From: Sean Christopherson <seanjc@google.com>
To: C CHI <chichen241@gmail.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: Potential Denial-of-Service Vulnerability in KVM When Emulating 'hlt' Instruction in L2 Guests
Date: Fri, 17 Jan 2025 09:22:22 -0800 [thread overview]
Message-ID: <Z4qRzuL3cDbzVTUS@google.com> (raw)
In-Reply-To: <CAFtZq1F1x5+pXjgUvy=iDMZgY2mPyW+Rq6DKtfD+Msw=-nBaZw@mail.gmail.com>
Dropping Non-KVM folks/lists.
On Fri, Jan 17, 2025, C CHI wrote:
> I roughly understand the above content.
Heh, you top posted, so it's below.
https://people.kernel.org/tglx/notes-about-netiquette
> The main reason for this phenomenon seems to be the chaotic VM memory layout
> caused by the syzkaller template settings. In fact, it’s even observable that
> the IDT region in the code doesn’t actually contain any exception handling
> code, very amusing :)
>
> Additionally, I would like to ask about the previously mentioned point
> where the IDT is set in the emulated MMIO space. How can I verify
> this, and where can I find the relevant code for setting the MMIO
> region?
In KVM, any guest address that isn't covered by a memslot, a.k.a. a user memory
region, is treated as emulated MMIO.
> The guest loops because the the guest's IDT is located in emulated
> MMIO space,
> and as suspected above, KVM refuses to emulates HLT for L2.
>
>
> Also, I'm curious as to what technique is used to get the following
> type of logging information, and I'd like to be able to get each ENTRY
> and EXIT info on the run
The below comes from KVM's tracepoints. E.g. if tracefs is mounted at
/sys/kernel/debug/trace, all KVM tracepoints can be enabled via:
/sys/kernel/debug/tracing/events/kvm/enable
See Documentation/trace/tracepoints.rst for details on using tracepoints (or the
same info in the web version https://docs.kernel.org/trace/tracepoints.html).
prev parent reply other threads:[~2025-01-17 17:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAFtZq1FwJOtxmbf_NPgYP_ZH=PkXJfF0=cXo0xbGkT5TGv66-A@mail.gmail.com>
[not found] ` <CAHk-=whnVemumt5AJ1f=rsGdLz4Fk95nZfoBchGmMWCGG63foQ@mail.gmail.com>
[not found] ` <CAFtZq1FpLfbnJzqc_s=j9TBLyGxe9D_ZYZU2qiES5dgsBAWv+g@mail.gmail.com>
[not found] ` <2025011646-chariot-revision-5753@gregkh>
[not found] ` <E5C85B8E-D8F8-408F-B00B-A3650C9320EA@gmail.com>
2025-01-16 15:24 ` Potential Denial-of-Service Vulnerability in KVM When Emulating 'hlt' Instruction in L2 Guests Sean Christopherson
2025-01-17 4:54 ` C CHI
2025-01-17 17:22 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z4qRzuL3cDbzVTUS@google.com \
--to=seanjc@google.com \
--cc=chichen241@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox