From patchwork Tue Jan 31 11:20:32 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergey Dyasli X-Patchwork-Id: 9546947 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4502D604A0 for ; Tue, 31 Jan 2017 11:23:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 381CF27BA5 for ; Tue, 31 Jan 2017 11:23:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2C8E928338; Tue, 31 Jan 2017 11:23:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id B918D27BA5 for ; Tue, 31 Jan 2017 11:23:07 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cYWUi-0003HK-46; Tue, 31 Jan 2017 11:21:04 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cYWUh-0003Gz-Iy for xen-devel@lists.xen.org; Tue, 31 Jan 2017 11:21:03 +0000 Received: from [85.158.143.35] by server-2.bemta-6.messagelabs.com id 3D/FD-22326-E1370985; Tue, 31 Jan 2017 11:21:02 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEIsWRWlGSWpSXmKPExsXitHSDva5s8YQ IgznTFS2WfFzM4sDocXT3b6YAxijWzLyk/IoE1owfc18xF9zTqNg/oYm9gfGWQhcjJ4eEgL/E q0sfmUBsNgE9iY2zX4HZIgKyEqu75rB3MXJxMAscYZSYuuoIO0hCWMBCYtqXPSwgNouAqsSi4 2tYQWxeAXeJK8/nsUEMlZO4ea6TGcTmFPCQ+LfqLVi9EFDN0d/T2SFsVYnXL3axQPQKSpyc+Q TMZhaQkDj44gXzBEbeWUhSs5CkFjAyrWLUKE4tKkst0jUy1UsqykzPKMlNzMzRNTQw08tNLS5 OTE/NSUwq1kvOz93ECAwfBiDYwbhqQeAhRkkOJiVR3s/CEyKE+JLyUyozEosz4otKc1KLDzHK cHAoSfCmFwHlBItS01Mr0jJzgIEMk5bg4FES4X1ZCJTmLS5IzC3OTIdInWLU5Th14/RLJiGWv Py8VClxXmmQGQIgRRmleXAjYFF1iVFWSpiXEegoIZ6C1KLczBJU+VeM4hyMSsK8WSBTeDLzSu A2vQI6ggnoCPdXfSBHlCQipKQaGE29mc703XnHs8fpsyDjWuUay316qpEsd+S8XvdP7Y/iv2r ltP6H3GNeA/k1TyvydGvX/K25+fJ60sbSrOxTQgbN347JcHk/n67puo3nNtM/tjdvxHUqjhmm l22+4LVGWO6ScZDvKVGGK2prJU7tNzj98dH7Nx/PmxTNf5XikHljvsVfM0eVs0osxRmJhlrMR cWJAICijySlAgAA X-Env-Sender: prvs=197ca0e1a=sergey.dyasli@citrix.com X-Msg-Ref: server-10.tower-21.messagelabs.com!1485861655!48694532!2 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.1.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 17112 invoked from network); 31 Jan 2017 11:21:00 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-10.tower-21.messagelabs.com with RC4-SHA encrypted SMTP; 31 Jan 2017 11:21:00 -0000 X-IronPort-AV: E=Sophos;i="5.33,314,1477958400"; d="scan'208";a="411964578" From: Sergey Dyasli To: Date: Tue, 31 Jan 2017 11:20:32 +0000 Message-ID: <1485861635-3473-2-git-send-email-sergey.dyasli@citrix.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1485861635-3473-1-git-send-email-sergey.dyasli@citrix.com> References: <1485861635-3473-1-git-send-email-sergey.dyasli@citrix.com> MIME-Version: 1.0 Cc: Andrew Cooper , Kevin Tian , Jan Beulich , Jun Nakajima , Sergey Dyasli Subject: [Xen-devel] [PATCH 1/4] x86/vmx: introduce __vmwrite_safe() X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Any fail during the original __vmwrite() leads to BUG() which can be easily exploited from a guest in the nested vmx mode. The new function returns error code depending on the outcome: VMsucceed: 0 VMfailValid: VM Instruction Error Number VMfailInvalid: a new VMX_INSN_FAIL_INVALID A new macro GAS_VMX_OP is introduced in order to improve the readability of asm. Existing ASM_FLAG_OUT macro is reused and moved into lib.h and x86_emulate.h Signed-off-by: Sergey Dyasli --- tools/tests/x86_emulator/x86_emulate.h | 6 ++++++ xen/arch/x86/hvm/vmx/vvmx.c | 3 ++- xen/arch/x86/x86_emulate/x86_emulate.c | 6 ------ xen/include/asm-x86/hvm/vmx/vmcs.h | 1 + xen/include/asm-x86/hvm/vmx/vmx.h | 29 +++++++++++++++++++++++++++++ xen/include/xen/lib.h | 6 ++++++ 6 files changed, 44 insertions(+), 7 deletions(-) diff --git a/tools/tests/x86_emulator/x86_emulate.h b/tools/tests/x86_emulator/x86_emulate.h index 3a6bade..6524bb3 