From patchwork Wed Feb 8 10:09:32 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergey Dyasli X-Patchwork-Id: 9562155 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B54AD601E5 for ; Wed, 8 Feb 2017 10:12:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A76FA28391 for ; Wed, 8 Feb 2017 10:12:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9C4B62849E; Wed, 8 Feb 2017 10:12:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4288328391 for ; Wed, 8 Feb 2017 10:12:04 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cbPC6-00018D-UN; Wed, 08 Feb 2017 10:09:46 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cbPC6-00017f-7C for xen-devel@lists.xen.org; Wed, 08 Feb 2017 10:09:46 +0000 Received: from [193.109.254.147] by server-4.bemta-6.messagelabs.com id 86/3A-25093-96EEA985; Wed, 08 Feb 2017 10:09:45 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpkkeJIrShJLcpLzFFi42JxWrrBXjfz3aw Igx5DiyUfF7M4MHoc3f2bKYAxijUzLym/IoE1Y9qKHcwFbQoVB/r2sTYwHpTsYuTgkBDwl2id 5drFyMnBJqAnsXH2KyYQW0RAVmJ11xz2LkYuDmaBI4wSU1cdYQepFxawlFi+TAukhkVARWLet +VsIDavgK3EjVvf2EFsCQE5iUvbvjCDlHMK2Ek8uGcCEhYCKpk6ZSMThK0q8frFLhaIVkGJkz OfgNnMAhISB1+8YJ7AyDsLSWoWktQCRqZVjOrFqUVlqUW6FnpJRZnpGSW5iZk5uoYGZnq5qcX FiempOYlJxXrJ+bmbGIFBwwAEOxhnX/Y/xCjJwaQkyuvzdFaEEF9SfkplRmJxRnxRaU5q8SFG GQ4OJQnej2+AcoJFqempFWmZOcDwhUlLcPAoifA+BknzFhck5hZnpkOkTjEqSonzar4FSgiAJ DJK8+DaYDFziVFWSpiXEegQIZ6C1KLczBJU+VeM4hyMSsK830DG82TmlcBNfwW0mAlo8fXTYI tLEhFSUg2Mu71ln7pNyEgQfvXTap8py7Uy/rxXGZbTv85UnHfFcsPhlQyyjrdKYq593yq4VDi it57H/PXpFYcPre9j+mF7zO3YJ/sfISx3uJ9ZdCW5CVqz5/5ffsGwserC5qrgFat8SiYKK2ic dEyMv2WkUrNqfz6f+5ncBhNpiYVvYljjxe6fY/xScm+vEktxRqKhFnNRcSIAXCBpQ5QCAAA= X-Env-Sender: prvs=205b15c4b=sergey.dyasli@citrix.com X-Msg-Ref: server-13.tower-27.messagelabs.com!1486548581!76480820!3 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.1.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 54027 invoked from network); 8 Feb 2017 10:09:44 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-13.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 8 Feb 2017 10:09:44 -0000 X-IronPort-AV: E=Sophos;i="5.33,346,1477958400"; d="scan'208";a="414224276" From: Sergey Dyasli To: Date: Wed, 8 Feb 2017 10:09:32 +0000 Message-ID: <20170208100935.30332-2-sergey.dyasli@citrix.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170208100935.30332-1-sergey.dyasli@citrix.com> References: <20170208100935.30332-1-sergey.dyasli@citrix.com> MIME-Version: 1.0 Cc: Andrew Cooper , Kevin Tian , Jan Beulich , Jun Nakajima , Sergey Dyasli Subject: [Xen-devel] [PATCH v3 1/4] x86/vmx: introduce vmwrite_safe() X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Any fail during the original __vmwrite() leads to BUG() which can be easily exploited from a guest in the nested vmx mode. The new function returns error code depending on the outcome: VMsucceed: 0 VMfailValid: VM Instruction Error Number VMfailInvalid: a new VMX_INSN_FAIL_INVALID A new macro GAS_VMX_OP is introduced in order to improve the readability of asm. Existing ASM_FLAG_OUT macro is reused and copied into asm_defns.h Signed-off-by: Sergey Dyasli Reviewed-by: Jan Beulich Acked-by: