From patchwork Wed Jul 3 10:56:53 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandru Stefan ISAILA X-Patchwork-Id: 11029341 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8197C13A4 for ; Wed, 3 Jul 2019 10:59:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 708CA28433 for ; Wed, 3 Jul 2019 10:59:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 646472879E; Wed, 3 Jul 2019 10:59:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3F7A128433 for ; Wed, 3 Jul 2019 10:59:03 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1hicwf-00016r-05; Wed, 03 Jul 2019 10:57:01 +0000 Received: from us1-rack-dfw2.inumbo.com ([104.130.134.6]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1hicwd-00016b-LX for xen-devel@lists.xenproject.org; Wed, 03 Jul 2019 10:56:59 +0000 X-Inumbo-ID: 4624a813-9d81-11e9-8980-bc764e045a96 Received: from EUR02-AM5-obe.outbound.protection.outlook.com (unknown [2a01:111:f400:fe07::701]) by us1-rack-dfw2.inumbo.com (Halon) with ESMTPS id 4624a813-9d81-11e9-8980-bc764e045a96; Wed, 03 Jul 2019 10:56:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bitdefender.onmicrosoft.com; s=selector1-bitdefender-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3XVdxfUIsK6/Y5VLsZav3qhfV4QfuN3ux+fmYToUYqM=; b=SGJBN4VB2GdcAOJXpjg+HIXEKmTETKyD/k8Ao0bgK1/JKaut7QBvq9niwRI1cy54Yu8Re1VdkqFTlqs5FE3pXSh59VY7d2wPphbJYh/wQefhWe+WYdICJhvL+OQlacrCCxvXdA9VQQ1Te4gGvy+v2H0b3utN5bRGZK+refhwxAM= Received: from VI1PR0202MB2928.eurprd02.prod.outlook.com (10.171.106.11) by VI1PR0202MB2608.eurprd02.prod.outlook.com (10.173.80.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2032.20; Wed, 3 Jul 2019 10:56:53 +0000 Received: from VI1PR0202MB2928.eurprd02.prod.outlook.com ([fe80::dd50:3e97:1d64:5aa3]) by VI1PR0202MB2928.eurprd02.prod.outlook.com ([fe80::dd50:3e97:1d64:5aa3%4]) with mapi id 15.20.2032.019; Wed, 3 Jul 2019 10:56:53 +0000 From: Alexandru Stefan ISAILA To: "xen-devel@lists.xenproject.org" Thread-Topic: [PATCH v7] x86/emulate: Send vm_event from emulate Thread-Index: AQHVMY4Gmux1Y/IiSU2ZKtKyOfOCuA== Date: Wed, 3 Jul 2019 10:56:53 +0000 Message-ID: <20190703105639.23081-1-aisaila@bitdefender.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: PR0P264CA0031.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:1::19) To VI1PR0202MB2928.eurprd02.prod.outlook.com (2603:10a6:800:e3::11) authentication-results: spf=none (sender IP is ) smtp.mailfrom=aisaila@bitdefender.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.17.1 x-originating-ip: [91.199.104.6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fe1060e7-d33b-4bf2-cc73-08d6ffa52861 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:VI1PR0202MB2608; x-ms-traffictypediagnostic: VI1PR0202MB2608:|VI1PR0202MB2608: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 00872B689F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(346002)(366004)(396003)(39860400002)(136003)(189003)(199004)(486006)(8936002)(36756003)(2616005)(26005)(186003)(66066001)(54906003)(71190400001)(3846002)(71200400001)(478600001)(6116002)(5640700003)(8676002)(81166006)(316002)(81156014)(1076003)(52116002)(6512007)(256004)(6436002)(476003)(7736002)(68736007)(5660300002)(6916009)(50226002)(2351001)(25786009)(6486002)(2501003)(66946007)(4326008)(14444005)(2906002)(305945005)(53936002)(99286004)(102836004)(86362001)(386003)(6506007)(14454004)(73956011)(66556008)(66476007)(64756008)(66446008)(309714004); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR0202MB2608; H:VI1PR0202MB2928.eurprd02.