lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20240906221824.491834-1-mlevitsk@redhat.com> Date: Fri, 6 Sep 2024 18:18:20 -0400 From: Maxim Levitsky <mlevitsk@...hat.com> To: kvm@...r.kernel.org Cc: Sean Christopherson <seanjc@...gle.com>, Thomas Gleixner <tglx@...utronix.de>, Paolo Bonzini <pbonzini@...hat.com>, Ingo Molnar <mingo@...hat.com>, Vitaly Kuznetsov <vkuznets@...hat.com>, linux-kernel@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org, Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>, Maxim Levitsky <mlevitsk@...hat.com> Subject: [PATCH v4 0/4] Relax canonical checks on some arch msrs Recently we came up upon a failure where likely the guest writes 0xff4547ceb1600000 to MSR_KERNEL_GS_BASE and later on, qemu sets this value via KVM_PUT_MSRS, and is rejected by the kernel, likely due to not being canonical in 4 level paging. One of the way to trigger this is to make the guest enter SMM, which causes paging to be disabled, which SMM bios re-enables but not the whole 5 level. MSR_KERNEL_GS_BASE on the other hand continues to contain old value. I did some reverse engineering and to my surprise I found out that both Intel and AMD indeed ignore CR4.LA57 when doing canonical checks on this and other msrs and/or other arch registers (like GDT base) which contain linear addresses. V2: addressed a very good feedback from Chao Gao. Thanks! V3: also fix the nested VMX, and also fix the MSR_IA32_SYSENTER_EIP / MSR_IA32_SYSENTER_ESP V4: - added PT and PEBS msrs - corrected emulation of SGDT/SIDT/STR/SLDT instructions - corrected canonical checks for TLB invalidation instructions Best regards, Maxim Levitsky Maxim Levitsky (4): KVM: x86: drop x86.h include from cpuid.h KVM: x86: implement emul_is_noncanonical_address using is_noncanonical_address KVM: x86: model canonical checks more precisely KVM: nVMX: fix canonical check of vmcs12 HOST_RIP arch/x86/kvm/cpuid.h | 1 - arch/x86/kvm/emulate.c | 15 ++++++----- arch/x86/kvm/kvm_emulate.h | 5 ++++ arch/x86/kvm/mmu.h | 1 + arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/vmx/hyperv.c | 1 + arch/x86/kvm/vmx/nested.c | 35 +++++++++++++++++--------- arch/x86/kvm/vmx/pmu_intel.c | 2 +- arch/x86/kvm/vmx/sgx.c | 5 ++-- arch/x86/kvm/vmx/vmx.c | 4 +-- arch/x86/kvm/x86.c | 13 +++++++--- arch/x86/kvm/x86.h | 49 ++++++++++++++++++++++++++++++++++-- 12 files changed, 102 insertions(+), 31 deletions(-) -- 2.26.3
Powered by blists - more mailing lists