[kernel-hardening] Re: [PATCH v3 4/4] KVM: VMX: Simplify segment_base

Thomas Garnier
2017-02-20T17:39:21Z

On Mon, Feb 20, 2017 at 9:28 AM, Thomas Garnier <thgarnie@google.com> wrote:
> On Mon, Feb 20, 2017 at 8:56 AM, Andy Lutomirski <luto@amacapital.net> wrote:
>> On Fri, Feb 17, 2017 at 2:01 PM, Thomas Garnier <thgarnie@google.com> wrote:
>>> On Fri, Feb 17, 2017 at 1:00 PM, Jim Mattson <jmattson@google.com> wrote:
>>>> On Fri, Feb 17, 2017 at 12:11 PM, Thomas Garnier <thgarnie@google.com> wrote:
>>>>> On Fri, Feb 17, 2017 at 9:49 AM, Jim Mattson <jmattson@google.com> wrote:
>>>>>>
>>>>>> Can we use the read-only GDT here? When expanding the virtual address
>>>>>> for 64-bit system descriptors, isn't it sufficient to check (d->s == 0
>>>>>> && d->type != 0)?
>>>>>
>>>>> We can use the readonly GDT but I think doesn't matter one or the
>>>>> other here. We have to check specific types for LDT or TSS, other
>>>>> values describe other entries (cf Intel volume 3, 3.5) (for example 14
>>>>> & 15 on 64-bits are for trap & interrupt gates).
>>>>
>>>> According to volume 3 of the SDM, section 3.5.2:
>>>>
>>>> The following system descriptors expand to 16 bytes:
>>>> — Call gate descriptors (see Section 5.8.3.1, “IA-32e Mode Call Gates”)
>>>> — IDT gate descriptors (see Section 6.14.1, “64-Bit Mode IDT”)
>>>> — LDT and TSS descriptors (see Section 7.2.3, “TSS Descriptor in 64-bit mode”).
>>>>
>>>> All legal system descriptor types (except for 0: Upper 8 bytes of an 16-byte
>>>> descriptor) should get the high 32 bits of the base address from the next 8-byte
>>>> descriptor.
>>>>
>>>
>>> Ok, then I will test an updated version next week.
>>>
>>
>> I'm going to send out some preliminary patches that just get rid of
>> this problem entirely.
>
> Okay, I guess I will have to wait for it to be integrated to
> linux-next then. Or would you rather to it after this patch set is
> added?
>

Read your summary for the patchset of KVM cleanup, I will wait for it
to reach linux-next to rebase and send the new iteration.

Thanks for working on the clean-up.

> --
> Thomas

--
Thomas