100644 --- a/tools/tests/x86_emulator/x86_emulate.h +++ b/tools/tests/x86_emulator/x86_emulate.h @@ -46,6 +46,12 @@ #define MMAP_SZ 16384 bool emul_test_make_stack_executable(void); +#ifdef __GCC_ASM_FLAG_OUTPUTS__ +# define ASM_FLAG_OUT(yes, no) yes +#else +# define ASM_FLAG_OUT(yes, no) no +#endif + #include "x86_emulate/x86_emulate.h" static inline uint64_t xgetbv(uint32_t xcr) diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index 9caebe5..105a3c0 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -483,7 +483,8 @@ static void vmfail_invalid(struct cpu_user_regs *regs) static void vmfail(struct cpu_user_regs *regs, enum vmx_insn_errno errno) { - if ( vcpu_nestedhvm(current).nv_vvmcxaddr != INVALID_PADDR ) + if ( vcpu_nestedhvm(current).nv_vvmcxaddr != INVALID_PADDR && + errno != VMX_INSN_FAIL_INVALID ) vmfail_valid(regs, errno); else vmfail_invalid(regs); diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 5bb5bdf..d133f09 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -409,12 +409,6 @@ typedef union { (void *)((long)(__##var + __alignof(type) - __alignof(long)) \ & -__alignof(type)) -#ifdef __GCC_ASM_FLAG_OUTPUTS__ -# define ASM_FLAG_OUT(yes, no) yes -#else -# define ASM_FLAG_OUT(yes, no) no -#endif - /* MSRs. */ #define MSR_TSC 0x00000010 #define MSR_SYSENTER_CS 0x00000174 diff --git a/xen/include/asm-x86/hvm/vmx/vmcs.h b/xen/include/asm-x86/hvm/vmx/vmcs.h index d71de04..cb02d53 100644 --- a/xen/include/asm-x86/hvm/vmx/vmcs.h +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h @@ -526,6 +526,7 @@ enum vmx_insn_errno VMX_INSN_VMPTRLD_INVALID_PHYADDR = 9, VMX_INSN_UNSUPPORTED_VMCS_COMPONENT = 12, VMX_INSN_VMXON_IN_VMX_ROOT = 15, + VMX_INSN_FAIL_INVALID = ~0UL, }; void vmx_disable_intercept_for_msr(struct vcpu *v, u32 msr, int type); diff --git a/xen/include/asm-x86/hvm/vmx/vmx.h b/xen/include/asm-x86/hvm/vmx/vmx.h index e5c6499..b0f3f3c 100644 --- a/xen/include/asm-x86/hvm/vmx/vmx.h +++ b/xen/include/asm-x86/hvm/vmx/vmx.h @@ -306,6 +306,12 @@ extern uint8_t posted_intr_vector; #define INVVPID_ALL_CONTEXT 2 #define INVVPID_SINGLE_CONTEXT_RETAINING_GLOBAL 3 +#ifdef HAVE_GAS_VMX +# define GAS_VMX_OP(yes, no) yes +#else +# define GAS_VMX_OP(yes, no) no +#endif + static always_inline void __vmptrld(u64 addr) { asm volatile ( @@ -423,6 +429,29 @@ static inline bool_t __vmread_safe(unsigned long field, unsigned long *value) return okay; } +static always_inline unsigned long __vmwrite_safe(unsigned long field, + unsigned long value) +{ + unsigned long ret = 0; + bool fail_invalid, fail_valid; + + asm volatile ( GAS_VMX_OP("vmwrite %[value], %[field]\n", + VMWRITE_OPCODE MODRM_EAX_ECX) + ASM_FLAG_OUT(, "setb %[fail_invalid]\n") + ASM_FLAG_OUT(, "sete %[fail_valid]\n") + : ASM_FLAG_OUT("=@ccb", [fail_invalid] "=rm") (fail_invalid), + ASM_FLAG_OUT("=@cce", [fail_valid] "=rm") (fail_valid) + : [field] GAS_VMX_OP("r", "a") (field), + [value] GAS_VMX_OP("rm", "c") (value)); + + if ( fail_invalid ) + ret = VMX_INSN_FAIL_INVALID; + else if ( fail_valid ) + __vmread(VM_INSTRUCTION_ERROR, &ret); + + return ret; +} + static always_inline void __invept(unsigned long type, u64 eptp, u64 gpa) { struct { diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h index d1171b7..6f6cac2 100644 --- a/xen/include/xen/lib.h +++ b/xen/include/xen/lib.h @@ -162,4 +162,10 @@ void init_constructors(void); void *bsearch(const void *key, const void *base, size_t num, size_t size, int (*cmp)(const void *key, const void *elt)); +#ifdef __GCC_ASM_FLAG_OUTPUTS__ +# define ASM_FLAG_OUT(yes, no) yes +#else +# define ASM_FLAG_OUT(yes, no) no +#endif + #endif /* __LIB_H__ */