linux-kernel - Re: [PATCH v3 4/7] KVM: VMX: Handle vectoring error in check_emulate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4f3fbcfe-a44c-4cb3-ae99-1a03f8bc2b83@gmail.com>
Date: Wed, 18 Dec 2024 22:00:15 +0000
From: Ivan Orlov <ivan.orlov0322@...il.com>
To: Sean Christopherson <seanjc@...gle.com>, Ivan Orlov <iorlov@...zon.com>
Cc: bp@...en8.de, dave.hansen@...ux.intel.com, mingo@...hat.com,
 pbonzini@...hat.com, shuah@...nel.org, tglx@...utronix.de, hpa@...or.com,
 kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-kselftest@...r.kernel.org, x86@...nel.org, dwmw@...zon.co.uk,
 pdurrant@...zon.co.uk, jalliste@...zon.co.uk
Subject: Re: [PATCH v3 4/7] KVM: VMX: Handle vectoring error in
 check_emulate_instruction

On 12/18/24 18:39, Sean Christopherson wrote:
> I definitely think it's worth explaining that moving the detection covers new
> emulation cases, and also calling out that handle_ept_misconfig() consults
> vmx_check_emulate_instruction(), i.e. that moving the detection shouldn't
> affect KVM's overall handlng of EPT Misconfig.
> 
> --
> 
> Move handling of emulation during event vectoring, which KVM doesn't
> support, into VMX's check_emulate_instruction(), so that KVM detects
> all unsupported emulation, not just cached emulated MMIO (EPT misconfig).
> E.g. on emulated MMIO that isn't cached (EPT Violation) or occurs with
> legacy shadow paging (#PF).
> 
> Rejecting emulation on other sources of emulation also fixes a largely
> theoretical flaw (thanks to the "unprotect and retry" logic), where KVM
> could incorrectly inject a #DF:
> 
>    1. CPU executes an instruction and hits a #GP
>    2. While vectoring the #GP, a shadow #PF occurs
>    3. On the #PF VM-Exit, KVM re-injects #GP
>    4. KVM emulates because of the write-protected page
>    5. KVM "successfully" emulates and also detects the #GP
>    6. KVM synthesizes a #GP, and since #GP has already been injected,
>       incorrectly escalates to a #DF.
> 
> Fix the comment about EMULTYPE_PF as this flag doesn't necessarily
> mean MMIO anymore: it can also be set due to the write protection
> violation.
> 
> Note, handle_ept_misconfig() checks vmx_check_emulate_instruction() before
> attempting emulation of any kind.
> 

Yeah, I thought that covering the change in non-cacheable MMIO / shadow 
paged #PF handling, but forgot to include it into the commit message :( 
Could you please fix the message when applying? The message you 
suggested looks good to me.

Thanks!

-- 
Kind regards,
Ivan Orlov