lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 26 May 2020 06:33:18 -0700
From:   Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
To:     Andreas Rammhold <andi@...much.email>
Cc:     Brendan Shanks <bshanks@...eweavers.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Babu Moger <Babu.Moger@....com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>,
        Jason Yan <yanaijie@...wei.com>, linux-kernel@...r.kernel.org
Subject: Re: umip: AMD Ryzen 3900X, pagefault after emulate SLDT/SIDT
 instruction

On Sat, May 23, 2020 at 04:17:39AM +0200, Andreas Rammhold wrote:
> On 12:43 19.05.20, Ricardo Neri wrote:
> > I have a patch for this already that I wrote for testing purposes:
> > https://github.com/ricardon/tip/commit/1692889cb3f8accb523d44b682458e234b93be50
> > Perhaps it can be used as a starting point? Not sure what the spoofing
> > value should be, though. Perhaps 0?
> 
> I tried the above patch (in modified/rebased version; hope that didn't
> kill it [0]). The results are negative, as without the patch.

Ah. My patch above is based on a rather old kernel. There is a check in
fixup_umip_exception() for SLDT and STR. I think this causes the
exception you see. Perhaps you can try by removing such check:

diff --git a/arch/x86/kernel/umip.c b/arch/x86/kernel/umip.c
@@ -383,10 +389,6 @@ bool fixup_umip_exception(struct pt_regs *regs)
 	umip_pr_warn(regs, "%s instruction cannot be used by applications.\n",
 			umip_insns[umip_inst]);

-	/* Do not emulate (spoof) SLDT or STR. */
-	if (umip_inst == UMIP_INST_STR || umip_inst == UMIP_INST_SLDT)
-		return false;
-
	umip_pr_warn(regs, "For now, expensive software emulation returns the result.\n");

	if (emulate_umip_insn(&insn, umip_inst, dummy_data, &dummy_data_size,

You would still need my old patch.

Thanks and BR,
Ricardo

Powered by blists - more mailing lists