linux-kernel - [PATCH] KVM: VMX: Forbid userspace MSR filters for x2APIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201019170519.1855564-1-pbonzini@redhat.com>
Date:   Mon, 19 Oct 2020 13:05:19 -0400
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc:     Alexander Graf <graf@...zon.com>,
        Aaron Lewis <aaronlewis@...gle.com>,
        Peter Xu <peterx@...hat.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>
Subject: [PATCH] KVM: VMX: Forbid userspace MSR filters for x2APIC

Allowing userspace to intercept reads to x2APIC MSRs when APICV is
fully enabled for the guest simply can't work.   But more in general,
if the LAPIC is in-kernel, allowing accessed by userspace would be very
confusing.  If userspace wants to intercept x2APIC MSRs, then it should
first disable in-kernel APIC.

We could in principle allow userspace to intercept reads and writes to TPR,
and writes to EOI and SELF_IPI, but while that could be made it work, it
would still be silly.

Cc: Alexander Graf <graf@...zon.com>
Cc: Aaron Lewis <aaronlewis@...gle.com>
Cc: Peter Xu <peterx@...hat.com>
Cc: Sean Christopherson <sean.j.christopherson@...el.com>
Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
---
 arch/x86/kvm/x86.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c4015a43cc8a..0faf733538f4 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5246,6 +5246,13 @@ static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user
 	return r;
 }
 
+static bool range_overlaps_x2apic(struct kvm_msr_filter_range *range)
+{
+	u32 start = range->base;
+	u32 end = start + range->nmsrs;
+	return start <= 0x8ff && end > 0x800;
+}
+
 static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
 {
 	struct kvm_msr_filter __user *user_msr_filter = argp;
@@ -5257,6 +5264,16 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
 	if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))
 		return -EFAULT;
 
+	/*
+	 * In principle it would be possible to trap x2apic ranges
+	 * if !lapic_in_kernel.  This however would be complicated
+	 * because KVM_X86_SET_MSR_FILTER can be called before
+	 * KVM_CREATE_IRQCHIP or KVM_ENABLE_CAP.
+	 */
+	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++)
+		if (range_overlaps_x2apic(&filter.ranges[i]))
+			return -EINVAL;
+
 	kvm_clear_msr_filter(kvm);
 
 	default_allow = !(filter.flags & KVM_MSR_FILTER_DEFAULT_DENY);
-- 
2.26.2