linux-kernel - Re: [PATCH 1/2] KVM: x86: fix ordering of cr0 initialization code in vmx_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 8 Feb 2016 17:43:18 +0100
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Bruce Rogers <brogers@...e.com>, kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc:	namit@...technion.ac.il, jan.kiszka@...mens.com
Subject: Re: [PATCH 1/2] KVM: x86: fix ordering of cr0 initialization code in
 vmx_cpu_reset



On 08/02/2016 17:29, Bruce Rogers wrote:
>>>> On 2/8/2016 at 08:09 AM, Paolo Bonzini <pbonzini@...hat.com> wrote: 
> 
>>
>> On 03/02/2016 23:51, Bruce Rogers wrote:
>>>
>>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>>> index e2951b6..21507b4 100644
>>> --- a/arch/x86/kvm/vmx.c
>>> +++ b/arch/x86/kvm/vmx.c
>>> @@ -4993,8 +4993,8 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool 
>> init_event)
>>>  		vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
>>>  
>>>  	cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
>>> -	vmx_set_cr0(vcpu, cr0); /* enter rmode */
>>>  	vmx->vcpu.arch.cr0 = cr0;
>>> +	vmx_set_cr0(vcpu, cr0); /* enter rmode */
>>
>> Your comment that the assignment is redundant is correct, but I am
>> afraid that this fix is also wrong.  In particular, it would not cause
>> exit_lmode and enter_rmode to be called.
>>
>> You are not describing which call to kvm_mmu_reset_context was messed
>> up, so I'm not sure how your patch is fixing things.
> 
> This is in the context of AP sending INIT to BSP with unrestricted_guest=N.
> 
> So the call sequence where I see the issue is: kvm_apic_accept_events() ->
> kvm_vcpu_reset() -> vmx_vcpu_reset() -> vmx_set_cr0() -> enter_rmode() ->
> kvm_mmu_reset_context().
> 
> enter_rmode is called in the case I am testing.

Please describe the bug as thoroughly as possible, especially the
initial state of the BSP and AP and how the bug manifests after the INIT
IPI.  It would be great to write a kvm-unit-tests testcase for it, but I
can do it too if you provide enough information.

Paolo