linux-kernel - Re: [PATCH] arm64: KVM: VHE: reset PSTATE.UAO when switch to host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ec27c833-c9f7-d144-3c6f-a87a3bf3d97f@arm.com>
Date:   Thu, 7 Sep 2017 11:13:46 +0100
From:   Marc Zyngier <marc.zyngier@....com>
To:     gengdongjiu <gengdongjiu@...wei.com>,
        James Morse <james.morse@....com>
Cc:     christoffer.dall@...aro.org, vladimir.murzin@....com,
        rkrcmar@...hat.com, catalin.marinas@....com,
        shankerd@...eaurora.org, linux-arm-kernel@...ts.infradead.org,
        kvmarm@...ts.cs.columbia.edu, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, zhanghaibin7@...wei.com,
        huangshaoyu@...wei.com
Subject: Re: [PATCH] arm64: KVM: VHE: reset PSTATE.UAO when switch to host

On 07/09/17 11:05, gengdongjiu wrote:
> Hi James,
> 
> On 2017/9/7 17:20, James Morse wrote:
>> Hi Dongjiu Geng,
>>
>> On 07/09/17 06:54, Dongjiu Geng wrote:
>>> In VHE mode, host kernel runs in the EL2 and can enable
>>> 'User Access Override' when fs==KERNEL_DS so that it can
>>> access kernel memory. However, PSTATE.UAO is set to 0 on
>>> an exception taken from EL1 to EL2. Thus when VHE is used
>>> and exception taken from a guest UAO will be disabled and
>>> host will use the incorrect PSTATE.UAO. So check and reset
>>> the PSTATE.UAO when switching to host.
>>
>> This would only be a problem if KVM were calling into world-switch with
>> fs==KERNEL_DS. I can't see where this happens.
>  Not only KVM, may also kernel sets the fs == KERNEL_DS before calling into world-switch

How? Please describe the exact sequence of event that lead to this
situation with the current code base.

	M.
-- 
Jazz is not dead. It just smells funny...