linux-kernel - Re: [PATCH 2/3] KVM: selftests: Fix wrmsr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 13 Jul 2022 15:41:04 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Vitaly Kuznetsov <vkuznets@...hat.com>
Cc:     kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Maxim Levitsky <mlevitsk@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] KVM: selftests: Fix wrmsr_safe()

On Wed, Jul 13, 2022, Vitaly Kuznetsov wrote:
> It seems to be a misconception that "A" places an u64 operand to
> EAX:EDX, at least with GCC11.

It's not a misconception, it's just that the "A" trick only works for 32-bit
binaries.  For 64-bit, the 64-bit integer fits into "rax" without needing to spill
into "rdx".

I swear I had fixed this, but apparently I had only done that locally and never
pushed/posted the changes :-/

> While writing a new test, I've noticed that wrmsr_safe() tries putting
> garbage to the upper bits of the MSR, e.g.:
> 
>   kvm_exit:             reason MSR_WRITE rip 0x402919 info 0 0
>   kvm_msr:              msr_write 40000118 = 0x60000000001 (#GP)
> ...
> when it was supposed to write '1'. Apparently, "A" works the same as
> "a" and not as EAX/EDX. Here's the relevant disassembled part:
> 
> With "A":
> 
> 	48 8b 43 08          	mov    0x8(%rbx),%rax
> 	49 b9 ba da ca ba 0a 	movabs $0xabacadaba,%r9
> 	00 00 00
> 	4c 8d 15 07 00 00 00 	lea    0x7(%rip),%r10        # 402f44 <guest_msr+0x34>
> 	4c 8d 1d 06 00 00 00 	lea    0x6(%rip),%r11        # 402f4a <guest_msr+0x3a>
> 	0f 30                	wrmsr
> 
> With "a"/"d":
> 
> 	48 8b 43 08          	mov    0x8(%rbx),%rax
> 	48 89 c2             	mov    %rax,%rdx
> 	48 c1 ea 20          	shr    $0x20,%rdx
> 	49 b9 ba da ca ba 0a 	movabs $0xabacadaba,%r9
> 	00 00 00
> 	4c 8d 15 07 00 00 00 	lea    0x7(%rip),%r10        # 402fc3 <guest_msr+0xb3>
> 	4c 8d 1d 06 00 00 00 	lea    0x6(%rip),%r11        # 402fc9 <guest_msr+0xb9>
> 	0f 30                	wrmsr
> 
> I was only able to find one online reference that "A" gives "eax and
> edx combined into a 64-bit integer", other places don't mention it at
> all.
> 
> Fixes: 3b23054cd3f5 ("KVM: selftests: Add x86-64 support for exception fixup")
> Signed-off-by: Vitaly Kuznetsov <vkuznets@...hat.com>
> ---
>  tools/testing/selftests/kvm/include/x86_64/processor.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/kvm/include/x86_64/processor.h b/tools/testing/selftests/kvm/include/x86_64/processor.h
> index 79dcf6be1b47..3d412c578e78 100644
> --- a/tools/testing/selftests/kvm/include/x86_64/processor.h
> +++ b/tools/testing/selftests/kvm/include/x86_64/processor.h
> @@ -612,7 +612,7 @@ static inline uint8_t rdmsr_safe(uint32_t msr, uint64_t *val)
>  
>  static inline uint8_t wrmsr_safe(uint32_t msr, uint64_t val)
>  {
> -	return kvm_asm_safe("wrmsr", "A"(val), "c"(msr));
> +	return kvm_asm_safe("wrmsr", "a"((u32)val), "d"(val >> 32), "c"(msr));
>  }
>  
>  uint64_t vm_get_page_table_entry(struct kvm_vm *vm, struct kvm_vcpu *vcpu,
> -- 
> 2.35.3
>