linux-kernel - [PATCH 0/2] KVM: SMM fixes for nVMX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 26 Aug 2021 12:57:48 +0300
From:   Maxim Levitsky <mlevitsk@...hat.com>
To:     kvm@...r.kernel.org
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Wanpeng Li <wanpengli@...cent.com>,
        Joerg Roedel <joro@...tes.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Jim Mattson <jmattson@...gle.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Ingo Molnar <mingo@...hat.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        x86@...nel.org (maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)),
        Borislav Petkov <bp@...en8.de>,
        linux-kernel@...r.kernel.org (open list:X86 ARCHITECTURE (32-BIT AND
        64-BIT)), Maxim Levitsky <mlevitsk@...hat.com>
Subject: [PATCH 0/2] KVM: SMM fixes for nVMX

Those are two patches that fix SMM entries while nested guests
are active and either EPT or unrestricted guest mode is disabled
(EPT disables the later)

1. First patch makes sure that we don't run vmx_handle_exit_irqoff
   when we emulate a handful of real mode smm instructions.

   When in emulation mode, vmx exit reason is not updated,
   and thus this function uses outdated values and crashes.

2. Second patch works around an incorrect restore of segment
   registers upon entry to nested guest from SMM.

   When entering the nested guest from SMM we enter real mode,
   and from it straight to nested guest, and in particular
   once we restore L2's CR0, enter_pmode is called which
   'restores' the segment registers from real mode segment
   cache.

   Normally this isn't a problem since after we finish entering
   the nested guest, we restore all its registers from SMRAM,
   but for the brief period when L2's segment registers are not up to date,
   we trip 'vmx_guest_state_valid' check for non unrestricted guest mode, even
   though it will be later valid.

Note that I still am able to crash L1 by migrating a VM with a
nested guest running and smm load, on VMX.

This even happens with normal stock settings of ept=1,unrestricted_guest=1
and will soon be investigated.

Best regards,
	Maxim Levitsky

Maxim Levitsky (2):
  KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
  VMX: nSVM: enter protected mode prior to returning to nested guest
    from SMM

 arch/x86/kvm/vmx/vmx.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

-- 
2.26.3