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bitdefender.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: sjWVVzavAA9brHZZ7ehddkQm8AmZKK1LnD6jSyTp+hpHl85c3pYQYfk4tA0duPcMZXKWMhVqgRPsO3x0isdtEuRflU25rlyhQBvO3ZEw+8fC0dy0/pWZlt3T3hMB3NESn4NpEbzUICO7NRYTJ4ok2yi1IWgYkKYmyC0xqYrxDCcQcj7v/L8t/ikIteWzzRQMASerk462PrHFOf3CVKJ7Lfgj7TuLF1H0VjdvcYJcdYTF3G9naFTtOumVg2A+PdSXHU5+3Jun1wRVKWsvttarlB/T1S/UMa8J5dElBUbildJX1IoQi1xWuMrOR71D1S7o1aAyggxmSrIofi5B8hOOLbogFHOdTUJLqHShRS5aoydLyO1GqN2XAooKfutNPNTyDgI4w5THlMEVmAqdlsIaneoSpTrO3G61ExfBHj/h/fA= MIME-Version: 1.0 X-OriginatorOrg: bitdefender.com X-MS-Exchange-CrossTenant-Network-Message-Id: fe1060e7-d33b-4bf2-cc73-08d6ffa52861 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jul 2019 10:56:53.6102 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 487baf29-f1da-469a-9221-243f830c36f3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: aisaila@bbu.bitdefender.biz X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0202MB2608 Subject: [Xen-devel] [PATCH v7] x86/emulate: Send vm_event from emulate X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Petre Ovidiu PIRCALABU , "tamas@tklengyel.com" , "wl@xen.org" , "rcojocaru@bitdefender.com" , "george.dunlap@eu.citrix.com" , "andrew.cooper3@citrix.com" , "paul.durrant@citrix.com" , "jbeulich@suse.com" , Alexandru Stefan ISAILA , "roger.pau@citrix.com" Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP A/D bit writes (on page walks) can be considered benign by an introspection agent, so receiving vm_events for them is a pessimization. We try here to optimize by fitering these events out. Currently, we are fully emulating the instruction at RIP when the hardware sees an EPT fault with npfec.kind != npfec_kind_with_gla. This is, however, incorrect, because the instruction at RIP might legitimately cause an EPT fault of its own while accessing a _different_ page from the original one, where A/D were set. The solution is to perform the whole emulation, while ignoring EPT restrictions for the walk part, and taking them into account for the "actual" emulating of the instruction at RIP. When we send out a vm_event, we don't want the emulation to complete, since in that case we won't be able to veto whatever it is doing. That would mean that we can't actually prevent any malicious activity, instead we'd only be able to report on it. When we see a "send-vm_event" case while emulating, we need to first send the event out and then stop the emulation (return X86EMUL_RETRY). After the emulation stops we'll call hvm_vm_event_do_resume() again after the introspection agent treats the event and resumes the guest. There, the instruction at RIP will be fully emulated (with the EPT ignored) if the introspection application allows it, and the guest will continue to run past the instruction. We use hvmemul_map_linear_addr() to intercept r/w access and __hvm_copy() to intercept exec access. hvm_emulate_send_vm_event() can return false if there was no violation, if there was an error from monitor_traps() or p2m_get_mem_access(). Returning false if p2m_get_mem_access() is