[kernel-hardening] Re: [PATCH v3 4/4] KVM: VMX: Simplify segment_base

Thomas Garnier
2017-02-20T17:28:50Z

On Mon, Feb 20, 2017 at 8:56 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Fri, Feb 17, 2017 at 2:01 PM, Thomas Garnier <thgarnie@google.com> wrote:
>> On Fri, Feb 17, 2017 at 1:00 PM, Jim Mattson <jmattson@google.com> wrote:
>>> On Fri, Feb 17, 2017 at 12:11 PM, Thomas Garnier <thgarnie@google.com> wrote:
>>>> On Fri, Feb 17, 2017 at 9:49 AM, Jim Mattson <jmattson@google.com> wrote:
>>>>>
>>>>> Can we use the read-only GDT here? When expanding the virtual address
>>>>> for 64-bit system descriptors, isn't it sufficient to check (d->s == 0
>>>>> && d->type != 0)?
>>>>
>>>> We can use the readonly GDT but I think doesn't matter one or the
>>>> other here. We have to check specific types for LDT or TSS, other
>>>> values describe other entries (cf Intel volume 3, 3.5) (for example 14
>>>> & 15 on 64-bits are for trap & interrupt gates).
>>>
>>> According to volume 3 of the SDM, section 3.5.2:
>>>
>>> The following system descriptors expand to 16 bytes:
>>> — Call gate descriptors (see Section 5.8.3.1, “IA-32e Mode Call Gates”)
>>> — IDT gate descriptors (see Section 6.14.1, “64-Bit Mode IDT”)
>>> — LDT and TSS descriptors (see Section 7.2.3, “TSS Descriptor in 64-bit mode”).
>>>
>>> All legal system descriptor types (except for 0: Upper 8 bytes of an 16-byte
>>> descriptor) should get the high 32 bits of the base address from the next 8-byte
>>> descriptor.
>>>
>>
>> Ok, then I will test an updated version next week.
>>
>
> I'm going to send out some preliminary patches that just get rid of
> this problem entirely.

Okay, I guess I will have to wait for it to be integrated to
linux-next then. Or would you rather to it after this patch set is
added?

--
Thomas