linux-kernel - Re: [Xen-devel] [PATCH v2 2/3] x86 Test and expose CPUID faulting capabilities in /proc/cpuinfo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrVy3bYFTs-nO0MJr_Bcs9rBz_9h96z+cTQA2DOvBrd5Pw@mail.gmail.com>
Date:   Thu, 15 Sep 2016 12:37:30 -0700
From:   Andy Lutomirski <luto@...capital.net>
To:     Kyle Huey <me@...ehuey.com>
Cc:     Jan Beulich <JBeulich@...e.com>,
        David Vrabel <david.vrabel@...rix.com>,
        Aravind Gopalakrishnan <aravind.gopalakrishnan@....com>,
        Huang Rui <ray.huang@....com>,
        Peter Zijlstra <peterz@...radead.org>,
        Len Brown <len.brown@...el.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        Andy Lutomirski <luto@...nel.org>,
        "maintainer:X86 ARCHITECTURE 32-BIT AND 64-BIT" <x86@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        DaveHansen <dave.hansen@...ux.intel.com>,
        Kristen Carlson Accardi <kristen@...ux.intel.com>,
        Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>,
        "moderated list:XEN HYPERVISOR INTERFACE" 
        <xen-devel@...ts.xenproject.org>,
        Vladimir Zapolskiy <vladimir_zapolskiy@...tor.com>,
        "Robert O'Callahan" <robert@...llahan.org>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Ingo Molnar <mingo@...hat.com>,
        Juergen Gross <JGross@...e.com>, Borislav Petkov <bp@...e.de>,
        "open list:X86 ARCHITECTURE 32-BIT AND 64-BIT" 
        <linux-kernel@...r.kernel.org>, "H. PeterAnvin" <hpa@...or.com>
Subject: Re: [Xen-devel] [PATCH v2 2/3] x86 Test and expose CPUID faulting
 capabilities in /proc/cpuinfo

On Thu, Sep 15, 2016 at 12:11 PM, Kyle Huey <me@...ehuey.com> wrote:
> On Thu, Sep 15, 2016 at 3:25 AM, Jan Beulich <JBeulich@...e.com> wrote:
>>>>> On 15.09.16 at 12:05, <david.vrabel@...rix.com> wrote:
>>> On 14/09/16 22:01, Kyle Huey wrote:
>>>> Xen advertises the underlying support for CPUID faulting but not does pass
>>>> through writes to the relevant MSR, nor does it virtualize it, so it does
>>>> not actually work. For now mask off the relevant bit on MSR_PLATFORM_INFO.
>>>
>>> Could you clarify in the commit message that it is PV guests that are
>>> affected.
>>
>> What makes you think HVM ones aren't?
>
> Testing on EC2, HVM guests are affected as well.  Not sure what to do
> about that.
>

It's kind of nasty, but it shouldn't be *too* hard to probe for this
thing during early boot.  Allocate a page somewhere that has the user
bit set, put something like this in it:

cpuid
inc %eax  /* return 1 */
movw %ax, %ss /* force %GP to get out of here */

Call it like this from asm (real asm, not inline):

FRAME_BEGIN
pushq %rbx

xorl %eax, %eax

/* Push return frame */
pushq %ss
pushq %rsp
addq $8, (%rsp)
pushfq
pushq %cs
pushq $end_of_cpuid_faulting_test

/* Call it! */
pushq $__USER_DS
pushq $0
pushq $X86_EFLAGS_FIXED  /* leave IF off when running the CPL3 stub */
pushq $__USER_CS
pushq [address of userspace stub]
INTERRUPT_RETURN

end_of_cpuid_faulting_test:
pop %rbx

FRAME_END

Run this after the main GDT is loaded but while the #GP vector is
temporarily pointing to:

movq SS-RIP(%rsp), %rsp  /* pop the real return frame */
INTERRUPT_RETURN

and with interrupts off.  The function should return 0 if CPUID
faulting works and 1 if it doesn't.

Yeah, this is gross, but it should work.  I'm not sure how okay I am
with putting this crap in the kernel...