| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <265883f8-83a4-6386-fa56-b53b4897f5e1@redhat.com>
Date: Mon, 18 Oct 2021 14:46:06 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Xiaoyao Li <xiaoyao.li@...el.com>
Cc: Sean Christopherson <seanjc@...gle.com>,
Vitaly Kuznetsov <vkuznets@...hat.com>,
Wanpeng Li <wanpengli@...cent.com>,
Jim Mattson <jmattson@...gle.com>,
Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 5/7] KVM: VMX: Disallow PT MSRs accessing if PT is not
exposed to guest
On 27/08/21 09:02, Xiaoyao Li wrote:
> Per SDM, it triggers #GP for all the accessing of PT MSRs, if
> X86_FEATURE_INTEL_PT is not available.
>
> Signed-off-by: Xiaoyao Li <xiaoyao.li@...el.com>
> ---
> Changes in v2:
> - allow userspace/host access regradless of PT bit, (Sean)
> ---
> arch/x86/kvm/vmx/vmx.c | 38 +++++++++++++++++++++++++-------------
> 1 file changed, 25 insertions(+), 13 deletions(-)
Let's cache this in vmx->pt_desc. More precisely:
- always call update_intel_pt_cfg from vmx_vcpu_after_set_cpuid
- add a field vmx->pt_desc.available matching guest_cpuid_has(vcpu,
X86_FEATURE_INTEL_PT)
- if it is false, clear _all_ of vmx->pt_desc (with memcpy) and return
early from update_intel_pt_cfg
Thanks,
Paolo
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index b9d640029c40..394ef4732838 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -1007,10 +1007,21 @@ static unsigned long segment_base(u16 selector)
> }
> #endif
>
> -static inline bool pt_can_write_msr(struct vcpu_vmx *vmx)
> +static inline bool pt_can_write_msr(struct vcpu_vmx *vmx,
> + struct msr_data *msr_info)
> {
> return vmx_pt_mode_is_host_guest() &&
> - !(vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN);
> + !(vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) &&
> + (msr_info->host_initiated ||
> + guest_cpuid_has(&vmx->vcpu, X86_FEATURE_INTEL_PT));
> +}
> +
> +static inline bool pt_can_read_msr(struct kvm_vcpu *vcpu,
> + struct msr_data *msr_info)
> +{
> + return vmx_pt_mode_is_host_guest() &&
> + (msr_info->host_initiated ||
> + guest_cpuid_has(vcpu, X86_FEATURE_INTEL_PT));
> }
>
> static inline bool pt_output_base_valid(struct kvm_vcpu *vcpu, u64 base)
> @@ -1852,24 +1863,24 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> &msr_info->data);
> break;
> case MSR_IA32_RTIT_CTL:
> - if (!vmx_pt_mode_is_host_guest())
> + if (!pt_can_read_msr(vcpu, msr_info))
> return 1;
> msr_info->data = vmx->pt_desc.guest.ctl;
> break;
> case MSR_IA32_RTIT_STATUS:
> - if (!vmx_pt_mode_is_host_guest())
> + if (!pt_can_read_msr(vcpu, msr_info))
> return 1;
> msr_info->data = vmx->pt_desc.guest.status;
> break;
> case MSR_IA32_RTIT_CR3_MATCH:
> - if (!vmx_pt_mode_is_host_guest() ||
> + if (!pt_can_read_msr(vcpu, msr_info) ||
> !intel_pt_validate_cap(vmx->pt_desc.caps,
> PT_CAP_cr3_filtering))
> return 1;
> msr_info->data = vmx->pt_desc.guest.cr3_match;
> break;
> case MSR_IA32_RTIT_OUTPUT_BASE:
> - if (!vmx_pt_mode_is_host_guest() ||
> + if (!pt_can_read_msr(vcpu, msr_info) ||
> (!intel_pt_validate_cap(vmx->pt_desc.caps,
> PT_CAP_topa_output) &&
> !intel_pt_validate_cap(vmx->pt_desc.caps,
> @@ -1878,7 +1889,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> msr_info->data = vmx->pt_desc.guest.output_base;
> break;
> case MSR_IA32_RTIT_OUTPUT_MASK:
> - if (!vmx_pt_mode_is_host_guest() ||
> + if (!pt_can_read_msr(vcpu, msr_info) ||
> (!intel_pt_validate_cap(vmx->pt_desc.caps,
> PT_CAP_topa_output) &&
> !intel_pt_validate_cap(vmx->pt_desc.caps,
> @@ -1888,7 +1899,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> break;
> case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
> index = msr_info->index - MSR_IA32_RTIT_ADDR0_A;
> - if (!vmx_pt_mode_is_host_guest() ||
> + if (!pt_can_read_msr(vcpu, msr_info) ||
> (index >= 2 * vmx->pt_desc.nr_addr_ranges))
> return 1;
> if (index % 2)
> @@ -2156,6 +2167,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> return vmx_set_vmx_msr(vcpu, msr_index, data);
> case MSR_IA32_RTIT_CTL:
> if (!vmx_pt_mode_is_host_guest() ||
> + !guest_cpuid_has(vcpu, X86_FEATURE_INTEL_PT) ||
> vmx_rtit_ctl_check(vcpu, data) ||
> vmx->nested.vmxon)
> return 1;
> @@ -2164,14 +2176,14 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> pt_update_intercept_for_msr(vcpu);
> break;
> case MSR_IA32_RTIT_STATUS:
> - if (!pt_can_write_msr(vmx))
> + if (!pt_can_write_msr(vmx, msr_info))
> return 1;
> if (data & MSR_IA32_RTIT_STATUS_MASK)
> return 1;
> vmx->pt_desc.guest.status = data;
> break;
> case MSR_IA32_RTIT_CR3_MATCH:
> - if (!pt_can_write_msr(vmx))
> + if (!pt_can_write_msr(vmx, msr_info))
> return 1;
> if (!intel_pt_validate_cap(vmx->pt_desc.caps,
> PT_CAP_cr3_filtering))
> @@ -2179,7 +2191,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> vmx->pt_desc.guest.cr3_match = data;
> break;
> case MSR_IA32_RTIT_OUTPUT_BASE:
> - if (!pt_can_write_msr(vmx))
> + if (!pt_can_write_msr(vmx, msr_info))
> return 1;
> if (!intel_pt_validate_cap(vmx->pt_desc.caps,
> PT_CAP_topa_output) &&
> @@ -2191,7 +2203,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> vmx->pt_desc.guest.output_base = data;
> break;
> case MSR_IA32_RTIT_OUTPUT_MASK:
> - if (!pt_can_write_msr(vmx))
> + if (!pt_can_write_msr(vmx, msr_info))
> return 1;
> if (!intel_pt_validate_cap(vmx->pt_desc.caps,
> PT_CAP_topa_output) &&
> @@ -2201,7 +2213,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> vmx->pt_desc.guest.output_mask = data;
> break;
> case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
> - if (!pt_can_write_msr(vmx))
> + if (!pt_can_write_msr(vmx, msr_info))
> return 1;
> index = msr_info->index - MSR_IA32_RTIT_ADDR0_A;
> if (index >= 2 * vmx->pt_desc.nr_addr_ranges)
>
Powered by blists - more mailing lists