linux-kernel - Re: [PATCH] KVM: X86: Dynamically allocating MSR number lists(msrs_to_save[], emulated_msrs[], msr_based

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6ed393eb-6402-ffe2-a652-c4fe51c9d301@intel.com>
Date:   Tue, 5 Nov 2019 19:11:24 +0800
From:   Xiaoyao Li <xiaoyao.li@...el.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Chenyi Qiang <chenyi.qiang@...el.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] KVM: X86: Dynamically allocating MSR number
 lists(msrs_to_save[], emulated_msrs[], msr_based_features[])

On 11/5/2019 6:41 PM, Paolo Bonzini wrote:
> On 05/11/19 10:20, Chenyi Qiang wrote:
>> The three msr number lists(msrs_to_save[], emulated_msrs[] and
>> msr_based_features[]) are global arrays of kvm.ko, which are
>> initialized/adjusted (copy supported MSRs forward to override the
>> unsupported MSRs) when installing kvm-{intel,amd}.ko, but it doesn't
>> reset these three arrays to their initial value when uninstalling
>> kvm-{intel,amd}.ko. Thus, at the next installation, kvm-{intel,amd}.ko
>> will initialize the modified arrays with some MSRs lost and some MSRs
>> duplicated.
>>
>> So allocate and initialize these three MSR number lists dynamically when
>> installing kvm-{intel,amd}.ko and free them when uninstalling.
> 
> I don't understand.  Do you mean insmod/rmmod when you say
> installing/uninstalling? Global data must be reloaded from the ELF file
> when insmod is executed.

Yes, we mean insmod/rmmod.
The problem is that these three MSR arrays belong to kvm.ko but not 
kvm-{intel,amd}.ko. When we rmmod kvm_intel.ko, it does nothing to them.

> How is the bug reproducible?

Suppose there is an intel machine.

1. You can first run
	#rmmod kvm-intel.ko
	#insmod kvm-intel.ko nested=0
2. and then
	#rmmod kvm-intel.ko
	#insmod kvm-intel.ko nested=1

In step 1, all the vmx-related MSRs in msr_based_features[] are not 
supported due to nested=0. And it will move MSR_IA32_UCODE_REV and 
MSR_IA32_ARCH_CAPABILITIES (on my Cascadelake server) forward to 
override array member 0 and 1 (MSR_IA32_VMX_BASIC and 
MSR_IA32_VMX_TRUE_PINBASED_CTLS).

In step 2, we just lose MSR_IA32_VMX_BASIC and 
MSR_IA32_VMX_TRUE_PINBASED_CTLS of VMX and get duplicated 
MSR_IA32_UCODE_REV and MSR_IA32_ARCH_CAPABILITIES.

> Paolo
>