linux-kernel - Re: [patch V2 04/16] x86/tss: Fix and move VMX BUILD_BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Nov 2019 23:44:19 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     x86@...nel.org, Linus Torvalds <torvalds@...uxfoundation.org>,
        Andy Lutomirski <luto@...nel.org>,
        Stephen Hemminger <stephen@...workplumber.org>,
        Willy Tarreau <w@....eu>, Juergen Gross <jgross@...e.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [patch V2 04/16] x86/tss: Fix and move VMX BUILD_BUG_ON()

On 11/11/19 23:03, Thomas Gleixner wrote:
> The BUILD_BUG_ON(IO_BITMAP_OFFSET - 1 == 0x67) in the VMX code is bogus in
> two aspects:
> 
> 1) This wants to be in generic x86 code simply to catch issues even when
>    VMX is disabled in Kconfig.
> 
> 2) The IO_BITMAP_OFFSET is not the right thing to check because it makes
>    asssumptions about the layout of tss_struct. Nothing requires that the
>    I/O bitmap is placed right after x86_tss, which is the hardware mandated
>    tss structure. It pointlessly makes restrictions on the struct
>    tss_struct layout.
> 
> The proper thing to check is:
> 
>     - Offset of x86_tss in tss_struct is 0
>     - Size of x86_tss == 0x68
> 
> Move it to the other build time TSS checks and make it do the right thing.
> 
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> Cc: Paolo Bonzini <pbonzini@...hat.com>
> ---
> V2: New patch
> ---
>  arch/x86/kvm/vmx/vmx.c       |    8 --------
>  arch/x86/mm/cpu_entry_area.c |    8 ++++++++
>  2 files changed, 8 insertions(+), 8 deletions(-)
> 
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -1338,14 +1338,6 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu
>  			    (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
>  		vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt);   /* 22.2.4 */
>  
> -		/*
> -		 * VM exits change the host TR limit to 0x67 after a VM
> -		 * exit.  This is okay, since 0x67 covers everything except
> -		 * the IO bitmap and have have code to handle the IO bitmap
> -		 * being lost after a VM exit.
> -		 */
> -		BUILD_BUG_ON(IO_BITMAP_OFFSET - 1 != 0x67);
> -
>  		rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
>  		vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
>  
> --- a/arch/x86/mm/cpu_entry_area.c
> +++ b/arch/x86/mm/cpu_entry_area.c
> @@ -161,6 +161,14 @@ static void __init setup_cpu_entry_area(
>  	BUILD_BUG_ON((offsetof(struct tss_struct, x86_tss) ^
>  		      offsetofend(struct tss_struct, x86_tss)) & PAGE_MASK);
>  	BUILD_BUG_ON(sizeof(struct tss_struct) % PAGE_SIZE != 0);
> +	/*
> +	 * VMX changes the host TR limit to 0x67 after a VM exit. This is
> +	 * okay, since 0x67 covers the size of struct x86_hw_tss. Make sure
> +	 * that this is correct.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct tss_struct, x86_tss) != 0);
> +	BUILD_BUG_ON(sizeof(struct x86_hw_tss) != 0x68);
> +
>  	cea_map_percpu_pages(&cea->tss, &per_cpu(cpu_tss_rw, cpu),
>  			     sizeof(struct tss_struct) / PAGE_SIZE, tss_prot);
>  
> 
> 

Acked-by: Paolo Bonzini <pbonzini@...hat.com>