linux-kernel - Re: [PATCH kvm-unit-tests] x86: Check DR6.RTM is writable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 21 Jul 2014 17:20:00 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Nadav Amit <namit@...technion.ac.il>
CC:	gleb@...nel.org, tglx@...utronix.de, mingo@...hat.com,
	x86@...nel.org, kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH kvm-unit-tests] x86: Check DR6.RTM is writable

Il 15/07/2014 16:41, Nadav Amit ha scritto:
> Recently discovered bug shows DR6.RTM is fixed to one. The bug is only apparent
> when the host emulates the MOV-DR instruction or when the host debugs the
> guest kernel. This patch tests whether DR6.RTM is indeed accessible according
> to RTM support as reported by cpuid.
> 
> Signed-off-by: Nadav Amit <namit@...technion.ac.il>
> ---
>  x86/emulator.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/x86/emulator.c b/x86/emulator.c
> index 1fd0ca6..f68882f 100644
> --- a/x86/emulator.c
> +++ b/x86/emulator.c
> @@ -3,6 +3,7 @@
>  #include "libcflat.h"
>  #include "desc.h"
>  #include "types.h"
> +#include "processor.h"
>  
>  #define memset __builtin_memset
>  #define TESTDEV_IO_PORT 0xe0
> @@ -870,6 +871,19 @@ static void test_nop(uint64_t *mem, uint8_t *insn_page,
>  	report("nop", outregs.rax == inregs.rax);
>  }
>  
> +static void test_mov_dr(uint64_t *mem, uint8_t *insn_page,
> +		uint8_t *alt_insn_page, void *insn_ram)
> +{
> +	bool rtm_support = cpuid(7).b & (1 << 11);
> +	unsigned long dr6_fixed_1 = rtm_support ? 0xfffe0ff0ul : 0xffff0ff0ul;
> +	inregs = (struct regs){ .rax = 0 };
> +	MK_INSN(mov_to_dr6, "movq %rax, %dr6\n\t");
> +	trap_emulator(mem, alt_insn_page, &insn_mov_to_dr6);
> +	MK_INSN(mov_from_dr6, "movq %dr6, %rax\n\t");
> +	trap_emulator(mem, alt_insn_page, &insn_mov_from_dr6);
> +	report("mov_dr6", outregs.rax == dr6_fixed_1);
> +}
> +
>  static void test_crosspage_mmio(volatile uint8_t *mem)
>  {
>      volatile uint16_t w, *pw;
> @@ -1072,6 +1086,7 @@ int main()
>  	test_movabs(mem, insn_page, alt_insn_page, insn_ram);
>  	test_smsw_reg(mem, insn_page, alt_insn_page, insn_ram);
>  	test_nop(mem, insn_page, alt_insn_page, insn_ram);
> +	test_mov_dr(mem, insn_page, alt_insn_page, insn_ram);
>  	test_crosspage_mmio(mem);
>  
>  	test_string_io_mmio(mem);
> 

Thanks, applying.

Paolo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/