Nadav Amit 854e8bb1aa KVM: x86: Check non-canonical addresses upon WRMSR ... Upon WRMSR, the CPU should inject #GP if a non-canonical value (address) is written to certain MSRs. The behavior is "almost" identical for AMD and Intel (ignoring MSRs that are not implemented in either architecture since they would anyhow #GP). However, IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if non-canonical address is written on Intel but not on AMD (which ignores the top 32-bits). Accordingly, this patch injects a #GP on the MSRs which behave identically on Intel and AMD. To eliminate the differences between the architecutres, the value which is written to IA32_SYSENTER_ESP and IA32_SYSENTER_EIP is turned to canonical value before writing instead of injecting a #GP. Some references from Intel and AMD manuals: According to Intel SDM description of WRMSR instruction #GP is expected on WRMSR "If the source register contains a non-canonical address and ECX specifies one of the following MSRs: IA32_DS_AREA, IA32_FS_BASE, IA32_GS_BASE, IA32_KERNEL_GS_BASE, IA32_LSTAR, IA32_SYSENTER_EIP, IA32_SYSENTER_ESP." According to AMD manual instruction manual: LSTAR/CSTAR (SYSCALL): "The WRMSR instruction loads the target RIP into the LSTAR and CSTAR registers. If an RIP written by WRMSR is not in canonical form, a general-protection exception (#GP) occurs." IA32_GS_BASE and IA32_FS_BASE (WRFSBASE/WRGSBASE): "The address written to the base field must be in canonical form or a #GP fault will occur." IA32_KERNEL_GS_BASE (SWAPGS): "The address stored in the KernelGSbase MSR must be in canonical form." This patch fixes CVE-2014-3610. Cc: stable@vger.kernel.org Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2014-10-24 13:21:08 +02:00
..
cpuid.c	KVM: nested VMX: disable perf cpuid reporting	2014-09-24 14:07:50 +02:00
cpuid.h	KVM: x86: Warn if guest virtual address space is not 48-bits	2014-09-24 14:07:48 +02:00
emulate.c	KVM: x86: emulating descriptor load misses long-mode case	2014-09-24 14:07:52 +02:00
i8254.c	KVM: x86: limit PIT timer frequency	2014-01-15 12:43:54 +01:00
i8254.h	KVM: fold kvm_pit_timer into kvm_kpit_state	2012-08-01 00:21:07 -03:00
i8259.c	KVM: inject ExtINT interrupt before APIC interrupts	2012-12-13 23:05:21 -02:00
irq.c	KVM: nVMX: fix "acknowledge interrupt on exit" when APICv is in use	2014-08-05 15:00:24 +02:00
irq.h	KVM: switch to symbolic name for irq_states size	2012-07-20 16:12:16 -03:00
Kconfig	KVM: Give IRQFD its own separate enabling Kconfig option	2014-08-05 14:26:28 +02:00
kvm_cache_regs.h
lapic.c	KVM: x86: make apic_accept_irq tracepoint more generic	2014-09-11 11:51:02 +02:00
lapic.h	KVM: x86: Validate guest writes to MSR_IA32_APICBASE	2014-01-27 14:39:44 +01:00
Makefile	kvm: Add VFIO device	2013-10-30 19:02:03 +01:00
mmu_audit.c	arch/x86: replace strict_strto calls	2014-08-08 15:57:28 -07:00
mmu.c	Merge branch 'for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-10 07:26:02 -04:00
mmu.h	KVM: mmio: cleanup kvm_set_mmio_spte_mask	2014-09-03 10:04:10 +02:00
mmutrace.h	x86/kvm: Resolve shadow warnings in macro expansion	2014-07-31 16:33:29 +02:00
paging_tmpl.h	KVM: x86: Remove debug assertion of non-PAE reserved bits	2014-09-24 14:07:55 +02:00
pmu.c	KVM: x86: Clarify PMU related features bit manipulation	2014-08-20 13:01:25 +02:00
svm.c	KVM: x86: Check non-canonical addresses upon WRMSR	2014-10-24 13:21:08 +02:00
trace.h	KVM: x86: make apic_accept_irq tracepoint more generic	2014-09-11 11:51:02 +02:00
tss.h
vmx.c	KVM: x86: Check non-canonical addresses upon WRMSR	2014-10-24 13:21:08 +02:00
x86.c	KVM: x86: Check non-canonical addresses upon WRMSR	2014-10-24 13:21:08 +02:00
x86.h	KVM: vmx: Inject #GP on invalid PAT CR	2014-09-24 14:07:52 +02:00