| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <9ac5cf9c-0afb-86d1-1ef2-b3a7138010f2@amd.com>
Date: Fri, 3 Dec 2021 12:59:42 -0600
From: Tom Lendacky <thomas.lendacky@....com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, x86@...nel.org,
Paolo Bonzini <pbonzini@...hat.com>,
Jim Mattson <jmattson@...gle.com>,
Joerg Roedel <joro@...tes.org>,
Vitaly Kuznetsov <vkuznets@...hat.com>,
Wanpeng Li <wanpengli@...cent.com>,
Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Ingo Molnar <mingo@...hat.com>,
Thomas Gleixner <tglx@...utronix.de>,
"H. Peter Anvin" <hpa@...or.com>,
Brijesh Singh <brijesh.singh@....com>
Subject: Re: [PATCH] KVM: SVM: Do not terminate SEV-ES guests on GHCB
validation failure
On 12/3/21 10:39 AM, Sean Christopherson wrote:
> On Thu, Dec 02, 2021, Tom Lendacky wrote:
>>
>> - return -EINVAL;
>> + return false;
>
> I'd really prefer that this helper continue to return 0/-EINVAL, there's no hint
> in the function name that this return true/false. And given the usage, there's
> no advantage to returning true/false. On the contrary, if there's a future
> condition where this needs to exit to userspace, we'll end up switching this all
> back to int.
I don't have any objection to that.
>
>> }
>> scratch_va = kvzalloc(len, GFP_KERNEL_ACCOUNT);
>> if (!scratch_va)
>> - return -ENOMEM;
>
> ...because this is wrong. Failure to allocate memory should exit to userspace,
> not report an error to the guest.
>
>> + goto e_scratch;
>>
>> if (kvm_read_guest(svm->vcpu.kvm, scratch_gpa_beg, scratch_va, len)) {
>> /* Unable to copy scratch area from guest */
>> pr_err("vmgexit: kvm_read_guest for scratch area failed\n");
>>
>> kvfree(scratch_va);
>> - return -EFAULT;
>> + goto e_scratch;
>
> Same here, failure to read guest memory is a userspace issue and needs to be
> reported to userspace.
But it could be a guest issue as well... whichever is preferred is ok by me.
>
>> }
>>
>> /*
>
> IMO, this should be the patch (compile tested only).
I can test this, but probably won't be able to get to it until Monday.
Thanks,
Tom
>
> ---
> arch/x86/include/asm/sev-common.h | 11 +++++
> arch/x86/kvm/svm/sev.c | 75 +++++++++++++++++++------------
> 2 files changed, 58 insertions(+), 28 deletions(-)
>
> diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h
> index 2cef6c5a52c2..6acaf5af0a3d 100644
> --- a/arch/x86/include/asm/sev-common.h
> +++ b/arch/x86/include/asm/sev-common.h
> @@ -73,4 +73,15 @@
>
> #define GHCB_RESP_CODE(v) ((v) & GHCB_MSR_INFO_MASK)
>
> +/*
> + * Error codes related to GHCB input that can be communicated back to the guest
> + * by setting the lower 32-bits of the GHCB SW_EXITINFO1 field to 2.
> + */
> +#define GHCB_ERR_NOT_REGISTERED 1
> +#define GHCB_ERR_INVALID_USAGE 2
> +#define GHCB_ERR_INVALID_SCRATCH_AREA 3
> +#define GHCB_ERR_MISSING_INPUT 4
> +#define GHCB_ERR_INVALID_INPUT 5
> +#define GHCB_ERR_INVALID_EVENT 6
> +
> #endif
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 713e3daa9574..60c6d7b216eb 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -2357,20 +2357,25 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm)
> {
> struct kvm_vcpu *vcpu;
> struct ghcb *ghcb;
> - u64 exit_code = 0;
> + u64 exit_code;
> + u64 reason;
>
> ghcb = svm->sev_es.ghcb;
>
> - /* Only GHCB Usage code 0 is supported */
> - if (ghcb->ghcb_usage)
> - goto vmgexit_err;
> -
> /*
> - * Retrieve the exit code now even though is may not be marked valid
> + * Retrieve the exit code now even though it may not be marked valid
> * as it could help with debugging.
