Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Gleb Natapov
On Mon, Dec 16, 2013 at 02:31:43PM +0100, Radim Krčmář wrote: > 2013-12-16 13:55+0100, Radim Krčmář: > > 2013-12-16 14:16+0200, Gleb Natapov: > > > On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: > > > > > > - Where does the 'only one supported cluster' come from? > > > > > > > > >

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Radim Krčmář
2013-12-16 13:55+0100, Radim Krčmář: > 2013-12-16 14:16+0200, Gleb Natapov: > > On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: > > > > > - Where does the 'only one supported cluster' come from? > > > > > > > > > "only one supported cluster" comes from 8 bit cpuid limitation of

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Radim Krčmář
2013-12-16 14:16+0200, Gleb Natapov: > On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: > > > > - Where does the 'only one supported cluster' come from? > > > > > > > "only one supported cluster" comes from 8 bit cpuid limitation of KVM's > > > x2apic > > > implementation. With 8

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Gleb Natapov
On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: > > > - Where does the 'only one supported cluster' come from? > > > > > "only one supported cluster" comes from 8 bit cpuid limitation of KVM's > > x2apic > > implementation. With 8 bit cpuid you can only address cluster 0 in

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Radim Krčmář
2013-12-14 11:46+0200, Gleb Natapov: > On Fri, Dec 13, 2013 at 05:07:54PM +0100, Radim Krčmář wrote: > > 2013-12-12 21:36+0100, Paolo Bonzini: > > > From: Gleb Natapov > > > > > > A guest can cause a BUG_ON() leading to a host kernel crash. > > > When the guest writes to the ICR to request an

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Radim Krčmář
2013-12-14 11:46+0200, Gleb Natapov: On Fri, Dec 13, 2013 at 05:07:54PM +0100, Radim Krčmář wrote: 2013-12-12 21:36+0100, Paolo Bonzini: From: Gleb Natapov g...@redhat.com A guest can cause a BUG_ON() leading to a host kernel crash. When the guest writes to the ICR to request an

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Gleb Natapov
On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: - Where does the 'only one supported cluster' come from? only one supported cluster comes from 8 bit cpuid limitation of KVM's x2apic implementation. With 8 bit cpuid you can only address cluster 0 in logical mode.

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Radim Krčmář
2013-12-16 14:16+0200, Gleb Natapov: On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: - Where does the 'only one supported cluster' come from? only one supported cluster comes from 8 bit cpuid limitation of KVM's x2apic implementation. With 8 bit cpuid you can

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Radim Krčmář
2013-12-16 13:55+0100, Radim Krčmář: 2013-12-16 14:16+0200, Gleb Natapov: On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: - Where does the 'only one supported cluster' come from? only one supported cluster comes from 8 bit cpuid limitation of KVM's x2apic

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-16 Thread Gleb Natapov
On Mon, Dec 16, 2013 at 02:31:43PM +0100, Radim Krčmář wrote: 2013-12-16 13:55+0100, Radim Krčmář: 2013-12-16 14:16+0200, Gleb Natapov: On Mon, Dec 16, 2013 at 01:01:10PM +0100, Radim Krčmář wrote: - Where does the 'only one supported cluster' come from? only one supported

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-14 Thread Gleb Natapov
On Fri, Dec 13, 2013 at 06:25:20PM +0100, Paolo Bonzini wrote: > Il 13/12/2013 17:07, Radim Krčmář ha scritto: > >This bug can only be hit when the destination cpu is > 256, so the > >request itself is buggy -- we don't support that many in kvm and it > >would crash when initializing

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-14 Thread Gleb Natapov
On Fri, Dec 13, 2013 at 05:07:54PM +0100, Radim Krčmář wrote: > 2013-12-12 21:36+0100, Paolo Bonzini: > > From: Gleb Natapov > > > > A guest can cause a BUG_ON() leading to a host kernel crash. > > When the guest writes to the ICR to request an IPI, while in x2apic > > mode the following things

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-14 Thread Gleb Natapov
On Fri, Dec 13, 2013 at 05:07:54PM +0100, Radim Krčmář wrote: 2013-12-12 21:36+0100, Paolo Bonzini: From: Gleb Natapov g...@redhat.com A guest can cause a BUG_ON() leading to a host kernel crash. When the guest writes to the ICR to request an IPI, while in x2apic mode the following

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-14 Thread Gleb Natapov
On Fri, Dec 13, 2013 at 06:25:20PM +0100, Paolo Bonzini wrote: Il 13/12/2013 17:07, Radim Krčmář ha scritto: This bug can only be hit when the destination cpu is 256, so the request itself is buggy -- we don't support that many in kvm and it would crash when initializing the vcpus

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-13 Thread Radim Krčmář
2013-12-13 18:25+0100, Paolo Bonzini: > Il 13/12/2013 17:07, Radim Krčmář ha scritto: > >This bug can only be hit when the destination cpu is > 256, so the > >request itself is buggy -- we don't support that many in kvm and it > >would crash when initializing the vcpus if we did. > >

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-13 Thread Paolo Bonzini
Il 13/12/2013 17:07, Radim Krčmář ha scritto: >This bug can only be hit when the destination cpu is > 256, so the >request itself is buggy -- we don't support that many in kvm and it >would crash when initializing the vcpus if we did. >=> It looks like we should just ignore the

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-13 Thread Radim Krčmář
2013-12-12 21:36+0100, Paolo Bonzini: > From: Gleb Natapov > > A guest can cause a BUG_ON() leading to a host kernel crash. > When the guest writes to the ICR to request an IPI, while in x2apic > mode the following things happen, the destination is read from > ICR2, which is a register that the

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-13 Thread Radim Krčmář
2013-12-12 21:36+0100, Paolo Bonzini: From: Gleb Natapov g...@redhat.com A guest can cause a BUG_ON() leading to a host kernel crash. When the guest writes to the ICR to request an IPI, while in x2apic mode the following things happen, the destination is read from ICR2, which is a register

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-13 Thread Paolo Bonzini
Il 13/12/2013 17:07, Radim Krčmář ha scritto: This bug can only be hit when the destination cpu is 256, so the request itself is buggy -- we don't support that many in kvm and it would crash when initializing the vcpus if we did. = It looks like we should just ignore the ipi,

Re: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)

2013-12-13 Thread Radim Krčmář
2013-12-13 18:25+0100, Paolo Bonzini: Il 13/12/2013 17:07, Radim Krčmář ha scritto: This bug can only be hit when the destination cpu is 256, so the request itself is buggy -- we don't support that many in kvm and it would crash when initializing the vcpus if we did. = It