator(mem, alt_insn_page, &insn_mov_from_dr6);
+	report("mov_dr6", outregs.rax == dr6_fixed_1);
+}
+
 static void test_crosspage_mmio(volatile uint8_t *mem)
 {
     volatile uint16_t w, *pw;
@@ -1072,6 +1086,7 @@ int main()
 	test_movabs(mem, insn_page, alt_insn_page, insn_ram);
 	test_smsw_reg(mem, insn_page, alt_insn_page, insn_ram);
 	test_nop(mem, insn_page, alt_insn_page, insn_ram);
+	test_mov_dr(mem, insn_page, alt_insn_page, insn_ram);
 	test_crosspage_mmio(mem);
 
 	test_string_io_mmio(mem);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/