> */
> exit_code = ghcb_get_sw_exit_code(ghcb);
>
> + /* Only GHCB Usage code 0 is supported */
> + if (ghcb->ghcb_usage) {
> + reason = GHCB_ERR_INVALID_USAGE;
> + goto vmgexit_err;
> + }
> +
> + reason = GHCB_ERR_MISSING_INPUT;
> +
> if (!ghcb_sw_exit_code_is_valid(ghcb) ||
> !ghcb_sw_exit_info_1_is_valid(ghcb) ||
> !ghcb_sw_exit_info_2_is_valid(ghcb))
> @@ -2449,6 +2454,7 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm)
> case SVM_VMGEXIT_UNSUPPORTED_EVENT:
> break;
> default:
> + reason = GHCB_ERR_INVALID_EVENT;
> goto vmgexit_err;
> }
>
> @@ -2457,22 +2463,25 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *svm)
> vmgexit_err:
> vcpu = &svm->vcpu;
>
> - if (ghcb->ghcb_usage) {
> + if (reason == GHCB_ERR_INVALID_USAGE) {
> vcpu_unimpl(vcpu, "vmgexit: ghcb usage %#x is not valid\n",
> ghcb->ghcb_usage);
> + } else if (reason == GHCB_ERR_INVALID_EVENT) {
> + vcpu_unimpl(vcpu, "vmgexit: exit code %#llx is not valid\n",
> + exit_code);
> } else {
> - vcpu_unimpl(vcpu, "vmgexit: exit reason %#llx is not valid\n",
> + vcpu_unimpl(vcpu, "vmgexit: exit code %#llx input is not valid\n",
> exit_code);
> dump_ghcb(svm);
> }
>
> - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
> - vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON;
> - vcpu->run->internal.ndata = 2;
> - vcpu->run->internal.data[0] = exit_code;
> - vcpu->run->internal.data[1] = vcpu->arch.last_vmentry_cpu;
> + /* Clear the valid entries fields */
> + memset(ghcb->save.valid_bitmap, 0, sizeof(ghcb->save.valid_bitmap));
>
> - return -EINVAL;
> + ghcb_set_sw_exit_info_1(ghcb, 2);
> + ghcb_set_sw_exit_info_2(ghcb, reason);
> +
> + return 1;
> }
>
> void sev_es_unmap_ghcb(struct vcpu_svm *svm)
> @@ -2542,14 +2551,14 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
> scratch_gpa_beg = ghcb_get_sw_scratch(ghcb);
> if (!scratch_gpa_beg) {
> pr_err("vmgexit: scratch gpa not provided\n");
> - return -EINVAL;
> + goto e_scratch;
> }
>
> scratch_gpa_end = scratch_gpa_beg + len;
> if (scratch_gpa_end < scratch_gpa_beg) {
> pr_err("vmgexit: scratch length (%#llx) not valid for scratch address (%#llx)\n",
> len, scratch_gpa_beg);
> - return -EINVAL;
> + goto e_scratch;
> }
>
> if ((scratch_gpa_beg & PAGE_MASK) == control->ghcb_gpa) {
> @@ -2567,7 +2576,7 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
> scratch_gpa_end > ghcb_scratch_end) {
> pr_err("vmgexit: scratch area is outside of GHCB shared buffer area (%#llx - %#llx)\n",
> scratch_gpa_beg, scratch_gpa_end);
> - return -EINVAL;
> + goto e_scratch;
> }
>
> scratch_va = (void *)svm->sev_es.ghcb;
> @@ -2580,7 +2589,7 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
> if (len > GHCB_SCRATCH_AREA_LIMIT) {
> pr_err("vmgexit: scratch area exceeds KVM limits (%#llx requested, %#llx limit)\n",
> len, GHCB_SCRATCH_AREA_LIMIT);
> - return -EINVAL;
> + goto e_scratch;
> }
> scratch_va = kvzalloc(len, GFP_KERNEL_ACCOUNT);
> if (!scratch_va)
> @@ -2608,6 +2617,12 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
> svm->sev_es.ghcb_sa_len = len;
>
> return 0;
> +
> +e_scratch:
> + ghcb_set_sw_exit_info_1(ghcb, 2);
> + ghcb_set_sw_exit_info_2(ghcb, GHCB_ERR_INVALID_SCRATCH_AREA);
> +
> + return 1;
> }
>
> static void set_ghcb_msr_bits(struct vcpu_svm *svm, u64 value, u64 mask,
> @@ -2658,7 +2673,7 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm)
>
> ret = svm_invoke_exit_handler(vcpu, SVM_EXIT_CPUID);
> if (!ret) {
> - ret = -EINVAL;
> + /* Error, keep GHCB MSR value as-is */
> break;
> }
>
> @@ -2694,10 +2709,13 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm)
> GHCB_MSR_TERM_REASON_POS);
> pr_info("SEV-ES guest requested termination: %#llx:%#llx\n",
> reason_set, reason_code);
> - fallthrough;
> +
> + ret = -EINVAL;
> + break;
> }
> default:
> - ret = -EINVAL;
> + /* Error, keep GHCB MSR value as-is */
> + break;
> }
>
> trace_kvm_vmgexit_msr_protocol_exit(svm->vcpu.vcpu_id,
> @@ -2721,14 +2739,18 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
>
> if (!ghcb_gpa) {
> vcpu_unimpl(vcpu, "vmgexit: GHCB gpa is not set\n");
> - return -EINVAL;
> +
> + /* Without a GHCB, just return right back to the guest */
> + return 1;
> }
>
> if (kvm_vcpu_map(vcpu, ghcb_gpa >> PAGE_SHIFT, &svm->sev_es.ghcb_map)) {
> /* Unable to map GHCB from guest */
> vcpu_unimpl(vcpu, "vmgexit: error mapping GHCB [%#llx] from guest\n",
> ghcb_gpa);
> - return -EINVAL;
> +
> + /* Without a GHCB, just return right back to the guest */
> + return 1;
> }
>
> svm->sev_es.ghcb = svm->sev_es.ghcb_map.hva;
> @@ -2788,11 +2810,8 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
> default:
> pr_err("svm: vmgexit: unsupported AP jump table request - exit_info_1=%#llx\n",
> control->exit_info_1);
> - ghcb_set_sw_exit_info_1(ghcb, 1);
> - ghcb_set_sw_exit_info_2(ghcb,
> - X86_TRAP_UD |
> - SVM_EVTINJ_TYPE_EXEPT |
> - SVM_EVTINJ_VALID);
> + ghcb_set_sw_exit_info_1(ghcb, 2);
> + ghcb_set_sw_exit_info_2(ghcb, GHCB_ERR_INVALID_INPUT);
> }
>
> ret = 1;
>
> base-commit: 70f433c2193fbfb5541ef98f973e087ddf2f9dfb
> --
>
Powered by blists - more mailing lists