Kevin Tian --- v2 --> v3: * vmwrite_safe() now returns "enum vmx_insn_errno" (32-bit value) * vmwrite_safe() is changed from always_inline to plain inline xen/arch/x86/hvm/vmx/vvmx.c | 3 ++- xen/include/asm-x86/asm_defns.h | 6 ++++++ xen/include/asm-x86/hvm/vmx/vmcs.h | 1 + xen/include/asm-x86/hvm/vmx/vmx.h | 29 +++++++++++++++++++++++++++++ 4 files changed, 38 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index 9caebe5..105a3c0 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -483,7 +483,8 @@ static void vmfail_invalid(struct cpu_user_regs *regs) static void vmfail(struct cpu_user_regs *regs, enum vmx_insn_errno errno) { - if ( vcpu_nestedhvm(current).nv_vvmcxaddr != INVALID_PADDR ) + if ( vcpu_nestedhvm(current).nv_vvmcxaddr != INVALID_PADDR && + errno != VMX_INSN_FAIL_INVALID ) vmfail_valid(regs, errno); else vmfail_invalid(regs); diff --git a/xen/include/asm-x86/asm_defns.h b/xen/include/asm-x86/asm_defns.h index f1c6fa1..220ae2e 100644 --- a/xen/include/asm-x86/asm_defns.h +++ b/xen/include/asm-x86/asm_defns.h @@ -413,4 +413,10 @@ static always_inline void stac(void) #define REX64_PREFIX "rex64/" #endif +#ifdef __GCC_ASM_FLAG_OUTPUTS__ +# define ASM_FLAG_OUT(yes, no) yes +#else +# define ASM_FLAG_OUT(yes, no) no +#endif + #endif /* __X86_ASM_DEFNS_H__ */ diff --git a/xen/include/asm-x86/hvm/vmx/vmcs.h b/xen/include/asm-x86/hvm/vmx/vmcs.h index d71de04..8d43efd 100644 --- a/xen/include/asm-x86/hvm/vmx/vmcs.h +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h @@ -526,6 +526,7 @@ enum vmx_insn_errno VMX_INSN_VMPTRLD_INVALID_PHYADDR = 9, VMX_INSN_UNSUPPORTED_VMCS_COMPONENT = 12, VMX_INSN_VMXON_IN_VMX_ROOT = 15, + VMX_INSN_FAIL_INVALID = ~0, }; void vmx_disable_intercept_for_msr(struct vcpu *v, u32 msr, int type); diff --git a/xen/include/asm-x86/hvm/vmx/vmx.h b/xen/include/asm-x86/hvm/vmx/vmx.h index 4bf4d50..9bfe71a 100644 --- a/xen/include/asm-x86/hvm/vmx/vmx.h +++ b/xen/include/asm-x86/hvm/vmx/vmx.h @@ -306,6 +306,12 @@ extern uint8_t posted_intr_vector; #define INVVPID_ALL_CONTEXT 2 #define INVVPID_SINGLE_CONTEXT_RETAINING_GLOBAL 3 +#ifdef HAVE_GAS_VMX +# define GAS_VMX_OP(yes, no) yes +#else +# define GAS_VMX_OP(yes, no) no +#endif + static always_inline void __vmptrld(u64 addr) { asm volatile ( @@ -423,6 +429,29 @@ static inline bool_t __vmread_safe(unsigned long field, unsigned long *value) return okay; } +static inline enum vmx_insn_errno vmwrite_safe(unsigned long field, + unsigned long value) +{ + unsigned long ret = 0; + bool fail_invalid, fail_valid; + + asm volatile ( GAS_VMX_OP("vmwrite %[value], %[field]\n\t", + VMWRITE_OPCODE MODRM_EAX_ECX) + ASM_FLAG_OUT(, "setc %[invalid]\n\t") + ASM_FLAG_OUT(, "setz %[valid]\n\t") + : ASM_FLAG_OUT("=@ccc", [invalid] "=rm") (fail_invalid), + ASM_FLAG_OUT("=@ccz", [valid] "=rm") (fail_valid) + : [field] GAS_VMX_OP("r", "a") (field), + [value] GAS_VMX_OP("rm", "c") (value)); + + if ( unlikely(fail_invalid) ) + ret = VMX_INSN_FAIL_INVALID; + else if ( unlikely(fail_valid) ) + __vmread(VM_INSTRUCTION_ERROR, &ret); + + return ret; +} + static always_inline void __invept(unsigned long type, u64 eptp, u64 gpa) { struct {