From: Sean Christopherson <seanjc@google.com>
To: C CHI <chichen241@gmail.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: Potential Denial-of-Service Vulnerability in KVM When Emulating 'hlt' Instruction in L2 Guests
Date: Fri, 17 Jan 2025 09:22:22 -0800 [thread overview]
Message-ID: <Z4qRzuL3cDbzVTUS@google.com> (raw)
In-Reply-To: <CAFtZq1F1x5+pXjgUvy=iDMZgY2mPyW+Rq6DKtfD+Msw=-nBaZw@mail.gmail.com>
Dropping Non-KVM folks/lists.
On Fri, Jan 17, 2025, C CHI wrote:
> I roughly understand the above content.
Heh, you top posted, so it's below.
https://people.kernel.org/tglx/notes-about-netiquette
> The main reason for this phenomenon seems to be the chaotic VM memory layout
> caused by the syzkaller template settings. In fact, it’s even observable that
> the IDT region in the code doesn’t actually contain any exception handling
> code, very amusing :)
>
> Additionally, I would like to ask about the previously mentioned point
> where the IDT is set in the emulated MMIO space. How can I verify
> this, and where can I find the relevant code for setting the MMIO
> region?
In KVM, any guest address that isn't covered by a memslot, a.k.a. a user memory
region, is treated as emulated MMIO.
> The guest loops because the the guest's IDT is located in emulated
> MMIO space,
> and as suspected above, KVM refuses to emulates HLT for L2.
>
>
> Also, I'm curious as to what technique is used to get the following
> type of logging information, and I'd like to be able to get each ENTRY
> and EXIT info on the run
The below comes from KVM's tracepoints. E.g. if tracefs is mounted at
/sys/kernel/debug/trace, all KVM tracepoints can be enabled via:
/sys/kernel/debug/tracing/events/kvm/enable
See Documentation/trace/tracepoints.rst for details on using tracepoints (or the
same info in the web version https://docs.kernel.org/trace/tracepoints.html).
prev parent reply other threads:[~2025-01-17 17:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAFtZq1FwJOtxmbf_NPgYP_ZH=PkXJfF0=cXo0xbGkT5TGv66-A@mail.gmail.com>
[not found] ` <CAHk-=whnVemumt5AJ1f=rsGdLz4Fk95nZfoBchGmMWCGG63foQ@mail.gmail.com>
[not found] ` <CAFtZq1FpLfbnJzqc_s=j9TBLyGxe9D_ZYZU2qiES5dgsBAWv+g@mail.gmail.com>
[not found] ` <2025011646-chariot-revision-5753@gregkh>
[not found] ` <E5C85B8E-D8F8-408F-B00B-A3650C9320EA@gmail.com>
2025-01-16 15:24 ` Potential Denial-of-Service Vulnerability in KVM When Emulating 'hlt' Instruction in L2 Guests Sean Christopherson
2025-01-17 4:54 ` C CHI
2025-01-17 17:22 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z4qRzuL3cDbzVTUS@google.com \
--to=seanjc@google.com \
--cc=chichen241@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.