of because this will happen if it was called with a bad address or if the entry was not found in the EPT in which case it is unrestricted. Signed-off-by: Alexandru Isaila --- Changes since V6: - Add comment for hvm_emulate_send_vm_event() - Use gfn_to_gaddr() - Move send_event flag to arch.vm_event - Remove send_event param from hvm_emulate_send_vm_event() - Remove send_event and pfec check from hvm_emulate_send_vm_event() - Cover all cases and remove default in switch ( access ) - Move hvm_emulate_send_vm_event() call out of PFEC_write_access - Add send_event check before hvm_emulate_send_vm_event() call - Set vm_event->send_event flag before every hvm_emulate_one_vm_event() call and clear it in hvm_emulate_send_vm_event() - Dropped Paul's review. --- xen/arch/x86/hvm/emulate.c | 78 ++++++++++++++++++++++++++++++- xen/arch/x86/hvm/hvm.c | 8 ++++ xen/arch/x86/hvm/vm_event.c | 1 + xen/arch/x86/mm/mem_access.c | 1 + xen/include/asm-x86/hvm/emulate.h | 4 ++ xen/include/asm-x86/vm_event.h | 2 + 6 files changed, 93 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 8659c89862..cb47e430af 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -12,9 +12,11 @@ #include #include #include +#include #include #include #include +#include #include #include #include @@ -530,6 +532,71 @@ static int hvmemul_do_mmio_addr(paddr_t mmio_gpa, return hvmemul_do_io_addr(1, mmio_gpa, reps, size, dir, df, ram_gpa); } +/* + * Send memory access vm_events based on pfec. Returns true if the event was + * sent and false for p2m_get_mem_access() error, no violation and event send + * error. Depends on arch.vm_event->send_event. + * + * NOTE: p2m_get_mem_access() can fail for wrong address or if the entry + * was not found in the EPT (in which case access to it is unrestricted, so + * no violations can occur). In both cases it is fine to continue the + * emulation. + */ +bool hvm_emulate_send_vm_event(unsigned long gla, gfn_t gfn, + uint32_t pfec) +{ + xenmem_access_t access; + vm_event_request_t req = {}; + paddr_t gpa = (gfn_to_gaddr(gfn) | (gla & ~PAGE_MASK)); + + current->arch.vm_event->send_event = false; + + if ( p2m_get_mem_access(current->domain, gfn, &access, + altp2m_vcpu_idx(current)) != 0 ) + return false; + + switch ( access ) + { + case XENMEM_access_x: + case XENMEM_access_rx: + if ( pfec & PFEC_write_access ) + req.u.mem_access.flags = MEM_ACCESS_R | MEM_ACCESS_W; + break; + + case XENMEM_access_w: + case XENMEM_access_rw: + if ( pfec & PFEC_insn_fetch ) + req.u.mem_access.flags = MEM_ACCESS_X; + break; + + case XENMEM_access_r: + case XENMEM_access_n: + if ( pfec & PFEC_write_access ) + req.u.mem_access.flags |= MEM_ACCESS_R | MEM_ACCESS_W; + if ( pfec & PFEC_insn_fetch ) + req.u.mem_access.flags |= MEM_ACCESS_X; + break; + + case XENMEM_access_wx: + case XENMEM_access_rwx: + case XENMEM_access_rx2rw: + case XENMEM_access_n2rwx: + case XENMEM_access_default: + break; + } + + if ( !req.u.mem_access.flags ) + return false; /* no violation */ + + req.reason = VM_EVENT_REASON_MEM_ACCESS; + req.u.mem_access.gfn = gfn_x(gfn); + req.u.mem_access.flags |= MEM_ACCESS_FAULT_WITH_GLA | MEM_ACCESS_GLA_VALID; + req.u.mem_access.gla = gla; + req.u.mem_access.offset = gpa & ~PAGE_MASK; + + return monitor_traps(current, true, &req) >= 0; +} + /* * Map the frame(s) covering