linux-kernel - Re: [PATCH RFC 1/3] x86/kvm/vmx: read MSR_FS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87po4gxc02.fsf@vitty.brq.redhat.com>
Date:   Wed, 07 Mar 2018 14:15:41 +0100
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     kvm list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>, X86 ML <x86@...nel.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH RFC 1/3] x86/kvm/vmx: read MSR_FS_BASE from current->thread

Andy Lutomirski <luto@...nel.org> writes:

> On Fri, Mar 2, 2018 at 10:55 AM, Vitaly Kuznetsov <vkuznets@...hat.com> wrote:
>> vmx_save_host_state() is only called from kvm_arch_vcpu_ioctl_run() so
>> the context is pretty well defined
>>
>
> True.
>
>> and MSR_FS_BASE should always be
>> equal to current->thread.fsbase.
>
> Not true.  current->thread.fsbase is almost entirely undefined in this
> context.  What you *could* do is export save_fsgs() and call it first.
> When FSGSBASE support lands (which will happen eventually!), the code
> in your patch will be completely wrong.
>
> Admittedly, your patch isn't 100% bogus, but the reason is subtle and
> you need lots of comments there *and* in save_fsgs().

Just to make sure I understand the reason,

Currently, the only way for processes to change FS/GS base is to call
ARCH_SET_FS/GS prctls and these reflect the changes they make in
thread.fs/gsbase so *conceptually* reading them is OK now.

Now there's so called X86_BUG_NULL_SEG: on Intel CPUs writing '0' to
FS/GS selectors zeroes the base (and on AMDs it doesn't). save_fsgs()
checks fs/gs selectors and adjusts thread.fs/gsbase
accordingly. (de-facto no-issue for my patch as it only touches Intel's
VMX but we don't want to rely on vendor, detect_null_seg_behavior() does
real check of the behavior).

Now FSGSBASE support comes to play. Userspace will start changing FS/GS
base without kernel's intervention so we really need to do read if we
want to figure out what's there. Luckily, reads are now cheaper thanks
to new instructions.

So what I think we need to do here is introduce "sync_process_fs_gs()"
('save_fsgs' now) api which we will call from both __switch_to() and
KVM's vmx_save_host_state() before reading thread.fs/gsbase.

-- 
  Vitaly