linux-kernel - Re: [Xen-devel] [PATCH -tip 0/2] x86: Prohibit kprobes on XEN_EMULATE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 5 Sep 2019 22:09:58 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Andrew Cooper <andrew.cooper3@...rix.com>,
        Ingo Molnar <mingo@...nel.org>,
        Juergen Gross <jgross@...e.com>,
        "Stefano Stabellini" <sstabellini@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Randy Dunlap <rdunlap@...radead.org>, <x86@...nel.org>,
        <linux-kernel@...r.kernel.org>, Borislav Petkov <bp@...en8.de>,
        "Josh Poimboeuf" <jpoimboe@...hat.com>,
        <xen-devel@...ts.xenproject.org>,
        "Boris Ostrovsky" <boris.ostrovsky@...cle.com>
Subject: Re: [Xen-devel] [PATCH -tip 0/2] x86: Prohibit kprobes on
 XEN_EMULATE_PREFIX

On Thu, 5 Sep 2019 20:32:24 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> On Thu, 5 Sep 2019 08:54:17 +0100
> Andrew Cooper <andrew.cooper3@...rix.com> wrote:
> 
> > On 05/09/2019 02:49, Masami Hiramatsu wrote:
> > > On Wed, 4 Sep 2019 12:54:55 +0100
> > > Andrew Cooper <andrew.cooper3@...rix.com> wrote:
> > >
> > >> On 04/09/2019 12:45, Masami Hiramatsu wrote:
> > >>> Hi,
> > >>>
> > >>> These patches allow x86 instruction decoder to decode
> > >>> xen-cpuid which has XEN_EMULATE_PREFIX, and prohibit
> > >>> kprobes to probe on it.
> > >>>
> > >>> Josh reported that the objtool can not decode such special
> > >>> prefixed instructions, and I found that we also have to
> > >>> prohibit kprobes to probe on such instruction.
> > >>>
> > >>> This series can be applied on -tip master branch which
> > >>> has merged Josh's objtool/perf sharing common x86 insn
> > >>> decoder series.
> > >> The paravirtualised xen-cpuid is were you'll see it most in a regular
> > >> kernel, but be aware that it is also used for testing purposes in other
> > >> circumstances, and there is an equivalent KVM prefix which is used for
> > >> KVM testing.
> > > Good catch! I didn't notice that. Is that really same sequance or KVM uses
> > > another sequence of instructions for KVM prefix?
> > 
> > I don't know if you've spotted, but the prefix is a ud2a instruction
> > followed by 'xen' in ascii.
> > 
> > The KVM version was added in c/s 6c86eedc206dd1f9d37a2796faa8e6f2278215d2

Hmm, I think I might misunderstand what the "emulate prefix"... that is not
a prefix which replace actual prefix, but just works like an escape sequence.
Thus the next instruction can have any x86 prefix, correct?

If so, this patch doesn't work. I have to add a new field in struct insn
like "insn.emulate_prefix_size" so that we can keep a room for the prefixes
for real instruction.

Thank you,


-- 
Masami Hiramatsu <mhiramat@...nel.org>