[kernel-hardening] Re: [PATCH v3 4/4] KVM: VMX: Simplify segment_base

Andy Lutomirski
2017-02-20T16:56:35Z

On Fri, Feb 17, 2017 at 2:01 PM, Thomas Garnier <thgarnie@google.com> wrote:
> On Fri, Feb 17, 2017 at 1:00 PM, Jim Mattson <jmattson@google.com> wrote:
>> On Fri, Feb 17, 2017 at 12:11 PM, Thomas Garnier <thgarnie@google.com> wrote:
>>> On Fri, Feb 17, 2017 at 9:49 AM, Jim Mattson <jmattson@google.com> wrote:
>>>>
>>>> Can we use the read-only GDT here? When expanding the virtual address
>>>> for 64-bit system descriptors, isn't it sufficient to check (d->s == 0
>>>> && d->type != 0)?
>>>
>>> We can use the readonly GDT but I think doesn't matter one or the
>>> other here. We have to check specific types for LDT or TSS, other
>>> values describe other entries (cf Intel volume 3, 3.5) (for example 14
>>> & 15 on 64-bits are for trap & interrupt gates).
>>
>> According to volume 3 of the SDM, section 3.5.2:
>>
>> The following system descriptors expand to 16 bytes:
>> — Call gate descriptors (see Section 5.8.3.1, “IA-32e Mode Call Gates”)
>> — IDT gate descriptors (see Section 6.14.1, “64-Bit Mode IDT”)
>> — LDT and TSS descriptors (see Section 7.2.3, “TSS Descriptor in 64-bit mode”).
>>
>> All legal system descriptor types (except for 0: Upper 8 bytes of an 16-byte
>> descriptor) should get the high 32 bits of the base address from the next 8-byte
>> descriptor.
>>
>
> Ok, then I will test an updated version next week.
>

I'm going to send out some preliminary patches that just get rid of
this problem entirely.