an individual linear access, for writeable * access. May return NULL for MMIO, or ERR_PTR(~X86EMUL_*) for other errors @@ -547,6 +614,7 @@ static void *hvmemul_map_linear_addr( unsigned int nr_frames = ((linear + bytes - !!bytes) >> PAGE_SHIFT) - (linear >> PAGE_SHIFT) + 1; unsigned int i; + gfn_t gfn; /* * mfn points to the next free slot. All used slots have a page reference @@ -585,7 +653,7 @@ static void *hvmemul_map_linear_addr( ASSERT(mfn_x(*mfn) == 0); res = hvm_translate_get_page(curr, addr, true, pfec, - &pfinfo, &page, NULL, &p2mt); + &pfinfo, &page, &gfn, &p2mt); switch ( res ) { @@ -629,6 +697,14 @@ static void *hvmemul_map_linear_addr( ASSERT(p2mt == p2m_ram_logdirty || !p2m_is_readonly(p2mt)); } + + if ( curr->arch.vm_event && + curr->arch.vm_event->send_event && + hvm_emulate_send_vm_event(addr, gfn, pfec) ) + { + err = ERR_PTR(~X86EMUL_RETRY); + goto out; + } } /* Entire access within a single frame? */ diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 029eea3b85..783ebc3525 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -3224,6 +3224,14 @@ static enum hvm_translation_result __hvm_copy( return HVMTRANS_bad_gfn_to_mfn; } + if ( unlikely(v->arch.vm_event) && + v->arch.vm_event->send_event && + hvm_emulate_send_vm_event(addr, gfn, pfec) ) + { + put_page(page); + return HVMTRANS_gfn_paged_out; + } + p = (char *)__map_domain_page(page) + (addr & ~PAGE_MASK); if ( flags & HVMCOPY_to_guest ) diff --git a/xen/arch/x86/hvm/vm_event.c b/xen/arch/x86/hvm/vm_event.c index 121de23071..dede21e1c9 100644 --- a/xen/arch/x86/hvm/vm_event.c +++ b/xen/arch/x86/hvm/vm_event.c @@ -86,6 +86,7 @@ void hvm_vm_event_do_resume(struct vcpu *v) VM_EVENT_FLAG_SET_EMUL_INSN_DATA ) kind = EMUL_KIND_SET_CONTEXT_INSN; + v->arch.vm_event->send_event = false; hvm_emulate_one_vm_event(kind, TRAP_invalid_op, X86_EVENT_NO_EC); diff --git a/xen/arch/x86/mm/mem_access.c b/xen/arch/x86/mm/mem_access.c index 0144f92b98..c0faa57db1 100644 --- a/xen/arch/x86/mm/mem_access.c +++ b/xen/arch/x86/mm/mem_access.c @@ -214,6 +214,7 @@ bool p2m_mem_access_check(paddr_t gpa, unsigned long gla, d->arch.monitor.inguest_pagefault_disabled && npfec.kind != npfec_kind_with_gla ) /* don't send a mem_event */ { + v->arch.vm_event->send_event = true; hvm_emulate_one_vm_event(EMUL_KIND_NORMAL, TRAP_invalid_op, X86_EVENT_NO_EC); return true; diff --git a/xen/include/asm-x86/hvm/emulate.h b/xen/include/asm-x86/hvm/emulate.h index b39a1a0331..3682efd90b 100644 --- a/xen/include/asm-x86/hvm/emulate.h +++ b/xen/include/asm-x86/hvm/emulate.h @@ -80,6 +80,10 @@ struct segment_register *hvmemul_get_seg_reg( enum x86_segment seg, struct hvm_emulate_ctxt *hvmemul_ctxt); int hvm_emulate_one_mmio(unsigned long mfn, unsigned long gla); +bool hvm_emulate_send_vm_event( + unsigned long gla, + gfn_t gfn, + uint32_t pfec); static inline bool handle_mmio(void) { diff --git a/xen/include/asm-x86/vm_event.h b/xen/include/asm-x86/vm_event.h index 23e655710b..66db9e1e25 100644 --- a/xen/include/asm-x86/vm_event.h +++ b/xen/include/asm-x86/vm_event.h @@ -36,6 +36,8 @@ struct arch_vm_event { bool set_gprs; /* A sync vm_event has been sent and we're not done handling it. */ bool sync_event; + /* Send mem access events from emulator */ + bool send_event; }; int vm_event_init_domain(struct domain *d);